From 6bed9e3e0dfb037cc3dfa4fa784686386778930d Mon Sep 17 00:00:00 2001
From: Flo <g-gitlab@zeidler.ms>
Date: Tue, 31 Mar 2026 00:12:57 +0200
Subject: [PATCH] chore: bump version to v0.1.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Initial release of git-harden.sh with audit/apply modes, SSH signing
wizard, FIDO2 support, SSH config hardening, safety review gate,
and 64 BATS tests.

Closes: #13

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 CHANGELOG.md  | 34 ++++++++++++++++++++++++++++++++++
 git-harden.sh |  2 +-
 2 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..8946e4d
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,34 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
+
+## [0.1.0] - 2026-03-31
+
+### Added
+- Interactive shell script that audits and hardens global git config
+- Audit mode (`--audit`) with color-coded report and CI-friendly exit codes
+- Auto-apply mode (`-y`) for unattended hardening
+- Object integrity checks (`transfer.fsckObjects`, `fetch.fsckObjects`, `receive.fsckObjects`)
+- Protocol restrictions with default-deny policy (blocks `git://` and `ext://`)
+- Filesystem protection (`core.protectNTFS`, `core.protectHFS`, `core.fsmonitor=false`)
+- Hook execution control via `core.hooksPath` redirection
+- Repository safety (`safe.bareRepository=explicit`, `submodule.recurse=false`)
+- Pull/merge hardening (`pull.ff=only`, `merge.ff=only`) with `pull.rebase` conflict detection
+- Transport security (HTTP-to-HTTPS rewrite, `http.sslVerify=true`)
+- Platform-detected credential helper (`osxkeychain` on macOS, `libsecret` on Linux)
+- SSH signing setup wizard with two tiers: software ed25519 and FIDO2 hardware keys
+- SSH config hardening (`StrictHostKeyChecking`, `HashKnownHosts`, `IdentitiesOnly`, algorithm restrictions)
+- Allowed signers file management
+- Pre-execution safety review gate with AI assistant review instructions
+- OSINT privacy advisory about signing key reuse across orgs
+- Admin/org-level recommendations printed at end of every run
+- Config backup before applying changes
+- BATS test suite with 64 tests
+
+### Security
+- Safe tilde expansion without `eval`
+- SSH config value parsing handles inline comments and quoted paths
+- Version comparison uses base-10 arithmetic to prevent octal interpretation
+- Containers run with `--network=none` and non-root user (e2e spec)
diff --git a/git-harden.sh b/git-harden.sh
index d2f0e45..afd7487 100755
--- a/git-harden.sh
+++ b/git-harden.sh
@@ -10,7 +10,7 @@ IFS=$'\n\t'
 # ------------------------------------------------------------------------------
 # Constants
 # ------------------------------------------------------------------------------
-readonly VERSION="1.0.0"
+readonly VERSION="0.1.0"
 readonly BACKUP_DIR="${HOME}/.config/git"
 readonly HOOKS_DIR="${HOME}/.config/git/hooks"
 readonly ALLOWED_SIGNERS_FILE="${HOME}/.config/git/allowed_signers"