eric/ReleaseKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Verify external assets without forwarding Gitea credentials

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-06 01:01:36 +00:00
parent 8b417760c6
commit 6b777dd861
4 changed files with 60 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/integrations/gitea.md
View File

@@ -47,9 +47,9 @@ not missing. A failed read-only inspection reports `not_attempted`; if this
invocation already delivered the page, its outcome retains `partial` progress.
Unknown-write outcomes are reserved for unresolved writes. Unrelated attachments are returned separately and are preserved.
Attachment downloads and same-origin redirects carry authorization only when
their scheme, host, and port match the configured Gitea service. Cross-origin
URLs and redirects are left unrequested and reported as unverifiable.
Attachment downloads and redirects carry the Gitea authorization token only
when their scheme, host, and port match the configured service. Cross-origin
content is downloaded without that token and verified by its digest.
The upload operation accepts only an inspection result without conflicts or
unverifiable assets. It uploads missing binaries in filename order and then the