secryst 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 185de54f6ce981b7739770b422262452752460c5559e029e4b5039f67f6483ef
-  data.tar.gz: df7df11ff4fc5a476074e8155448a3b1ab0577ab693c37e796a98c0cf7934af8
+  metadata.gz: 41fa8b9cc35c52b6ed2a5ffb898d40f83df55e89533d48878e899bcf20ee142f
+  data.tar.gz: 697eae0009ab525080e429e213b09b4b06a828a4157db9649a6cea04abd16dd7
 SHA512:
-  metadata.gz: 1c51c600385d5a05e9f9298925f2ba7fb1c32a49b26f0345d877c8a11da04459a50d4adb5a23aedac480212e5b83af621a917db472382194ddeb716bd2ae5c4f
-  data.tar.gz: 558249e6dcf7ec5cb927512f6487ee8edd911cb06f9f1685bd4ab1b00ec651e230940880cc2c0f3cd61a095a37c3dc0cad046ea4299b25acdd5ee2669ba35df4
+  metadata.gz: 007d2fb6944c93ee1e38ace06e06a025336b00318c7a5446e9daf33cc8ab0448caa4646dd943176452d1d4fe61ea3d706e3713b0deabc9f526b24e600707f432
+  data.tar.gz: 8dfdc84550803d2d87566fc1c70c268505b05fe963213e98e12a89a16cada7e07eedfcb8cc138738b615b346db554b13fa71a1a352ab721581b359d3d588faca

data/lib/secryst/imf.rb

@@ -15,7 +15,7 @@ module Secryst
     EOS_ID = 1
     UNK_ID = 2
 
-    DEFAULT_INDEX_URL = "https://raw.githubusercontent.com/interscript/interscript-ml/main/models.yaml"
+    DEFAULT_INDEX_URL = "https://github.com/interscript/interscript-ml/releases/download/index-v1/models-index.yaml"
 
     class FormatError < StandardError; end
     class RegistryError < StandardError; end
@@ -142,7 +142,7 @@ module Secryst
 
       def load_index(source)
         text = if source.start_with?("http://", "https://")
-          URI.open(source) { |remote| remote.read }
+          fetch_index_with_sidecar(source)
         else
           File.read(source)
         end
@@ -150,6 +150,28 @@ module Secryst
         raise RegistryError, "index must have version: 1" if raw["version"] != 1
         raw.fetch("models", {})
       end
+      public :load_index
+
+      # HTTP sources must ship a sibling .sha256 sidecar; verify the
+      # body against it before parsing (GitHub Releases index assets do).
+      def fetch_index_with_sidecar(source)
+        body = URI.open(source, "rb") { |remote| remote.read }
+        sidecar =
+          begin
+            URI.open("#{source}.sha256") { |remote| remote.read }
+          rescue OpenURI::HTTPError => e
+            raise RegistryError, "index sha256 sidecar missing: #{source}.sha256 (#{e.message})"
+          end
+        expected = sidecar.to_s.strip.split(/\s+/).first.to_s
+        unless expected.match?(/\A[0-9a-fA-F]{64}\z/)
+          raise RegistryError, "index sha256 sidecar malformed: #{source}.sha256"
+        end
+        actual = Digest::SHA256.hexdigest(body)
+        unless actual == expected.downcase
+          raise RegistryError, "index sha256 mismatch: got #{actual}, sidecar says #{expected.downcase}"
+        end
+        body.force_encoding(Encoding::UTF_8)
+      end
     end
   end
 end

data/lib/secryst/version.rb

@@ -1,3 +1,3 @@
 module Secryst
-  VERSION = "1.0.0"
+  VERSION = "1.0.1"
 end

data/spec/secryst/imf_spec.rb

@@ -178,3 +178,67 @@ RSpec.describe Secryst::IMF do
     end
   end
 end
+
+  describe "index distribution contract" do
+    it "pins DEFAULT_INDEX_URL to a GitHub Release asset, never raw" do
+      expect(Secryst::IMF::DEFAULT_INDEX_URL).to match(
+        %r{\Ahttps://github\.com/interscript/interscript-ml/releases/download/index-v\d+/models-index\.yaml\z}
+      )
+      expect(Secryst::IMF::DEFAULT_INDEX_URL).not_to include("raw.githubusercontent")
+    end
+
+    it "verifies the .sha256 sidecar on HTTP index fetches" do
+      require "socket"
+      body = "version: 1\nmodels: {}\n"
+      good = Digest::SHA256.hexdigest(body)
+      bad = "0" * 64
+
+      serve = lambda do |sidecar, &blk|
+        server = TCPServer.new("127.0.0.1", 0)
+        port = server.addr[1]
+        thread = Thread.new do
+          loop do
+            client = server.accept rescue break
+            request = client.readline
+            client.each_line { |line| break if line == "\r\n" }
+            path = request.split(" ")[1]
+            case path
+            when "/models-index.yaml"
+              client.write("HTTP/1.1 200 OK\r\nContent-Length: #{body.bytesize}\r\n\r\n#{body}")
+            when "/models-index.yaml.sha256"
+              if sidecar.nil?
+                client.write("HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\n\r\n")
+              else
+                payload = "#{sidecar}  models-index.yaml\n"
+                client.write("HTTP/1.1 200 OK\r\nContent-Length: #{payload.bytesize}\r\n\r\n#{payload}")
+              end
+            else
+              client.write("HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\n\r\n")
+            end
+            client.close
+          end
+        end
+        begin
+          blk.call("http://127.0.0.1:#{port}/models-index.yaml")
+        ensure
+          server.close
+          thread.join(5)
+        end
+      end
+
+      serve.call(good) do |url|
+        entries = Secryst::IMF.load_index(url)
+        expect(entries).to eq({})
+      end
+      serve.call(bad) do |url|
+        expect {
+          Secryst::IMF.load_index(url)
+        }.to raise_error(Secryst::IMF::RegistryError, /index sha256 mismatch/)
+      end
+      serve.call(nil) do |url|
+        expect {
+          Secryst::IMF.load_index(url)
+        }.to raise_error(Secryst::IMF::RegistryError, /index sha256/)
+      end
+    end
+  end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: secryst
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Interscript / Secryst contributors
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-20 00:00:00.000000000 Z
+date: 2026-08-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor