peji/Alta-Proxy-Tool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix: keep Alta bearer out of proxy command lines

Browse Source
This commit is contained in:
PageZ948
2026-08-19 22:26:47 +00:00
parent 582fc46914
commit 808698dc46
15 changed files with 207 additions and 101 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plans/2026-08-19-apt-security-foundation.md
+4 -4
View File
@@ -36,7 +36,7 @@ Feature discovery begins only after Phase A passes independent security review a
## Non-negotiable guardrails
- GitPeji is the only source of truth. Do not fetch from, push to, publish on, or update from GitHub.
- GitPeji is the only source of truth. Do not fetch from, push to, publish on, or update from alternate source hosts.
- Use a fresh worktree from GitPeji `master` at `a80074ac57b7a4517837b5d95754f5e6433df3ac` or newer.
- Preserve current Tool Hub downloads and production visibility until Zac approves replacement.
- Do not use real Alta cookies in automated tests; use conspicuous synthetic sentinels.
@@ -73,7 +73,7 @@ git worktree add -b hardening/security-foundation /home/peji/worktrees/apt-secur
git -C /home/peji/worktrees/apt-security-foundation status --short --branch
```
**Expected:** clean branch based on exact GitPeji `origin/master`; no GitHub remote used.
**Expected:** clean branch based on exact GitPeji `origin/master`; no alternate-host remote used.
**Commit:** `docs: record APT security hardening baseline`
@@ -387,7 +387,7 @@ npm run check
**Files:**
- Create: `.gitea/workflows/ci.yml`
- Create: `.gitea/workflows/release.yml`
- Remove or retire: `.github/workflows/deploy-pages.yml`
- Remove or retire the legacy alternate-host Pages workflow.
- Modify: `docs/index.html`
- Create: `scripts/verify-kit.js`
@@ -395,7 +395,7 @@ npm run check
1. CI gate: `npm ci`, syntax, tests, audit policy, Windows unpacked build, kit verification, secret scan.
2. Release gate: tag/version match, clean source, approved helper checksum, exact artifact hashes, SBOM, checksums, retained logs.
3. Point docs/downloads to GitPeji or the approved Tool Hub route, never GitHub.
3. Point docs/downloads to GitPeji or the approved Tool Hub route, never an alternate source host.
4. Publish no artifact automatically until the first manual release rehearsal passes.
5. Rehearse on a non-production candidate tag and verify fresh download/extraction.