Files

T

verify / verify (push) Successful in 2m58s

Details

docs: publish the Web Foundations application onramp

Sanitized snapshot of private source 144ca0a9544042b0477ae732c1356cf0b9d62b3f. Add package selection, adoption workflow, and optional Sandwich Hime integration guidance.

AI-Assistance: OpenAI Codex assisted documentation, verification, and publication.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

2026-08-16 21:10:18 -04:00

1.2 KiB

Raw Blame History

Dependency boundary

Most packages use only the Go standard library. Two direct modules are pinned:

golang.org/x/crypto supplies the reviewed Argon2id implementation used by auth (BSD-3-Clause upstream licence).
modernc.org/sqlite supplies the no-CGO SQLite adapter in authsqlite (BSD-3-Clause upstream licence).

Applications that do not import auth or authsqlite do not link those implementations into their binaries. Optional GeoIP enrichment is an interface only; the base toolkit performs no lookup and adds no GeoIP dependency.

All packages currently share one Go module, so these requirements remain visible in the module graph even when an application imports only requestmeta. Go still avoids compiling or linking unused packages. A future nested module may isolate a heavyweight adapter such as authsqlite when its independent dependency and release lifecycle justify the additional tags, vanity metadata, and CI. See MODULES.md.

go.sum, go mod verify, checksum-database verification, vulnerability scanning, and the public snapshot allowlist are release gates. Binary distributors remain responsible for preserving all applicable upstream notices.

1.2 KiB Raw Blame History

Dependency boundary

1.2 KiB

Raw Blame History