M4-A5: real GitHub OIDC RS256 time proof bound to two live source digests by StanleyLl0yd · Pull Request #320 · StanleyLl0yd/FootballForecast

feat(m4): verify GitHub RS256 OIDC time and two independent-source digest audiences

StanleyLl0yd

committed

a46b4f0

build(m4): pin OIDC signature dependencies for runtime and tests

StanleyLl0yd

committed

56f5572

feat(m4): bind actual OpenFoot/MatchTV observations to GitHub-issued signed UTC

StanleyLl0yd

committed

2561e30

feat(m4): owner-only GitHub OIDC cryptographic timestamp gate (no DB creds)

StanleyLl0yd

committed

d94a728

test(m4): cryptographic JWT, audience, issuer, owner, clock and workflow negatives

StanleyLl0yd

committed

62b595b

test(m4): guard owner-only GitHub OIDC cryptographic gate

StanleyLl0yd

committed

7b0e2ad

docs(m4): truthful OIDC signed-time evidence scope and non-claims

StanleyLl0yd

committed

46d92ce

style(m4): normalize OIDC verifier imports under Ruff

StanleyLl0yd

committed

668e1c6

style(m4): normalize OIDC verifier imports under Ruff

StanleyLl0yd

committed

f708f8e

Navigation Menu

Repository navigation

M4-A5: real GitHub OIDC RS256 time proof bound to two live source digests - #320

M4-A5: real GitHub OIDC RS256 time proof bound to two live source digests#320
StanleyLl0yd merged 9 commits into
mainfrom
m4-a5-github-oidc-time-proof

Commits on Nov 14, 2026

feat(m4): verify GitHub RS256 OIDC time and two independent-source digest audiences

build(m4): pin OIDC signature dependencies for runtime and tests

feat(m4): bind actual OpenFoot/MatchTV observations to GitHub-issued signed UTC

feat(m4): owner-only GitHub OIDC cryptographic timestamp gate (no DB creds)

test(m4): cryptographic JWT, audience, issuer, owner, clock and workflow negatives

test(m4): guard owner-only GitHub OIDC cryptographic gate

docs(m4): truthful OIDC signed-time evidence scope and non-claims

style(m4): normalize OIDC verifier imports under Ruff

style(m4): normalize OIDC verifier imports under Ruff