Release Matrix with fixed runtime and exact scanned OCI publication #157

Merged

jlxq0 merged 2 commits from fix/fixed-runtime-20261029 into main

2026-10-28 23:32:12 +00:00

jlxq0 commented

2026-10-28 23:22:54 +00:00

Owner

Release CI now builds one SPDX/SLSA-attested OCI layout, scans those exact bytes, and copies the full index by digest before exposing an immutable version tag. A different existing release tag is refused. The optional GHCR mirror copies the same layout without rebuilding/media conversion. Main builds and scans without publishing a release; PR jobs receive no registry credentials. The copier is byte-identical to the independently qualified CardDAV/Hevy helper.

Validation:386 unit+6 integration tests,4 crypto floor regressions, source audit0 vulnerability advisories with2 unsuppressed unmaintained notices; fixed-base compatibility health200/version/unauthenticated401 and14 OS packages with0HIGH/CRITICAL findings. Local disposable-registry test verified30 recursively copied objects, SPDX/SLSA retention, same-digest replay and conflicting-tag refusal. These are source/base qualification, not the new final release artifact. Exact-head independent review+CI, actual main image build, final tag scan/provenance/ELF/health and coordinated scoped platform promotion remain mandatory. No production apply or message writes.

Prepare v0.10.16 with the already reviewed fixed crypto dependencies and fresh room-verification read. This PR changes only the final runtime to the pinned official Debian13 nonroot base and release pipeline/docs. Rust1.96 builder, Matrix SDK0.19.1, encrypted stores, user, ports, credentials and entrypoint remain unchanged. Release CI now builds one SPDX/SLSA-attested OCI layout, scans those exact bytes, and copies the full index by digest before exposing an immutable version tag. A different existing release tag is refused. The optional GHCR mirror copies the same layout without rebuilding/media conversion. Main builds and scans without publishing a release; PR jobs receive no registry credentials. The copier is byte-identical to the independently qualified CardDAV/Hevy helper. Validation:386 unit+6 integration tests,4 crypto floor regressions, source audit0 vulnerability advisories with2 unsuppressed unmaintained notices; fixed-base compatibility health200/version/unauthenticated401 and14 OS packages with0HIGH/CRITICAL findings. Local disposable-registry test verified30 recursively copied objects, SPDX/SLSA retention, same-digest replay and conflicting-tag refusal. These are source/base qualification, not the new final release artifact. Exact-head independent review+CI, actual main image build, final tag scan/provenance/ELF/health and coordinated scoped platform promotion remain mandatory. No production apply or message writes.

jlxq0 added 1 commit

2026-10-28 23:22:54 +00:00

release: qualify Matrix fixed runtime and publish scanned OCI bytes

CI / cargo (pull_request) Successful in 4m31s

Details

CI / docker (pull_request) Has been skipped

Details

2836e0307d

jlxq0 added 1 commit

2026-10-28 23:28:11 +00:00

test: prove publisher copies absent OCI descendants

CI / cargo (pull_request) Successful in 3m11s