gamertan
3a4b6db9b8
verify / verify (push) Successful in 2m55s
Export the reviewed application-neutral package set through the exact public allowlist. Development history and private application evidence remain outside this canonical source root. Developed with material AI assistance under maintainer review. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
824 B
824 B
Dependency boundary
Most packages use only the Go standard library. Two direct modules are pinned:
golang.org/x/cryptosupplies the reviewed Argon2id implementation used byauth(BSD-3-Clause upstream licence).modernc.org/sqlitesupplies the no-CGO SQLite adapter inauthsqlite(BSD-3-Clause upstream licence).
Applications that do not import auth or authsqlite do not link those
implementations into their binaries. Optional GeoIP enrichment is an interface
only; the base toolkit performs no lookup and adds no GeoIP dependency.
go.sum, go mod verify, checksum-database verification, vulnerability
scanning, and the public snapshot allowlist are release gates. Binary
distributors remain responsible for preserving all applicable upstream notices.