mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-20 23:32:19 +00:00
chore: migrate repository URLs from AnsoCode/Sencho to studio-saelix/sencho
Updates all hardcoded GitHub repository references across 21 files: - package.json: repository URL, bugs URL, homepage, description, author - CONTRIBUTING.md: bug report template URL - SECURITY.md: advisory URL, cosign cert-identity regexp - .github/CODEOWNERS: @AnsoCode -> @studio-saelix/maintainers - .github/workflows/ci.yml: repositories scope (Sencho -> sencho), docs-sync git URL - .github/workflows/cla.yml: path-to-document URL - .github/workflows/docker-publish.yml: cosign verify comment - frontend/**/*.tsx: issues and changelog links (3 components) - frontend/public/.well-known/security.txt: Contact and Policy URLs - security/vex/sencho.openvex.json: @id field - docs/openapi.yaml: license URL - docs/docs.json: navbar and footer GitHub links (5 instances) - docs/security.mdx: advisory and SECURITY.md links - docs/reference/verifying-images.mdx: repo link + cosign regexp + legacy identity note - docs/reference/contact.mdx: issues, LICENSE, advisory, policy, CoC links - docs/reference/security-advisories.mdx: releases link - docs/operations/verifying-images.mdx: cosign regexps and VEX download URL (6 instances) - docs/operations/upgrade.mdx: releases links (2 instances) - backend/src/utils/version-check.ts: GitHub Releases API endpoint CHANGELOG.md intentionally excluded (release-please managed). Legacy cosign identity note added for pre-migration image verification.
This commit is contained in:
SaelixCode
+5
-5
@@ -29,7 +29,7 @@
|
||||
"links": [
|
||||
{
|
||||
"type": "github",
|
||||
"href": "https://github.com/AnsoCode/Sencho"
|
||||
"href": "https://github.com/studio-saelix/sencho"
|
||||
}
|
||||
],
|
||||
"primary": {
|
||||
@@ -40,7 +40,7 @@
|
||||
},
|
||||
"footer": {
|
||||
"socials": {
|
||||
"github": "https://github.com/AnsoCode/Sencho"
|
||||
"github": "https://github.com/studio-saelix/sencho"
|
||||
},
|
||||
"links": [
|
||||
{
|
||||
@@ -48,14 +48,14 @@
|
||||
"items": [
|
||||
{ "label": "Website", "href": "https://sencho.io" },
|
||||
{ "label": "Pricing", "href": "https://sencho.io/#pricing" },
|
||||
{ "label": "Changelog", "href": "https://github.com/AnsoCode/Sencho/releases" }
|
||||
{ "label": "Changelog", "href": "https://github.com/studio-saelix/sencho/releases" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"header": "Community",
|
||||
"items": [
|
||||
{ "label": "GitHub", "href": "https://github.com/AnsoCode/Sencho" },
|
||||
{ "label": "Contributing", "href": "https://github.com/AnsoCode/Sencho/blob/main/CONTRIBUTING.md" }
|
||||
{ "label": "GitHub", "href": "https://github.com/studio-saelix/sencho" },
|
||||
{ "label": "Contributing", "href": "https://github.com/studio-saelix/sencho/blob/main/CONTRIBUTING.md" }
|
||||
]
|
||||
},
|
||||
{
|
||||
|
||||
+1
-1
@@ -32,7 +32,7 @@ info:
|
||||
url: https://sencho.io
|
||||
license:
|
||||
name: BSL 1.1
|
||||
url: https://github.com/AnsoCode/Sencho/blob/main/LICENSE
|
||||
url: https://github.com/studio-saelix/sencho/blob/main/LICENSE
|
||||
|
||||
servers:
|
||||
- url: "{protocol}://{host}:{port}"
|
||||
|
||||
@@ -65,7 +65,7 @@ If you prefer to control exactly which version you run, pin the image tag in you
|
||||
image: saelix/sencho:0.38.0
|
||||
```
|
||||
|
||||
Check [GitHub Releases](https://github.com/AnsoCode/Sencho/releases) for available versions and changelogs.
|
||||
Check [GitHub Releases](https://github.com/studio-saelix/sencho/releases) for available versions and changelogs.
|
||||
|
||||
---
|
||||
|
||||
@@ -83,4 +83,4 @@ Sencho follows [Semantic Versioning](https://semver.org/) (`MAJOR.MINOR.PATCH`):
|
||||
While the version is below 1.0, minor releases (0.x.0) may occasionally include breaking changes. These are always documented in the release notes. Once Sencho reaches 1.0, breaking changes will only occur in major releases.
