simplify sigchain http distribution
Some checks failed
CI / fmt, clippy, docs (push) Failing after 5s
CI / test (ubuntu-latest) (push) Failing after 5s
CI / iroh integration smoke tests (push) Failing after 4s
CodeQL / Analyze Rust (push) Failing after 5s
Security / RustSec cargo-audit (push) Failing after 4s
CI / test (macos-latest) (push) Has been cancelled
CI / test (windows-latest) (push) Has been cancelled

This commit is contained in:
Eric Wendland 2026-07-19 03:43:06 +02:00
commit 538b52bdb6
12 changed files with 66 additions and 72 deletions

View file

@ -584,9 +584,9 @@ resource-scoped capability decisions.
clearly preserving claims/receipts only in the canonical bundle.
- `[x]` `verify-sigchain` auto-detects JSONL or canonical bundles and binds
a bundle's namespace and chain ID to local trust.
- `[x]` Specify the backend-neutral distribution-source contract and a static
HTTP full-snapshot profile at
`/.well-known/sshsigchain/v1/<chain-id>/chain.sscb`.
- `[x]` Specify the backend-neutral distribution-source contract and a
single-file static HTTP full-snapshot profile at an arbitrary, explicitly
configured URL, without well-known discovery or URL-based trust.
- `[ ]` Implement automatic distribution fetchers.
- Acceptance criteria: an HTTP fetcher enforces streaming limits,
conditional caching, redirect policy, trust-tuple matching, accepted-head