Contributions are accepted under the repository's MIT OR Apache-2.0 license. Every commit must
carry one or more non-duplicate human Signed-off-by: Full Name <address> trailers and exactly one
AI-Disclosure: trailer. Use AI-Disclosure: none (exact lowercase) when no assistant or automated
tool materially contributed. Otherwise use
AI-Disclosure: Tool | material contribution and review detail, for example
AI-Disclosure: Codex | implemented artifact validation; human reviewed and tested the security invariants.
Vague values, placeholders, missing review detail, duplicate trailers, malformed identities, and bot-only
sign-offs are rejected.
Initial CODEOWNERS review routes all paths, with explicit trust/protocol and
workflow coverage, to @joshuajbouw. Expand ownership only through a reviewed
change that establishes each maintainer's responsibility and protected-review
role; do not weaken the security-path entries to make a change self-approving.
The author remains responsible for understanding, explaining, defending, testing, and responding to review of every submitted change, including code drafted with an assistant. Reviewers may ask for an independent reproduction or a narrower patch. Keep protocol, schema, canonical digest, and trust-boundary changes explicit; do not add compatibility aliases for the retired legacy identity.
Before opening a pull request, run:
cargo fmt --all -- --check
cargo test --workspace --all-targets --locked
cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
python3 -m unittest -v tests/conformance/test_runner.py
python3 -m unittest -v tests/conformance/test_derivation_vectors.py
python3 -m unittest -v tests/test_check_dco.py
python3 -m unittest -v docs/repository-template/tests/test_template.pyCandidate tests run in a read-only pull_request job with checkout credentials
not persisted. A separate base-owned pull_request_target policy check
never executes candidate files and rejects PR changes to required workflows or
policy scripts, preventing a candidate from spoofing the required CI context.
Deliberate policy changes use the separately protected maintainer path.
Security-sensitive changes should include a regression test and explain the invariant being preserved. Do not commit private TUF keys, credentials, unsigned release artifacts, or local cache directories.