IvanHunters d5891f7093 fix(marketplace): close gate rename bypass, label CLI tap sources, reject artifact-name collisions ...

Address review findings:
- The index gate listed only added/modified entries (--diff-filter=AM), so a
  renamed entry file (R) skipped validation and signature checks and could
  auto-merge an unreviewed ociRef. Include renames and copies (ACMR).
- 'cozypkg tap' created its OCIRepository without the marketplace-tap label or
  tap-name annotation, so the dashboard's orphan-disconnect could not find a
  CLI-created source. Set both, aligned with the tap's community name.
- cozypkg validate now rejects two components whose artifact names collide after
  dot-to-dash normalisation (e.g. v1.0/c and v1/0-c), which would otherwise make
  the reconciler overwrite one OutputArtifact with the other.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>

2026-09-07 10:58:37 +03:00

..

validate-entry.sh

fix(marketplace): close gate rename bypass, label CLI tap sources, reject artifact-name collisions

2026-09-07 10:58:37 +03:00