santhsecurity/keyhog

v0.5.47 Feature

This release adds 1 notable feature for engineering teams evaluating rollout.

Published 22h Secrets & Credentials

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

api-keys credentials security git gpu hyperscan

+5 more

pre-commit rust secret-detection secret-scanner simd

Summary

AI summary

Release asset verification now accepts both text‑mode and binary‑mode sha256sum manifests.

Full changelog

The POSIX installer accepts --no-calibrate for deterministic automation.
It still verifies the signature, checksum, installed binary, GPU literal
sidecar, and doctor self-test, then warns that automatic routing remains
uncalibrated until you run install.sh --calibrate.
The signed Linux release smoke uses the explicit no-calibration path and a
measured-correct SIMD backend. Hosted-runner timing noise can no longer block
publication after payload and product verification have passed.

Release asset verification accepts both text-mode and binary-mode
sha256sum manifests, including the *filename form emitted for Windows
executables.
Manual release recovery dispatches check out and attest the exact requested
immutable tag in every build, installer, signing, container, publication,
and floating-tag job.
Signing uses hardened publication and release-note automation from the
workflow commit while all product bytes remain bound to the requested tag.
The prerelease version bumper tracks every canonical version-bearing guide
and no longer rejects versionless pages. Documentation truth checks now cover
the integration, verification, and out-of-band verification pins updated for
this release.