Use the canonical account name, not a redirect - #39
Merged
Conversation
The account was renamed and the old name is now UNCLAIMED, not a permanent alias. GitHub frees a renamed username immediately, so every redirect dies the moment anyone registers it. Two of these were live risks rather than cosmetics: verifier/go.mod declared the module as github.com/<old>/agentwall/verifier. A Go module path is resolved by fetching that URL, so once the name is claimed by someone else, `go get` on the verifier silently returns a stranger's code. That is a supply-chain hijack of the one component whose entire purpose is being independently trustworthy. package.json carried the old scope, and npm Trusted Publishing matches the GitHub OIDC token's repository claim, which always carries the canonical owner. A publisher configured against the old name fails with an authentication error that reads like a bad credential rather than a wrong name. Suite 333, build clean, go test ok, workflow pins intact. Signed-off-by: reesebuilt <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The account was renamed and the old username now returns 404, meaning it is registrable by anyone. GitHub frees a renamed username immediately; the redirect dies the moment someone claims it.
Two of these were live risks, not cosmetics.
verifier/go.moddeclared the module asgithub.com/<old>/agentwall/verifier. Go resolves a module path by fetching that URL, so once the old name is claimed,go geton the verifier returns a stranger's code. That is a supply-chain hijack of the one component built specifically to be independently trustworthy.package.jsoncarried the old scope. npm Trusted Publishing matches the GitHub OIDC token'srepositoryclaim, which always carries the canonical owner, so a publisher configured against the old name fails with an auth error that reads like a bad credential rather than a wrong name.Suite 333, build clean,
go testok, workflow pins intact.