nsauditor-ai 0.2.46 → 0.2.47
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +14 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -17,6 +17,20 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
|
|
|
17
17
|
|
|
18
18
|
## What's New
|
|
19
19
|
|
|
20
|
+
**Paired release with the Enterprise timestamp-integrity patch (CE 0.2.47 / Enterprise 0.40.3).** No CE
|
|
21
|
+
behaviour change and **the peer floor stays `>=0.2.45`, unraised** — nothing in this cycle needs new
|
|
22
|
+
Community Edition code. This bump exists because npm freezes a README at publish time, so the page
|
|
23
|
+
you are reading can only be corrected by publishing, and it pairs with Enterprise 0.40.3. What
|
|
24
|
+
Enterprise fixes, in case you run the pair — all on the **opt-in** RFC 3161 path
|
|
25
|
+
(`NSAUDITOR_TSA_URL`; no default authority): a granted timestamp carries the digest it attests, and
|
|
26
|
+
nothing compared it to the digest the request carried — so a replay or a caching proxy could return a
|
|
27
|
+
valid timestamp **for a different artifact** and it was written as evidence. It is now refused. And the verification instruction printed on every timestamped compliance report could not be
|
|
28
|
+
run: it passed `-queryfile` and `-data` together, which openssl rejects outright with no verdict, and
|
|
29
|
+
named a `.tsq` file no pack contains. Timestamping remains **opt-in** (`NSAUDITOR_TSA_URL`; no default
|
|
30
|
+
authority). ⚠️ **If you have timestamped packs produced before Enterprise 0.40.3, the fix is not
|
|
31
|
+
retroactive** — re-verify them with `openssl ts -verify -in <file>.tsr -data <file> -CAfile <bundle>`,
|
|
32
|
+
and note that a `.tsr` which fails there was never a valid timestamp for that artifact.
|
|
33
|
+
|
|
20
34
|
**Paired release with the Enterprise evidence-integrity patch (CE 0.2.46 / Enterprise 0.40.2).** No CE
|
|
21
35
|
code change — this publish exists because npm freezes this README at publish time: it delivers the
|
|
22
36
|
page corrections made since 0.2.45 (the eighth framework was missing from four places on this page;
|