fix: the documents say what this tool does about signing and about locking

[donislawdev]

Findings S3 and S6 of the outside security review. Both are about a document read by somebody deciding whether to trust something.

SECURITY.md was wrong about signing

It said:

The released binaries are not signed. Signing is not set up, the release notes say so, and your operating system will warn you.

Every part of that had stopped being true. release.yml writes release notes saying the Windows binaries are signed and the macOS ones are signed and notarised by Apple. internal/legal/codesign.go pins the certificate by the SHA-256 of its DER bytes. There is a whole guard family around the wording of those notes, and nothing was watching this one document.

The effect is not cosmetic. SECURITY.md is what a cautious person reads before deciding whether to trust a download. Telling them the signature they can see is not one the project makes is the exact reasoning that leads somebody to ignore a mismatch, or to skip a check they have been told there is nothing to do.

It now names which platforms carry a signature and which do not, and points at the provenance attestation beside the checksums. The guard reads those claims out of the release notes rather than from a list repeated in the test, so the two cannot drift apart again - and it fails rather than passes if it finds no sentence about signing to compare against.

Re-measured while there: repository secrets, zero, on 2026-09-06.

The locking setting never said what locking does not give

encryption described which readers open which scheme, and stopped there.

This is not a defect in the design, and the review that raised it said so. The salt comes from the run seed rather than from crypto/rand on purpose - a random one would give two runs of one recipe different bytes, which untouchable rule 3 forbids - and the password is written into the manifest because a locked fixture nobody can open checks nothing. Both are right for a tool that produces fixtures.

What was missing is the sentence where somebody meets it. aes-256 carries a meaning everywhere else it is written, and a person choosing it here gets an archive with no confidentiality at all: same recipe, same seed, same password gives the same key on any machine, and the password is written down beside the file.

The declaration carries the sentence, so tfg formats zip prints it and the window shows it beside the field. README.md says it too. The guard asks the declaration rather than the README, because the README is a third copy.

Guards

Two, both with mutations, both caught.

🤖 Generated with Claude Code