4dbac421ab
feat(advisories): add provisional GHSA feed ( #242 )
...
* feat(advisories): add provisional ghsa feed
* fix(workflows): include advisory signatures in checksums
* fix(workflows): mirror ghsa feed at release root
* feat(advisories): consolidate ghsa into agent feed
* ci(advisories): consolidate ghsa during nvd poll
* fix(advisories): retain unreplaced ghsa feed entries
* chore(skills): bump advisory feed consumers
* fix(release): resolve ts import closure dry run
* fix(release): preserve urls while stripping comments
* fix(release): ignore skill test-only changes
* fix(advisories): follow ghsa pagination links
* test(advisories): add nvd ghsa pipeline dry run
2026-05-24 21:41:59 +03:00
1e48a955cc
fix(release): exclude tests from skill payloads ( #230 )
...
* fix(release): exclude tests from skill payloads
* fix(release): normalize test path filtering
* fix(release): prefer GitHub artifacts for non-OpenClaw installs
* fix(release): keep legacy ClawHub publishing
* fix(release): address skill packaging review feedback
* chore(skills): bump release versions
* feat(skills): surface recommended platforms
* docs(skills): add signed release verification
* fix(skills): normalize PR version bumps
---------
Co-authored-by: David Abutbul <David.a@prompt.security >
2026-05-14 14:38:58 +03:00
e4c1e07544
fix(skills-catalog): resolve platform metadata fallbacks ( #229 )
...
* fix(skills-catalog): resolve platform metadata fallbacks
* fix(skills-catalog): harden platform metadata guards
2026-05-10 16:07:31 +03:00
f6afc80aa2
chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 ( #218 )
...
Bumps [actions/setup-node](https://github.com/actions/setup-node ) from 6.3.0 to 6.4.0.
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 6.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-05 12:58:47 +03:00
9462fe7e1b
chore(deps): bump actions/configure-pages from 5.0.0 to 6.0.0 ( #219 )
...
Bumps [actions/configure-pages](https://github.com/actions/configure-pages ) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/actions/configure-pages/releases )
- [Commits](https://github.com/actions/configure-pages/compare/983d7736d9b0ae728b81ab479565c72886d7745b...45bfe0192ca1faeb007ade9deae92b16b8254a0d )
---
updated-dependencies:
- dependency-name: actions/configure-pages
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-05 12:43:36 +03:00
e3337d0f33
chore(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 ( #220 )
...
Bumps [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact ) from 4.0.0 to 5.0.0.
- [Release notes](https://github.com/actions/upload-pages-artifact/releases )
- [Commits](https://github.com/actions/upload-pages-artifact/compare/7b1f4a764d45c48632c6b24a0339c27f5614fb0b...fc324d3547104276b827a68afc52ff2a11cc49c9 )
---
updated-dependencies:
- dependency-name: actions/upload-pages-artifact
dependency-version: 5.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-05 11:13:41 +03:00
b39fe73e45
chore(deps): bump actions/deploy-pages from 4.0.5 to 5.0.0 ( #159 )
...
Bumps [actions/deploy-pages](https://github.com/actions/deploy-pages ) from 4.0.5 to 5.0.0.
- [Release notes](https://github.com/actions/deploy-pages/releases )
- [Commits](https://github.com/actions/deploy-pages/compare/d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e...cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 )
---
updated-dependencies:
- dependency-name: actions/deploy-pages
dependency-version: 5.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-08 23:53:52 +03:00
e715c8a625
chore(deps): bump actions/setup-node from 6.2.0 to 6.3.0 ( #120 )
...
Bumps [actions/setup-node](https://github.com/actions/setup-node ) from 6.2.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/6044e13b5dc448c55e2357c09f80417699197238...53b83947a5a98c8d113130e565377fae1a50d02f )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 6.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-10 16:51:09 +02:00
7c0aa37a05
fix pipelines ( #83 )
2026-02-26 12:25:52 +02:00
fefecaa60a
feat(wiki): add full in-app wiki browser and llms index ( #80 )
...
* feat(wiki): add full in-app wiki browser and llms index
* feat(wiki): auto-generate per-page llms exports
* vuln package
* fix(wiki): guard malformed route decoding
* fix(wiki): preserve markdown anchor fragments across page links
* refactor(markdown): share default render components
* fix(wiki): block unsafe markdown link schemes
* fix(wiki): block unsafe markdown image schemes
* docs(wiki): migrate root docs into wiki pages
* chore(wiki): de-track generated llms exports
* chore(wiki): ignore generated public wiki artifacts
* fix(wiki): align llms urls with per-page endpoint pattern
* fix(wiki): derive llms index from wiki index page
* refactor(markdown): share frontmatter and title helpers
* refactor(wiki): share route and llms path mapping
* ci(pages): add pr verify workflow and tighten deploy triggers
2026-02-26 10:43:36 +02:00
51532bc753
Added dynamic skill-catalog discovery in clawsec-suite ( #26 )
...
