Node / ReticulumProjects / MeshChatX.git / commits / 0a56c47

Parents : 415abdb

Author : Ivan <ivan@quad4.io>

Signature : Invalid signer <e46112d44649266d71fe2193e00a4710>, author is <ivan@quad4.io>

Date : 2026-07-13T10:23:53-05:00

chore: remove unnecessary blank line

2 files changed, 0 insertions(+), 2 deletions(-)

M SECURITY.md -1

M Taskfile.yml -1

--- a/SECURITY.md

+++ b/SECURITY.md

**Optional extra signatures:** If you see `*.cosign.bundle` files next to a binary, those are additional attestations from a **repository-managed signing key** (when the project enables it). They are separate from the SLSA `*.intoto.jsonl` files. Either or both may be present depending on configuration.

### Source tree integrity (`.rsm`)

The repository root includes a signed rnid message file, `meshchatx.rsm`. It embeds a SHA-256 inventory of every git-tracked file (except itself). CI verifies the signature against the required signer identity `e46112d44649266d71fe2193e00a4710`, then re-hashes file bytes. Jobs also recheck the inventory at the end so a compromised runner cannot silently add or modify tracked files.

--- a/Taskfile.yml

+++ b/Taskfile.yml

- cd "{{.ANDROID_DIR}}" && ./gradlew clean

- rm -rf "{{.PYTHON_SRC_DIR}}/meshchatx" "{{.ANDROID_DIR}}/app/src/main/python/meshchatx"

tree-manifest:

desc: Print SHA-256 inventory of git-tracked files (excludes meshchatx.rsm)

cmds: