base-layer/releasekit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Bound remote asset content verification

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-02 03:29:59 +00:00
parent 76676ee5a6
commit 2b23574ece
5 changed files with 149 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/integrations/gitea.md
View File

@@ -89,6 +89,8 @@ Attachment downloads and redirects carry the Gitea authorization token only
when their scheme, host, and port match the configured service. Cross-origin
content is downloaded without that token and verified by its digest. Downloads
follow at most ten redirects; an additional redirect is unverifiable.
Comparison reads no more than the declared local size plus one byte; shorter
or longer content conflicts, regardless of the server's reported size.
Shared delivery uploads only after inspection finds no conflicts or
unverifiable assets. It uploads missing binaries in filename order and then the