feat: v0.6.0 — DNSSEC enforcement, SVCB param demotion, quality gates#4
Merged
feat: v0.6.0 — DNSSEC enforcement, SVCB param demotion, quality gates#4
Conversation
… signing, security hardening Wire require_dnssec into discover(): raises DNSSECError when AD flag absent. Add DANE full certificate matching with SPKI support. Add Sigstore cosign keyless signing to release workflow (wheel, tarball, SBOM). - DNSSEC enforcement with DNSSECError exception on validation failure - DANE/TLSA full certificate and SPKI matching (verify_dane_cert flag) - Sigstore cosign keyless signing in release workflow - SSRF protection for cap_fetcher and a2a_card (HTTPS-only, private IP blocking) - BANDAID custom SVCB params (cap, cap-sha256, bap, policy, realm, sig) - JWS application-layer signatures as DNSSEC alternative - Backend list_records and get_record support for all providers - MCP server transport options and new tools - Experimental metadata models (agent_metadata, capability_model) documented - MAINTAINERS.md with open roles and recruitment plan - Bandit config migrated to pyproject.toml for newer versions - 577 tests passing, ruff clean, mypy clean, bandit clean Signed-off-by: Igor Racic <iracic82@gmail.com>
Route53 and Cloudflare reject private-use SvcParamKeys (key65001–key65006). Both backends now split standard SVCB params from custom BANDAID params (cap, cap-sha256, bap, policy, realm, sig), keeping standard params in SVCB and demoting custom params to TXT records with bandaid_ prefix. - Route53 backend: publish_agent() override with param demotion - Cloudflare backend: same demotion pattern applied - Correct version labels across docs (remove non-existent v0.7.0 refs) - Mark Kubernetes Controller as Planned in all documentation - 577 tests passing, 3 new param demotion tests for Route53 Signed-off-by: Igor Racic <iracic82@gmail.com>
Refactor 5 functions exceeding cognitive complexity threshold of 10 by extracting private helpers with no public API changes. Add 87 new tests covering CLI commands, publisher, SDK client, validator, indexer, Cloudflare backend, OTEL telemetry, and discoverer edge cases. Complexity refactoring: - discoverer.py: extract 7 helpers from discover/zone/http functions - cap_fetcher.py: extract _verify_cap_digest, _extract_string_list - otel.py: extract _parse_signal_fqdn, _build_span_attributes Test coverage additions: - CLI: publish, delete, list, zones, index list/sync, verify commands - Publisher: default backend, sign validation, exception handling - SDK client: async context, rankings fetch, HTTP sync push - Validator: DANE cert match/mismatch, DNSSEC TXT fallback - Indexer: DNS reads, delete/sync exceptions, equality checks - Cloudflare: param demotion, get_record SVCB/TXT/not-found - OTEL: span attributes, FQDN parsing, shutdown idempotency Result: 664 tests passing, 0 C901 violations, 80% coverage, ruff/bandit clean Signed-off-by: Igor Racic <iracic82@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sync dns-aid-core with upstream development. This release brings security enforcement, DNS backend fixes, and code quality improvements to meet LF contribution standards.
DNSSEC & Security Hardening
require_dnssecintodiscover()— raisesDNSSECErrorwhen AD flag absentverify_dane_certflag)cap_fetcheranda2a_card(HTTPS-only, private IP blocking)SVCB Custom Param Demotion
bandaid_prefixCode Quality (SonarQube Gate)
Additional
agent_metadata,capability_model) documented as Phase 5.5MAINTAINERS.mdwith open roles and recruitment planlist_recordsandget_recordsupport for all providerspyproject.tomlfor newer versionsTest Plan
pytest tests/ -m "not live")ruff check --select C901 src/)