james.maesandCodex GPT-6
38dd5c1488
This replaces the blocked history in PR #3 with one properly attributed, signed/DCO commit. The owner personally reviewed and approved PR #3 in the release session. **No file changes from the approved candidate:** bothbaee14f492ande605df62c4have exact Git treea85912cbad. Original PR #3 and its commits are preserved for review history. Historical commits were locally signed but GitHub reported no_user; protected merge checks those introduced commits even for squash merging. This commit resolves attribution without bypassing or weakening signature rules. The reader, Settings, themes, source highlighting/split, live reload, file associations, Print/PDF, About credits, toolbar/footer/editor fixes, user-first README/screenshots and developer guides are exactly the approved implementation. Stable/dev separation and protected Azure signing caller are unchanged. Evidence: - Approved treebaee14f/ CI38285775463 passes all checks. Downloaded focused29/29, published111/111, stable110/110 and dev110/110 TRXs have zero failures/skips. Core coverage100% lines/98.86% branches; actual update/restart/coexistence/default-preservation receipts verify. - New single-commit hooks, online workflow security, signing and DCO pass. GitHub must rerun all required checks on this commit; results are not copied across SHAs. - Live repository setup validates18 Actions-bound checks, with only fuzzing added and all prior protections preserved. - OpenSSF project15417 is now owner-reviewed and saved at70% under owner-confirmed CDLA-Permissive2.0. This is an in-progress assessment, not a passing badge. - Production CI OIDC and signed1.0/dev publication remain required; local representative signing is not CI proof. Substantial AI assistance: Codex (GPT-6). Supersedes PR #3. Release work remains tracked in #33. Closes #4, #6, #7, #8, #9, #10, #11, #12, #13, #14, #15, #16, #17, #18, #19, #20, #21, #22, #23, #24, #25, #26, #27, #28, #29, #32, #34. Refs #1, #5, #30, #31, #33. Signed-off-by: James Maes <james@kof22.com> Co-authored-by: Codex GPT-6 <noreply@openai.com>
21 lines
1.0 KiB
JSON
21 lines
1.0 KiB
JSON
{
|
|
"schemaVersion": 1,
|
|
"badge": {
|
|
"applicability": "required",
|
|
"reason": "Public open-source Product enrolled as project 15417. Evidence-backed maintainer assessment remains required; enrollment does not establish passing status.",
|
|
"projectUrl": "https://www.bestpractices.dev/en/projects/15417",
|
|
"evidence": "docs/security/best-practices.md"
|
|
},
|
|
"fuzzing": {
|
|
"applicability": "required",
|
|
"reason": "Untrusted Markdown/HTML/frontmatter, source ranges/folds, resource URLs, imported theme JSON and activation JSON are parser boundaries. Seeded mutation targets verify unsafe acceptance as well as exceptions.",
|
|
"targets": [
|
|
"tests/MarkdownViewr.Windows.Core.Tests/SecurityFuzzTests.cs",
|
|
"tests/MarkdownViewr.Windows.UiTests/ActivationFuzzTests.cs"
|
|
],
|
|
"command": "dotnet test tests/MarkdownViewr.Windows.Core.Tests -c Release -p:Platform=x64 --no-build --no-restore --filter Category=Fuzz",
|
|
"workflow": ".github/workflows/fuzz.yml",
|
|
"evidence": "docs/security/fuzzing.md"
|
|
}
|
|
}
|