Retain v0.1.7 verification files and update SIGNING.md

SIGNING.md

@@ -1,17 +1,17 @@
 # Verifying ArchiveGenocide release signatures
 
-Zero Breach v0.1.6 supplies detached GPG signatures for the exact released
+Zero Breach v0.1.7 supplies detached GPG signatures for the exact released
 scanner and its SHA256SUMS.txt manifest. They use ArchiveGenocide's existing
 Ed25519 release-signing key, also published on the archive's verification page.
 
 Official repository: https://github.com/interplains/zero-breach
-Official release: https://github.com/interplains/zero-breach/releases/tag/v0.1.6
+Official release: https://github.com/interplains/zero-breach/releases/tag/v0.1.7
 Independent publisher page: https://archivegenocide.com/scan/#verify-download
 Established key identity: https://archivegenocide.com/verify.html
 
 ## Check the publisher and file
 
-Download these three files from the v0.1.6 release into one directory:
+Download these three files from the v0.1.7 release into one directory:
 
 - zero-breach.py
 - zero-breach.py.asc
@@ -36,9 +36,9 @@ Verification must succeed using the expected ArchiveGenocide key. A warning
 that the key is not certified by your own web of trust is different from a
 bad signature; do not ignore a fingerprint mismatch or failed verification.
 
-The expected SHA-256 of zero-breach.py v0.1.6 is:
+The expected SHA-256 of zero-breach.py v0.1.7 is:
 
-    09fba9710143c11465c1627a0399b34ad1ee9a49341eddaa7d4656d77bf5ec78
+    9431426a940a3a9bdea617017030e0fa7b155693c3b2d25d97960d1eb262ae4e
 
 A signature verifies which key signed these exact bytes. It does not establish
 that the program has no bugs. A checksum alone is not publisher authentication.
@@ -58,14 +58,14 @@ The manifest lists the fifteen release-content files, including the optional
 requirements file and Candiru rule attribution and licence records. The manifest itself and
 the added public key/signatures are not self-listed.
 
-Public verification artifacts are also retained in release-signatures/v0.1.6/.
+Public verification artifacts are also retained in release-signatures/v0.1.7/.
 No private key is stored in this repository or in its project backups.
 
 ## Indicator updates are a separate trust path
 
 The manually run scan/update-iocs.py still checks HTTPS, a published SHA-256,
 and indicator-file validity. It does not automatically verify GPG signatures.
-The signed release manifest covers the indicator file shipped with v0.1.6;
+The signed release manifest covers the indicator file shipped with v0.1.7;
 it does not authenticate later files fetched from the development branch.
 
 ## Maintainer release procedure

release-signatures/v0.1.7/SHA256SUMS.txt

@@ -0,0 +1,15 @@
+b013f21a44956c6d717f211990b450aeaa4d7266da4614ab8c386b479565296e  LICENSE-CC-BY-SA-4.0.txt
+8a959b2413d0c83ca1b3ce9153076c649abf2e4bbfebbb493fb24c2074a1eb8a  LICENSE-DRL-1.1.txt
+55c1b1ea87e3767c1e1d8fe7b60b9e3e99f69dd79b7015428423e790fa0c14dd  NOTICE
+437a044d6ab5157e5e7af5a17ea3e311e409ff7093a6173d53376f3a1d42962c  adfection.adblock.txt
+712e2ec22cd6020c7e72c995c1e2c925546c24616a27bfe6b57692a53f2f093d  adfection.dnsmasq.conf
+d47609b69b58b918305b1c2e7fa6a8d1386cded512fe167613aec1375d254b71  adfection.domains.txt
+8276d3ec8c4210ea4c3c7fbc2065a6d02fdc782003bd168a11cc39e127c85e49  adfection.hosts.txt
+5ee47a8d062082f7a98ab85284a46d379141dc6172ba1e8e0d3fb22960a5ebe7  adfection.misp.json
+b346ad6fa1be58172847a5efca8567abb92428bd5359e9150922c37d1567c745  adfection.stix.json
+b86d4526066599e80b12971739e70a701a217e4c046ec29d06b8716ef2bf0572  adfection.withdrawals.stix.json
+c9801e3ba37376535a676d9938d65550bcaa5478578cb80a6dd09eb2ac402d38  adfection_iocs.txt
+9e8a80c2f80cf2fe7ff74be6308b4d9fc3a7fe14d6b90c9c9567e3479131b6c8  adfection_iocs.txt.sha256
+435d8d68f345ec5cc5e3046bb586cb215e878e2128c64bd3596712afe9bb60c4  candiru-rule-PROVENANCE.json
+7ce52106aae95ca50491067a30b0148af4890ac88ab33b92ad7da10b6d46c355  requirements-patterns.txt
+9431426a940a3a9bdea617017030e0fa7b155693c3b2d25d97960d1eb262ae4e  zero-breach.py

release-signatures/v0.1.7/SHA256SUMS.txt.asc

@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+
+iHUEABYKAB0WIQTCTskrEtZnCiUWBl+bTVdUma+lPAUCatdelwAKCRCbTVdUma+l
+PKbcAP9WV6n9VL7T/40CKCYJxdkru1yOz/D236+Tl/i6mOKKwAD/VVonZTUaA2M0
+NCBFOr+GyBK0NJfPtlAoSfEVYDqiPAc=
+=G3Gj
+-----END PGP SIGNATURE-----

release-signatures/v0.1.7/archivegenocide-signing-key.asc

@@ -0,0 +1,10 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEakkTBRYJKwYBBAHaRw8BAQdA+pOHPwElYpMviQuBZYxZeFXDSxJeG+Ib+RfE
+IBDND8+0LkFyY2hpdmUgR2Vub2NpZGUgPGFyY2hpdmVAYXJjaGl2ZWdlbm9jaWRl
+LmNvbT6IkwQTFgoAOxYhBMJOySsS1mcKJRYGX5tNV1SZr6U8BQJqSRMFAhsDBQsJ
+CAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEJtNV1SZr6U8dS4BANz2SqF8JJEe
+npU+A9bm+aYLKrTYsG1SUKmuctWU2ZnYAQCQS5WMaZM6tIUBL9tQDnW7gVCjFBQr
+/lMpsWDm8BG2Aw==
+=L8Ay
+-----END PGP PUBLIC KEY BLOCK-----

release-signatures/v0.1.7/zero-breach.py.asc

@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+
+iHUEABYKAB0WIQTCTskrEtZnCiUWBl+bTVdUma+lPAUCatdelwAKCRCbTVdUma+l
+PLKqAQDwGUZYzU/tthjuv/z+urD12E/XuFHmTVUGaHcwm0lLfAD/f5mMBEgJ5QvY
+Hhr2dRWeB6/R2RJgwWtjyKt47MlM1AQ=
+=RAHI
+-----END PGP SIGNATURE-----