* feat(clawsec-suite): integrate audit-watchdog and add email-gated setup
* fix(clawsec-suite): escape shell env assignments in watchdog setup
* fix(lint): remove unnecessary escapes in watchdog exec template
* clawsec-suite: add dynamic remote skill catalog discovery with fallback
* clawsec-suite: align signed feed defaults and checksum key compatibility
* fix(lint): use globalThis fetch/AbortController in catalog script
* Revert "fix(lint): remove unnecessary escapes in watchdog exec template"
This reverts commit 09e40d2a8861e2d179137467c9ba938776609a56.
* Revert "fix(clawsec-suite): escape shell env assignments in watchdog setup"
This reverts commit 54d97653a6f8ac14c125ef14c59bca7532cfee15.
* Revert "feat(clawsec-suite): integrate audit-watchdog and add email-gated setup"
This reverts commit 1ba55dd69ecb7a248a53123277158ce27474d5f7.
* fix(openclaw-audit-watchdog): escape shell env interpolation in setup_cron
* ci(signing): enforce key consistency across docs, repo, and generated assets
* docs(readme): document signing key consistency CI guardrails
* chore(clawsec-suite): bump to 0.1.0 and record release changelog
* chore(changelog): update to version 0.1.1 and enhance signing key drift control documentation
* chore(clawsec-suite): bump version to 0.1.1
2026-02-16 14:47:32 +02:00
26fa73fc92
feat: enhance skill release workflow with changelog extraction for versioned releases
2026-02-12 20:18:22 +02:00
5ee8587b1e
Integration/signing work ( #20 )
...
* ci: sign advisory feed and checksums in workflows
* feat(clawsec-suite): add verifier-side signature and checksum enforcement
Implements cryptographic verification for advisory feed loading:
- Ed25519 detached signature verification for feed.json
- Supports raw base64 and JSON-wrapped signature formats
- Pinned public key at advisories/feed-signing-public.pem
- SHA-256 checksum manifest (checksums.json) verification
- Signed checksums.json.sig prevents partial artifact substitution
- Verifies feed.json, feed.json.sig, and public key against manifest
- Remote feed: returns null on verification failure (triggers fallback)
- Local feed: throws on verification failure (hard fail)
- No silent bypass of verification
- CLAWSEC_ALLOW_UNSIGNED_FEED=1 temporarily bypasses verification
- Warning logged when bypass mode is enabled
- Intended for transition period only
- guarded_skill_install without --version matches any advisory for skill
- Encourages explicit version specification
- scripts/sign_detached_ed25519.mjs - signing utility
- scripts/verify_detached_ed25519.mjs - verification utility
- scripts/generate_checksums_json.mjs - checksum manifest generator
- test/feed_verification.test.mjs - 14 verification tests
- test/guarded_install.test.mjs - 6 install flow tests
- hooks/.../lib/feed.mjs - full rewrite with verification
- hooks/.../handler.ts - verification options integration
- scripts/guarded_skill_install.mjs - verification integration
- skill.json - v0.0.9, new SBOM entries, openssl requirement
- SKILL.md - signed install flow, env vars documentation
- HOOK.md - new environment variables
- ci.yml - added verification test job
Refs: fail-closed verification, Ed25519 signatures, checksum manifests
* fix: update action versions in CI workflows for improved stability
* chore(clawsec-suite): bump version to 0.0.10
* feat: enhance security measures in asset deployment and add changelog for version history
* feat: add dry-run signing for advisory artifacts and generate checksums
* fix: enhance error handling in loadRemoteFeed for security policy violations
* feat: implement Ed25519 signing and verification for advisory artifacts and checksums
* feat: implement signing and verification for advisory artifacts and checksums in workflows
* feat: update dry-run signing key generation to use Ed25519 algorithm
* feat: update Ed25519 signing and verification to use -rawin flag for compatibility
* feat: add public key copying to advisory directory and implement safe basename extraction for URLs
* feat: remove Product Hunt promotion section from README and Home page
2026-02-12 18:49:34 +02:00
d3c703aea6
ClawSec init
2026-02-05 21:58:23 +02:00
davida-ps
David Abutbul
dependabot[bot]