|
||||
</Note>
|
||||
|
||||
Breaking changes are marked with `BREAKING CHANGE` in the [release notes](https://github.com/AnsoCode/Sencho/releases). Subscribe to the repository's releases to be notified of new versions.
|
||||
Breaking changes are marked with `BREAKING CHANGE` in the [release notes](https://github.com/studio-saelix/sencho/releases). Subscribe to the repository's releases to be notified of new versions.
|
||||
|
||||
@@ -29,7 +29,7 @@ Every published tag is signed with cosign keyless signing via GitHub Actions OID
|
||||
|
||||
```bash
|
||||
cosign verify saelix/sencho:<tag> \
|
||||
--certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
|
||||
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
|
||||
--certificate-oidc-issuer https://token.actions.githubusercontent.com
|
||||
```
|
||||
|
||||
@@ -46,7 +46,7 @@ BuildKit produces an SLSA v1 provenance attestation during every multi-arch buil
|
||||
```bash
|
||||
cosign verify-attestation \
|
||||
--type slsaprovenance \
|
||||
--certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
|
||||
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
|
||||
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
||||
saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
|
||||
```
|
||||
@@ -56,7 +56,7 @@ cosign verify-attestation \
|
||||
```bash
|
||||
cosign verify-attestation \
|
||||
--type cyclonedx \
|
||||
--certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
|
||||
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
|
||||
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
||||
saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
|
||||
```
|
||||
@@ -68,7 +68,7 @@ Alternatively, download `sbom.cdx.json` directly from the GitHub Release assets
|
||||
```bash
|
||||
cosign verify-attestation \
|
||||
--type spdxjson \
|
||||
--certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
|
||||
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
|
||||
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
||||
saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
|
||||
```
|
||||
@@ -82,7 +82,7 @@ The OpenVEX document explains Sencho's triage decisions for any CVEs that appear
|
||||
```bash
|
||||
cosign verify-attestation \
|
||||
--type openvex \
|
||||
--certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
|
||||
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
|
||||
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
||||
saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
|
||||
```
|
||||
@@ -96,7 +96,7 @@ To reproduce the same scan that gates every release:
|
||||
```bash
|
||||
# Download the VEX document
|
||||
curl -Lo sencho.openvex.json \
|
||||
https://github.com/AnsoCode/Sencho/releases/latest/download/sencho.openvex.json
|
||||
https://github.com/studio-saelix/sencho/releases/latest/download/sencho.openvex.json
|
||||
|
||||
# Scan with VEX applied (exit 1 if any unresolved HIGH/CRITICAL CVE)
|
||||
trivy image \
|
||||
|
||||
@@ -11,7 +11,7 @@ Sencho provides dedicated email channels for different types of inquiries. Use t
|
||||
Technical support, how-to questions, and troubleshooting help. Available to Skipper and Admiral license holders via **Settings > Help & Support** in the app.
|
||||
</Card>
|
||||
|
||||
Community users can get help through the [Documentation](https://docs.sencho.io) and [GitHub Issues](https://github.com/AnsoCode/Sencho/issues).
|
||||
Community users can get help through the [Documentation](https://docs.sencho.io) and [GitHub Issues](https://github.com/studio-saelix/sencho/issues).
|
||||
|
||||
## General inquiries
|
||||
|
||||
@@ -26,7 +26,7 @@ Community users can get help through the [Documentation](https://docs.sencho.io)
|
||||
</Card>
|
||||
|
||||
This address appears in:
|
||||
- The [LICENSE](https://github.com/AnsoCode/Sencho/blob/main/LICENSE) file for alternative licensing inquiries
|
||||
- The [LICENSE](https://github.com/studio-saelix/sencho/blob/main/LICENSE) file for alternative licensing inquiries
|
||||
- Upgrade prompts inside the app (paywall screens)
|
||||
- The [Refund Policy](https://sencho.io/refund) and pricing section on the website
|
||||
|
||||
@@ -36,9 +36,9 @@ This address appears in:
|
||||
Vulnerability reports, security incidents, and bug bounty submissions. **Do not open a public issue for security vulnerabilities.**
|
||||
</Card>
|
||||
|
||||
You can also use [GitHub private vulnerability reporting](https://github.com/AnsoCode/Sencho/security/advisories/new). Both the app and the website publish a `/.well-known/security.txt` file that points to this address.
|
||||
You can also use [GitHub private vulnerability reporting](https://github.com/studio-saelix/sencho/security/advisories/new). Both the app and the website publish a `/.well-known/security.txt` file that points to this address.
