mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-19 23:06:49 +00:00
chore: migrate repository URLs from AnsoCode/Sencho to studio-saelix/sencho
Updates all hardcoded GitHub repository references across 21 files: - package.json: repository URL, bugs URL, homepage, description, author - CONTRIBUTING.md: bug report template URL - SECURITY.md: advisory URL, cosign cert-identity regexp - .github/CODEOWNERS: @AnsoCode -> @studio-saelix/maintainers - .github/workflows/ci.yml: repositories scope (Sencho -> sencho), docs-sync git URL - .github/workflows/cla.yml: path-to-document URL - .github/workflows/docker-publish.yml: cosign verify comment - frontend/**/*.tsx: issues and changelog links (3 components) - frontend/public/.well-known/security.txt: Contact and Policy URLs - security/vex/sencho.openvex.json: @id field - docs/openapi.yaml: license URL - docs/docs.json: navbar and footer GitHub links (5 instances) - docs/security.mdx: advisory and SECURITY.md links - docs/reference/verifying-images.mdx: repo link + cosign regexp + legacy identity note - docs/reference/contact.mdx: issues, LICENSE, advisory, policy, CoC links - docs/reference/security-advisories.mdx: releases link - docs/operations/verifying-images.mdx: cosign regexps and VEX download URL (6 instances) - docs/operations/upgrade.mdx: releases links (2 instances) - backend/src/utils/version-check.ts: GitHub Releases API endpoint CHANGELOG.md intentionally excluded (release-please managed). Legacy cosign identity note added for pre-migration image verification.
This commit is contained in:
SaelixCode
@@ -11,7 +11,7 @@ Sencho provides dedicated email channels for different types of inquiries. Use t
|
||||
Technical support, how-to questions, and troubleshooting help. Available to Skipper and Admiral license holders via **Settings > Help & Support** in the app.
|
||||
</Card>
|
||||
|
||||
Community users can get help through the [Documentation](https://docs.sencho.io) and [GitHub Issues](https://github.com/AnsoCode/Sencho/issues).
|
||||
Community users can get help through the [Documentation](https://docs.sencho.io) and [GitHub Issues](https://github.com/studio-saelix/sencho/issues).
|
||||
|
||||
## General inquiries
|
||||
|
||||
@@ -26,7 +26,7 @@ Community users can get help through the [Documentation](https://docs.sencho.io)
|
||||
</Card>
|
||||
|
||||
This address appears in:
|
||||
- The [LICENSE](https://github.com/AnsoCode/Sencho/blob/main/LICENSE) file for alternative licensing inquiries
|
||||
- The [LICENSE](https://github.com/studio-saelix/sencho/blob/main/LICENSE) file for alternative licensing inquiries
|
||||
- Upgrade prompts inside the app (paywall screens)
|
||||
- The [Refund Policy](https://sencho.io/refund) and pricing section on the website
|
||||
|
||||
@@ -36,9 +36,9 @@ This address appears in:
|
||||
Vulnerability reports, security incidents, and bug bounty submissions. **Do not open a public issue for security vulnerabilities.**
|
||||
</Card>
|
||||
|
||||
You can also use [GitHub private vulnerability reporting](https://github.com/AnsoCode/Sencho/security/advisories/new). Both the app and the website publish a `/.well-known/security.txt` file that points to this address.
|
||||
You can also use [GitHub private vulnerability reporting](https://github.com/studio-saelix/sencho/security/advisories/new). Both the app and the website publish a `/.well-known/security.txt` file that points to this address.
|
||||
|
||||
See the full [Security Policy](https://github.com/AnsoCode/Sencho/blob/main/SECURITY.md) for response times and disclosure guidelines.
|
||||
See the full [Security Policy](https://github.com/studio-saelix/sencho/blob/main/SECURITY.md) for response times and disclosure guidelines.
|
||||
|
||||
## Privacy
|
||||
|
||||
@@ -54,7 +54,7 @@ This address is listed in the [Privacy Policy](https://sencho.io/privacy) and [T
|
||||
Reports of Code of Conduct violations in any Sencho community space.
|
||||
</Card>
|
||||
|
||||
All reports are reviewed promptly and handled with confidentiality. See the [Code of Conduct](https://github.com/AnsoCode/Sencho/blob/main/CODE_OF_CONDUCT.md) for details.
|
||||
All reports are reviewed promptly and handled with confidentiality. See the [Code of Conduct](https://github.com/studio-saelix/sencho/blob/main/CODE_OF_CONDUCT.md) for details.
|
||||
|
||||
## Summary
|
||||
|
||||
|
||||
@@ -59,5 +59,5 @@ The following dependency upgrades resolved all known CVEs at time of release:
|
||||
Sencho tracks and remediates dependency CVEs with each release. Dependency versions are pinned in the Dockerfile for reproducible builds and targeted remediation independent of Alpine's release cycle.
|
||||
|
||||
<Note>
|
||||
If you need specific CVE details for compliance or audit purposes, refer to the [GitHub release notes](https://github.com/AnsoCode/Sencho/releases) where each release documents dependency changes.
|
||||
If you need specific CVE details for compliance or audit purposes, refer to the [GitHub release notes](https://github.com/studio-saelix/sencho/releases) where each release documents dependency changes.
|
||||
</Note>
|
||||
|
||||
@@ -15,7 +15,7 @@ Every image also ships with an embedded SBOM (Software Bill of Materials) and [S
|
||||
|
||||
Verification guarantees:
|
||||
|
||||
1. The image was built from the [AnsoCode/Sencho](https://github.com/AnsoCode/Sencho) repository on GitHub.
|
||||
1. The image was built from the [studio-saelix/sencho](https://github.com/studio-saelix/sencho) repository on GitHub.
|
||||
2. The build ran inside a GitHub Actions workflow, not on someone's laptop.
|
||||
3. The image has not been tampered with between publish and pull.
|
||||
|
||||
@@ -51,10 +51,15 @@ Replace `<tag>` with the version you intend to pull, for example `0.42.7`, `0.42
|
||||
|
||||
```bash
|
||||
cosign verify saelix/sencho:<tag> \
|
||||
--certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
|
||||
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
|
||||
--certificate-oidc-issuer https://token.actions.githubusercontent.com
|
||||
```
|
||||
|
||||
<Note>
|
||||
Images released before the repository migration (prior to v0.65.x) were signed with the identity `https://github.com/AnsoCode/Sencho/...`. To verify those older images, use the combined regexp:
|
||||
`"https://github.com/(AnsoCode/Sencho|studio-saelix/sencho)/.*"`
|
||||
</Note>
|
||||
|
||||
A successful verification prints the signature, the Rekor transparency log entry, and the certificate that signed it. If the image is not signed by the official Sencho pipeline, the command exits with a non-zero status and you should not run that image.
|
||||
|
||||
## Inspect the SBOM and provenance
|
||||
|
||||
Reference in New Issue
Block a user