requestlog: publish collector-readable evidence boundary

Publish the reviewed Gamertan Web Foundations v0.1.0-preview.6 snapshot with a narrow mode-0640 collector boundary, private mode-0600 default, explicit setgid ownership guidance, and native macOS-safe release verification.

Exported from reviewed private source 120d660fa432761f85316ca3dde990e2dd142f19 after trusted Gitea CI run 681 and the complete native Mac verification suite.

Material implementation assistance provided by OpenAI Codex; reviewed and verified through the maintainer workflow.

Signed-off-by: Cole Speelman <crspeelman@gmail.com>

scripts/check-embedded-webauthn.sh

@@ -17,22 +17,34 @@ packages=(
 	webauthn
 )
 
-install -D -m 0644 "$source_root/LICENSE" "$derived/LICENSE"
+install_file() {
+	source=$1
+	destination=$2
+	mkdir -p "$(dirname "$destination")"
+	install -m 0644 "$source" "$destination"
+}
+
+install_file "$source_root/LICENSE" "$derived/LICENSE"
 for package in "${packages[@]}"; do
-	while IFS= read -r source; do
+	for source in "$source_root/$package"/*.go; do
+		case $source in
+			*_test.go) continue ;;
+		esac
 		relative=${source#"$source_root"/}
-		install -D -m 0644 "$source" "$derived/$relative"
-	done < <(find "$source_root/$package" -maxdepth 1 -type f -name '*.go' ! -name '*_test.go' | sort)
+		install_file "$source" "$derived/$relative"
+	done
 done
 
 while IFS= read -r source; do
-	sed -i \
+	temporary="$source.tmp"
+	sed \
 		's#github.com/go-webauthn/webauthn#gamertan.com/web/internal/webauthnvendored#g' \
-		"$source"
+		"$source" >"$temporary"
+	mv "$temporary" "$source"
 done < <(find "$derived" -type f -name '*.go' | sort)
 
 cmp -s LICENSES/BSD-3-Clause-go-webauthn.txt "$embedded_root/LICENSE"
-if ! diff -ru --no-dereference "$derived" "$embedded_root"; then
+if ! diff -ru "$derived" "$embedded_root"; then
 	echo 'compiled WebAuthn verifier differs from its audited mechanical derivation' >&2
 	exit 1
 fi

scripts/check-vendored-webauthn.sh

@@ -6,7 +6,11 @@ cd "$root"
 
 test -f third_party/go-webauthn/LICENSE
 cmp -s LICENSES/BSD-3-Clause-go-webauthn.txt third_party/go-webauthn/LICENSE
-sha256sum -c third_party/go-webauthn.SHA256SUMS >/dev/null
+if command -v sha256sum >/dev/null 2>&1; then
+	sha256sum -c third_party/go-webauthn.SHA256SUMS >/dev/null
+else
+	shasum -a 256 -c third_party/go-webauthn.SHA256SUMS >/dev/null
+fi
 expected=$(sed -n 's#  third_party/go-webauthn/.*#&#p' third_party/go-webauthn.SHA256SUMS | wc -l)
 actual=$(find third_party/go-webauthn -type f | wc -l)
 test "$expected" -eq "$actual"

scripts/export-public.sh

@@ -8,7 +8,10 @@ output=$1
 [[ $output = /* && $output != / && ! -e $output ]] || usage
 cd "$root"
 [[ -z $(git status --porcelain=v1 --untracked-files=all) ]] || { echo "private source must be clean" >&2; exit 1; }
-mapfile -t files < <(grep -Ev '^[[:space:]]*(#|$)' scripts/public-snapshot.allow)
+files=()
+while IFS= read -r file; do
+	files+=("$file")
+done < <(grep -Ev '^[[:space:]]*(#|$)' scripts/public-snapshot.allow)
 [[ ${#files[@]} -gt 0 ]] || exit 1
 for file in "${files[@]}"; do
 	[[ $file != /* && $file != *..* ]] || { echo "invalid allowlisted path: $file" >&2; exit 1; }

scripts/test-public-snapshot.sh

@@ -6,14 +6,14 @@ cd "$root"
 temporary=$(mktemp -d)
 trap 'rm -rf "$temporary"' EXIT
 ./scripts/export-public.sh "$temporary/export"
-(cd "$temporary/export" && find . -type f -printf '%P\n' | sort) >"$temporary/actual"
+(cd "$temporary/export" && find . -type f -print | sed 's#^\./##' | LC_ALL=C sort) >"$temporary/actual"
 while IFS= read -r path; do
 	if [[ $path = */ ]]; then
-		find "${path%/}" -type f -printf '%p\n'
+		find "${path%/}" -type f -print
 	else
 		echo "$path"
 	fi
-done < <(grep -Ev '^[[:space:]]*(#|$)' scripts/public-snapshot.allow) | sort >"$temporary/expected"
+done < <(grep -Ev '^[[:space:]]*(#|$)' scripts/public-snapshot.allow) | LC_ALL=C sort >"$temporary/expected"
 diff -u "$temporary/expected" "$temporary/actual"
 private_word='PRI''VATE'
 token_word='to''ken'

scripts/verify.sh

@@ -5,6 +5,7 @@ root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 cd "$root"
 ./scripts/check-licenses.sh
 ./scripts/check-dependencies.sh
+./scripts/test-public-snapshot.sh
 test -z "$(find . \( -path ./third_party -o -path ./internal/webauthnvendored \) -prune -o -name '*.go' -print0 | xargs -0 gofmt -l)"
 go test ./...
 go test -race ./...