@claudinite/cli 1.61022.1 → 1.61022.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +26 -0
- package/manifest.json +9 -9
- package/manifest.sig.json +1 -1
- package/package.json +1 -1
package/README.md
ADDED
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
# @claudinite/cli
|
|
2
|
+
|
|
3
|
+
The release manifest of the Claudinite engine, `cn`. It holds no engine code: the binary for each
|
|
4
|
+
platform is in `@claudinite/cli-<platform>`, and this package says which binaries make up a
|
|
5
|
+
release and vouches for them.
|
|
6
|
+
|
|
7
|
+
Install the engine in a repository with `npx --yes @claudinite/setup`, which reads the version the
|
|
8
|
+
repository pins and checks everything below before it runs anything.
|
|
9
|
+
|
|
10
|
+
## Provenance
|
|
11
|
+
|
|
12
|
+
These packages carry no npm provenance attestation: npm attests only builds from a public
|
|
13
|
+
repository, and the engine's source is private. A release is vouched for by its own signature
|
|
14
|
+
instead:
|
|
15
|
+
|
|
16
|
+
- `manifest.json` names the version, the commit it was built from, and the SHA-256 and size of
|
|
17
|
+
each platform's binary.
|
|
18
|
+
- `manifest.sig.json` signs `manifest.json` with the release key, and carries the release key's
|
|
19
|
+
certificate, signed by the Claudinite root key.
|
|
20
|
+
- `@claudinite/setup` and `cn` hold the root keys. They check the certificate against them, the
|
|
21
|
+
signature against the certificate, and each binary against its manifest entry, and refuse a
|
|
22
|
+
release where any of those fails. A repository also pins the hash of its `manifest.json`, so a
|
|
23
|
+
later change to a published release is refused too.
|
|
24
|
+
|
|
25
|
+
npm's own integrity hash only says the tarball is the one npm stored; the manifest signature is
|
|
26
|
+
what says Claudinite built it.
|
package/manifest.json
CHANGED
|
@@ -1,16 +1,16 @@
|
|
|
1
1
|
{
|
|
2
2
|
"v": 1,
|
|
3
|
-
"version": "1.61022.
|
|
4
|
-
"builtAt": "2026-10-
|
|
5
|
-
"commit": "
|
|
3
|
+
"version": "1.61022.2",
|
|
4
|
+
"builtAt": "2026-10-22T17:26:23Z",
|
|
5
|
+
"commit": "8521083",
|
|
6
6
|
"goVersion": "go1.26.9",
|
|
7
|
-
"updaterDigest": "
|
|
7
|
+
"updaterDigest": "ca6f4817a8b256bfa36218692e50040456c24ceac4553ceb869e40143efcf52a",
|
|
8
8
|
"binaries": {
|
|
9
|
-
"linux-x64": {"file": "cn", "sha256": "
|
|
10
|
-
"linux-arm64": {"file": "cn", "sha256": "
|
|
11
|
-
"darwin-x64": {"file": "cn", "sha256": "
|
|
12
|
-
"darwin-arm64": {"file": "cn", "sha256": "
|
|
13
|
-
"windows-x64": {"file": "cn.exe", "sha256": "
|
|
9
|
+
"linux-x64": {"file": "cn", "sha256": "ed6cb1caaa51a24c38d82ce1cb4344731c7efa33d51728cdabedacbdf4b574bb", "size": 15261858},
|
|
10
|
+
"linux-arm64": {"file": "cn", "sha256": "12c2762e5248def69ced9016ef0e76d8784c4564cc442b601ecbfe50d8621659", "size": 13828258},
|
|
11
|
+
"darwin-x64": {"file": "cn", "sha256": "bb9049be7a169eb453c23e5d0baa3fcd87e7ca657ef28a23ba334c811b69a625", "size": 15505152},
|
|
12
|
+
"darwin-arm64": {"file": "cn", "sha256": "0667d03c197f1178a97382ab3bda168cd6172dd0a99f3df300f64139586faf0b", "size": 14119042},
|
|
13
|
+
"windows-x64": {"file": "cn.exe", "sha256": "46108e7d8c332cc52cdc413032a0cbfdf70ad2b57e59d95495c73c74789359a7", "size": 15584256}
|
|
14
14
|
},
|
|
15
15
|
"launcher": "c0259f07c6a875dbb03293d34cca199c8074f2238ec3c2bcff49fcf0657b6f7b",
|
|
16
16
|
"testedPacks": {}
|
package/manifest.sig.json
CHANGED
|
@@ -3,5 +3,5 @@
|
|
|
3
3
|
"payload": "eyJ2IjoxLCJrZXlJZCI6ImM3NzQwNWM2ZDA4NzExODYiLCJwdWJsaWNLZXkiOiI0UHlTQzRTbG5MakJ1cVY2Qll4eU9XWUtLOWkzV295NkZCQ1ZNckF6clRzIiwidXNlIjoibWFuaWZlc3QiLCJpc3N1ZXIiOiJlYTg1ZjM1NDIxZjM3NWZjIiwibm90QmVmb3JlIjoiMjAyNi0xMC0wM1QxNjozNjozN1oiLCJub3RBZnRlciI6IjIwMjctMTAtMDNUMTY6MzY6MzdaIn0",
|
|
4
4
|
"signature": "ex4GNEE3PIUj3Ue6X2TZnbB5E6G-DVrGNaYdvI13NuOauoJYilB_54TyAH490IS9-IZiu3BKVYpigm3uDTXSBw"
|
|
5
5
|
},
|
|
6
|
-
"signature": "
|
|
6
|
+
"signature": "J27pqov_cKKtJIcSf9xAB2NEOL-9r357CBQ_O794S2ckJHPxUR_iZxEzr3MyqnvWeRoa3pnzemaL0D6eDHWIAg"
|
|
7
7
|
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@claudinite/cli",
|
|
3
|
-
"version": "1.61022.
|
|
3
|
+
"version": "1.61022.2",
|
|
4
4
|
"description": "Claudinite engine release manifest and engine setup",
|
|
5
5
|
"license": "UNLICENSED",
|
|
6
6
|
"repository": {"type": "git", "url": "git+https://github.com/Claudinite/Engine.git"},
|