build: qualify immutable Withings0.1.4 runtime releases #9
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/fixed-runtime-20261029"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Prepare Withings0.1.4 with the fixed digest-pinned Debian13 distroless runtime while retaining the Rust1.93 builder, external rotating-token store and existing API/auth behavior. Release CI builds one attested OCI artifact, scans that exact layout/config and publishes the same recursive index by digest. Tags must match the package and descend from main; scheduled audits skip image builds, and PRs have no publication credentials or cache export.
Independent review caught a copied crate-name error in dependency-cache cleanup before any release. The final patch restores withings_mcp cleanup and refuses stale stub binaries at build time; positive, stub, empty and read-error controls passed.120 MSRV tests, format/Clippy, RustSec/OSV/license/source gates pass. The copied publisher passed a real disposable-registry30-object proof with absent-object upload, identical replay, conflicting-tag and missing-descendant refusal. Two fresh Claude reviews approved exact
f57532d610conditional on remote CI.No production or provider writes. Final exact release image/binary identity, fresh scan, immutable provenance and native authenticated readback remain mandatory before promotion. Attestations are not signatures; tag prechecks are not registry compare-and-swap, so a single authorized writer is required. Existing production rollback pin remains retained at the platform layer.