sha / PGXN Search

Scripts and Generated Contracts

scripts/run-* executes a gate and records SHA-named evidence. tests/shell/*_smoke.sh proves positive and negative script behavior. release/checks/ composes the bounded open-source readiness gate.

V1 Artifact Verification Policy

… by a GitHub-verified signed annotated tag, published SHA-256 checksums, and a Sigstore build-provenance attestation for the source archive.

Release Tooling

../scripts/render-release-notes.py binds the exact candidate SHA into the final notes used by the protected publication job. ../.github/workflows/ci.yml runs bounded pull-request checks. ../.

P12 worker runtime and license decision

The artifact is operator-provided, verified by length and SHA-256 before use, and is not a transformer-compatibility claim. Worker dependency and artifact licenses The worker has no provider SDK…

The report records commit SHA, clean-tree state, Rust, Cargo, cargo-pgrx, artifact sizes, SHA-256 checksums, signature verification status, and version consistency between context-pg and pgcontext.

Release Compatibility Fixtures

Record the producing pgGraph/PostgreSQL versions, platform, SHA-256, and expected load or rebuild result. Never regenerate an existing fixture in place. Add a new versioned fixture.

Release Process

… V1 uses a GitHub-verified signed annotated tag, published SHA-256 checksums, a Sigstore attestation for the source archive, the immutable candidate SHA in provenance, and an attested OCI manifest…

PGXN packaging, automatic versions, and publishing

… package workflow rebuilds the ZIP from the exact stable release SHA, verifies that vX.Y.Z points to that SHA, and uploads it directly to PGXN Manager over HTTPS.A rerun is idempotent.

Security

Management authorization API Admin bearer tokens (SHA-256 fingerprints, constant-time check).Tamper resistance core AEAD authentication tag; AAD binds ciphertext to name:version.

Threat model

Spoofing an admin High-entropy bearer tokens; only SHA-256 fingerprints stored; constant-time check; revocation.Tampering with stored ciphertext AEAD tag fails open; AAD binds ciphertext to…

Optional real semantic model tests

… and records each downloaded ONNX artifact’s byte length and SHA-256 digest in target/real-semantic-models/installed-models.json. The smoke report records the models, revisions, digests, platform…

Release Gates

… its protected publish mode requires the exact tag, candidate SHA, prepare run, and both accepted manifest digests. See the release process, release matrix, and release tooling.

pgmnemo Scientific-Technical Release Process

json, pinned SHA) recall@5/10/25/50, MRR, per-category Run full 1982+ questions, not sampledLongMemEval-S xiaowu0162/longmemeval-cleaned (longmemeval_s_cleaned.

pgmnemo — Strategic Charter

… gate on writes none provenance gate — write requires commit SHA or artifact hashMulti-agent role isolation RLS or none first-class — role + project + provenance compositeVendor lock-in yes (data…

Fuzzing

Each report records the command, target, corpus path, commit SHA, host OS, boundary, status, exit code, requested duration, measured elapsed duration, and per-target log path.

Unsafe Review

The no-flag form executes every row and is owned by the frozen-SHA hardening phase. When a later product slice adds an unsafe owner, validated mmap view, callback surface, or subprocess harness…

pgmnemo Usage Guide

… Examples -- Minimal: text-only lesson with provenance via commit SHA SELECT pgmnemo.ingest( 'developer', 1, 'security', 'Rotate JWT secrets within 24 hours of any key-compromise indicator.

Semantic reranking

… returns a versioned envelope containing the authorized text and SHA-256 content digest. Private candidate rows retain identity, version, digest, fusion provenance, and allow-listed metadata, but do…

pgmnemo — POSITIONING v0.1

… gate Yes — lesson write blocked without commit SHA or artifact hash No No No No NoMulti-agent role isolation Yes — PostgreSQL RLS per agent role + project composite API-level only (no DB…

Design decisions

The default posture is deny. 8. Admin tokens stored as SHA-256 fingerprints, compared in constant time Decision. Generate 256-bit random tokens; store only sha256(token); verify with a constant-time…

pgmnemo — Tactical Plan, Month 1

00W3.3 Provenance gate trigger — verify commit SHA / artifact hash before promotion backend_developer (70) $4.00W3.4 Demo case 1: Claude Code agent reading from pgmnemo (script + README)…

FbSQL

… by CI on every push to main (tags: latest, the short commit SHA, and the version on release tags). To build the identical image locally instead: scripts/docker-build.

REST API

… "payment" } 201 Created → the raw token, shown once (only its SHA-256 is stored): { "name": "payments-svc", "role": "payment", "token": "f3q...

REPORT_PGWIRE_PROXY.md — pgwire Proxy / Intercept Analysis

Handle startup, auth (cleartext, MD5, SCRAM-SHA-256), simple query, extended query, COPY, cancel, notifications. Client (backend): Connect to upstream PG. Same protocol coverage.

Benchmark Methodology

Reporting Benchmark reports must include: commit SHA and whether the worktree was clean; Rust toolchain, PostgreSQL version, target OS, and CPU model; dataset name, row count, dimensions, tenant…

pg_uuid_v8

… Available Algorithms XOR (default): XOR-based obfuscation with SHA-256 key derivation from seed AES128: AES-128 encryption in ECB mode for cryptographically secure timestamp protection AES256…

Automatic document chunking

… generation remains visible only while its source version and SHA-256 still match an invoker-visible authoritative row. A source edit, delete, SELECT revocation, or RLS change hides stale chunks…

PgClone Manual Testing Guide

… Installed + preloaded Installed + preloadedAuth scram-sha-256 scram-sha-256Connection string used throughout: host=172.17.0.2 port=5432 dbname=db1 user=postgres password=123654 All SQL commands run…

Contributing to Citus

… the commit that you want to backport git cherry-pick -x <sha> (the -x is important) Push the branch git push Wait for tests to pass If the cherry-pick required non-trivial merge conflicts, create a…

Release Process

zip Extension files for Windows x64SHA256SUMS.txt SHA-256 checksums for all archivesghcr.io/grove/pg_trickle-ext:<ver> CNPG extension image for Image Volumes (amd64 + arm64)Installing from an archive…

Appendix E. Veil2 Authentication Protocols

Create a sha-1 hash of the concatenated string. Encode the hash as a base64 string. The open_connection() function will create the same encoded hash internally and check that it matches.

veil2 0.9.1
2020-12-18
Marc Munro

PGXN

PostgreSQL Extension Network

1-41 of 41 found