fix(signing)!: Ed25519-only registry signing verified against the pinned key - #48

Merged

Patel230 merged 6 commits into

mainfrom

fix/registry-signing

Sep 29, 2026

Commits on Sep 26, 2026

fix(ci): drop the forgeable dev-fallback registry signing key

Patel230
and
claude
committed
a19afd4
feat(signing)!: sign the registry with Ed25519 only and pin the public key

Patel230
and
claude
committed
b4db29d
build(deps): add hash-locked requirement sets for registry publishing

Patel230
and
claude
committed
e27b287
ci(publish): Ed25519-only signing verified against the pinned key

Patel230
and
claude
committed
eecbe31
ci: audit the publish lock files with pip-audit

Patel230
and
claude
committed
6858770
docs(registry): document the Ed25519 registry signature contract

Patel230
and
claude
committed
6295927