2 Commits
Author SHA1 Message Date
clawbot 02f14143eb docs: TODO.md holds open work only (closes #769)
check / check (push) Waiting to run
e2e / e2e-chrome (push) Waiting to run
e2e / e2e-firefox (push) Waiting to run
Removes the Completed Steps work log and the v0.1.0 tagging date from
Status. Every open item the log mentioned is a tracker issue. The
Workflow bullet that named the removed section now says to record no
finished work in this file.

Model: opus-5-5
2026-11-11 02:04:13 +01:00
clawbot b87c03be11 fix: build hashes and recovery-phrase entropy come from ethers (closes #758)
check / check (push) Waiting to run
e2e / e2e-chrome (push) Waiting to run
e2e / e2e-firefox (push) Waiting to run
build.js and script/lib/package.js hash with sha256 from ethers, with the
0x prefix stripped so the build receipt and SHA256SUMS keep bare lowercase
hex. generateMnemonic() takes its 16 bytes of entropy from randomBytes in
ethers. The README Crypto policy no longer lists these as exceptions.

Model: opus-5-5
2026-11-11 00:42:18 +01:00
2 changed files with 8 additions and 1937 deletions

No files matched your search

+4 -1935
View File
File diff suppressed because it is too large. Load diff
+4 -2
View File
@@ -1,4 +1,5 @@
// The release archives: the zip container, and the self-containment rule.
// The release archives: the zip container, the self-containment rule, and the
// digest format in release/SHA256SUMS.
//
// script/package produces one archive per browser and script/lib/package.js
// decides what goes in it. The trap that rule exists for is real and specific:
@@ -11,7 +12,8 @@
// So the packager resolves every reference in the manifest and in every HTML
// document, and fails on any that leaves the extension root. These are the
// cases for that, plus the archive format itself — new code, and the thing the
// artifact is made of.
// artifact is made of. One more case checks the digest format in
// release/SHA256SUMS.
const {
checkSelfContained,