trentpower.fr

Editions are additive: every previous edition's frozen archive remains published under /integrity/releases/ with its own manifest and signature, permanently. Nothing is purged.

GitHub Issues.

No vulnerabilities have been resolved; reporters will be credited in release notes unless they ask otherwise.

SECURITY.md sets the channel and the 14-day window; docs/INCIDENT-RESPONSE.md sets what happens next. https://github.com/trentpower/trentpower.fr/blob/main/docs/INCIDENT-RESPONSE.md

The style is codified in tool configuration — ruff in pyproject.toml, eslint and stylelint configs, shfmt — and docs/GATES-CHECKS-AND-QUALITY.md explains the two-tier gate that applies them. https://github.com/trentpower/trentpower.fr/blob/main/docs/GATES-CHECKS-AND-QUALITY.md

The source-quality CI job runs the full lint set in enforcing mode (QUALITY_ENFORCE=1): findings fail the job.

No native binaries are built.

Nothing is compiled or stripped; the published files are their own source, mirrored byte-for-byte under /source/.

One top-level build script orchestrates ordered stages; there are no recursive sub-builds.

The CI build-check job independently repeats the build and compares it against the committed record on every promotion.

The product is a published website; there is nothing to install. Release archives are plain tar/zip.

No installation system.

git clone, npm ci, pip install the hash-pinned requirements, then bash tools/build/build.sh --check — documented in docs/BUILD-AND-DEPLOYMENT.md.

package-lock.json and the compiled requirements files under .github/requirements/ list every dependency with exact versions and hashes, machine-readably. https://github.com/trentpower/trentpower.fr/tree/main/.github/requirements

Weekly Dependabot across npm, pip and GitHub Actions, OSV checks, and nothing merges without review.

Everything external arrives through a lockfile or a hash-pinned requirements file; updating a component is a one-line bump that Dependabot usually proposes first.

The enforced linters flag deprecated usage, and the stack is deliberately small and current.

Every push and pull request runs the suite and the gate; results are reported on the commit and the run summary.

Every bug fixed since the suite existed has a regression property in the test suite (most recently the badge escaper defect — see docs/fuzzing.md).

80% statement coverage of the release-path tooling, measured with coverage.py across the unit suite plus a full gated build (the local-only score-ledger audit utility is excluded as outside the release path). The measurement procedure is recorded in docs/ASSURANCE-CASE.md.

The policy is written and binding: the pull request template requires tests for new or changed tooling behaviour, and the enforced CI job runs them.

It is a checklist line in .github/PULL_REQUEST_TEMPLATE.md, so every change proposal restates it.

Standard-strict configurations, and the quality gate has a documented switch (QUALITY_ENFORCE) to turn any finding into a blocker.

The assurance case walks the principles — economy of mechanism, fail-closed gates, least privilege, open design, complete mediation — and where each is implemented. https://github.com/trentpower/trentpower.fr/blob/main/docs/ASSURANCE-CASE.md

Digests are SHA-256 and SHA-384 throughout; SHA-1 appears nowhere.

Digests are algorithm-prefixed in the manifests (sha256-…), so migrating to another member of the SHA-2 family or SHA-3 is a field change in a new edition, not a redesign; the PGP layer likewise supports re-keying with a published successor key.

Signing keys live exclusively in the local GnuPG and OpenSSH keyrings, entirely outside the repository and the deployed site; rotation is a key swap plus a published announcement, with no code change.

Everything is HTTPS/TLS — the site, the repository, every fetch the tooling makes. No insecure protocol exists to enable.

TLS 1.2+ with HSTS on the site; tooling uses the platform TLS stack with no downgrade path.

The tooling uses standard clients (python urllib/requests, curl) with default certificate verification; nothing disables it anywhere in the repository.

Certificate verification happens before any request is sent, and no request carries private data in any case — there are no cookies or credentials in the system.

Every release is PGP-signed (manifest, archives, SHA256SUMS), the public key is published at a well-known URL with its fingerprint in SECURITY.md, and the verification walk-through is public. The private key has never been on any distribution site. https://trentpower.fr/en-au/verify/

edition/* tags are signed and protected by a tag ruleset against moving or deletion.

Allow-lists are the house style: the public-exposure manifest decides what the server may serve and refuses the rest; the verification-data validators accept only declared paths, hash shapes and dates; the template engine rejects unknown tokens outright.

Strict CSP, SRI, cross-origin isolation headers, HSTS, Trusted Types. URL: https://github.com/trentpower/trentpower.fr/blob/main/docs/SECURITY-AND-PRIVACY.md

docs/ASSURANCE-CASE.md: threat model, trust boundaries, the secure-design argument, countered weaknesses, and the residual risks stated rather than hidden. https://github.com/trentpower/trentpower.fr/blob/main/docs/ASSURANCE-CASE.md

CodeQL runs its security query suites for Python and JavaScript.

Nothing here is written in a memory-unsafe language — HTML, CSS, JavaScript, Python and shell only.