chore: add signed-release ceremony for v0.1.3 - #5
Merged
Conversation
Record where fingerprint pins live (keys/) and that they must enter the signed checksum set the same way release notes do. Changes: - Add PDR-0001 (proposed) - Index the record in docs/decisions/README.md Generated by Grok 4.6 via Grok Build under supervision of @3leapsdave Co-Authored-By: Grok 4.6 <noreply@3leaps.net> Role: cxotech Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
Add a waitprims-style signing DAG and generate fingerprint pins from decernor records. Stage those pins into dist before checksums. Changes: - Add release-insert-anchors, release-stage-anchors, and signing targets - Commit keys/expected-fingerprints generated by decernor fingerprint - Bump VERSION and notes to 0.1.3 - Accept PDR-0001 Generated by Grok 4.6 via Grok Build under supervision of @3leapsdave Co-Authored-By: Grok 4.6 <noreply@3leaps.net> Role: cxotech Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
Changes: - Normalize PDR-0001 and decisions README for goneat format Generated by Grok 4.6 via Grok Build under supervision of @3leapsdave Co-Authored-By: Grok 4.6 <noreply@3leaps.net> Role: cxotech Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
Require archives in checksums, verify staged pins, and install the fingerprint pair atomically. Align the process record with the executable walk. Changes: - Fail generate-checksums when no archives are present - Verify dist/release pins, schema, and recomputed publics - Stage insert outputs then replace both pin files as a pair - Add ceremony probes and reconcile PDR-0001 Generated by Grok 4.6 via Grok Build under supervision of @3leapsdave Co-Authored-By: Grok 4.6 <noreply@3leaps.net> Role: cxotech Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
Remove a newly installed pin when the second install fails and no prior pair existed. Require exactly two TXT fields and two NDJSON records on the staged payload. Changes: - Add atomic-install-pair with first-use rollback - Tighten staged TXT/NDJSON shape checks - Validate schema records via a temp file and trap - Extend ceremony probes for writer and shape faults Generated by Grok 4.6 via Grok Build under supervision of @3leapsdave Co-Authored-By: Grok 4.6 <noreply@3leaps.net> Role: cxotech Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
Arm process-lifetime rollback for the pin install window and extract shape/schema checks so ceremony probes assert the specific refusal. Changes: - Trap EXIT/INT/TERM/HUP until both dest files are installed - Add validate-pin-pair helper (shape + schema, no keys/ compare) - Probe signal-after-first-install and exact shape errors Generated by Grok 4.6 via Grok Build under supervision of @3leapsdave Co-Authored-By: Grok 4.6 <noreply@3leaps.net> Role: cxotech Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
Ceremony shape probes must fail on the two-field / two-record errors without a built binary. Schema validation still runs after shape. Generated by Grok 4.6 via Grok Build under supervision of @3leapsdave Co-Authored-By: Grok 4.6 <noreply@3leaps.net> Role: cxotech Committer-of-Record: Dave Thompson <dave.thompson@3leaps.net> [@3leapsdave]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the waitprims-style signing DAG and stages generated fingerprint pins into the checksum set before signing. Pins come from
decernor fingerprintviaDECERNOR_*environment variables only.First signed private cut is v0.1.3. Does not move v0.1.2.