|
||||
|
||||
See the full [Security Policy](https://github.com/AnsoCode/Sencho/blob/main/SECURITY.md) for response times and disclosure guidelines.
|
||||
See the full [Security Policy](https://github.com/studio-saelix/sencho/blob/main/SECURITY.md) for response times and disclosure guidelines.
|
||||
|
||||
## Privacy
|
||||
|
||||
@@ -54,7 +54,7 @@ This address is listed in the [Privacy Policy](https://sencho.io/privacy) and [T
|
||||
Reports of Code of Conduct violations in any Sencho community space.
|
||||
</Card>
|
||||
|
||||
All reports are reviewed promptly and handled with confidentiality. See the [Code of Conduct](https://github.com/AnsoCode/Sencho/blob/main/CODE_OF_CONDUCT.md) for details.
|
||||
All reports are reviewed promptly and handled with confidentiality. See the [Code of Conduct](https://github.com/studio-saelix/sencho/blob/main/CODE_OF_CONDUCT.md) for details.
|
||||
|
||||
## Summary
|
||||
|
||||
|
||||
@@ -59,5 +59,5 @@ The following dependency upgrades resolved all known CVEs at time of release:
|
||||
Sencho tracks and remediates dependency CVEs with each release. Dependency versions are pinned in the Dockerfile for reproducible builds and targeted remediation independent of Alpine's release cycle.
|
||||
|
||||
<Note>
|
||||
If you need specific CVE details for compliance or audit purposes, refer to the [GitHub release notes](https://github.com/AnsoCode/Sencho/releases) where each release documents dependency changes.
|
||||
If you need specific CVE details for compliance or audit purposes, refer to the [GitHub release notes](https://github.com/studio-saelix/sencho/releases) where each release documents dependency changes.
|
||||
</Note>
|
||||
|
||||
@@ -15,7 +15,7 @@ Every image also ships with an embedded SBOM (Software Bill of Materials) and [S
|
||||
|
||||
Verification guarantees:
|
||||
|
||||
1. The image was built from the [AnsoCode/Sencho](https://github.com/AnsoCode/Sencho) repository on GitHub.
|
||||
1. The image was built from the [studio-saelix/sencho](https://github.com/studio-saelix/sencho) repository on GitHub.
|
||||
2. The build ran inside a GitHub Actions workflow, not on someone's laptop.
|
||||
3. The image has not been tampered with between publish and pull.
|
||||
|
||||
@@ -51,10 +51,15 @@ Replace `<tag>` with the version you intend to pull, for example `0.42.7`, `0.42
|
||||
|
||||
```bash
|
||||
cosign verify saelix/sencho:<tag> \
|
||||
--certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
|
||||
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
|
||||
--certificate-oidc-issuer https://token.actions.githubusercontent.com
|
||||
```
|
||||
|
||||
<Note>
|
||||
Images released before the repository migration (prior to v0.65.x) were signed with the identity `https://github.com/AnsoCode/Sencho/...`. To verify those older images, use the combined regexp:
|
||||
`"https://github.com/(AnsoCode/Sencho|studio-saelix/sencho)/.*"`
|
||||
</Note>
|
||||
|
||||
A successful verification prints the signature, the Rekor transparency log entry, and the certificate that signed it. If the image is not signed by the official Sencho pipeline, the command exits with a non-zero status and you should not run that image.
|
||||
|
||||
## Inspect the SBOM and provenance
|
||||
|
||||
+2
-2
@@ -260,6 +260,6 @@ For copy-paste verification commands, see [Verifying Images](/operations/verifyi
|
||||
|
||||
## Reporting a vulnerability
|
||||
|
||||
If you discover a security vulnerability in Sencho, please report it privately via [security@sencho.io](mailto:security@sencho.io) or through [GitHub private vulnerability reporting](https://github.com/AnsoCode/Sencho/security/advisories/new). Do not open a public issue for security vulnerabilities.
|
||||
If you discover a security vulnerability in Sencho, please report it privately via [security@sencho.io](mailto:security@sencho.io) or through [GitHub private vulnerability reporting](https://github.com/studio-saelix/sencho/security/advisories/new). Do not open a public issue for security vulnerabilities.
|
||||
|
||||
See the full [Security Policy](https://github.com/AnsoCode/Sencho/blob/main/SECURITY.md) for response times and disclosure guidelines.
|
||||
See the full [Security Policy](https://github.com/studio-saelix/sencho/blob/main/SECURITY.md) for response times and disclosure guidelines.
|
||||
|
||||
Reference in New Issue
Block a user