Rebuild CrossDrive v1.5.35 with verifiable GPL source and release gates - #4
Merged
Merged
Conversation
gkaragioul
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v1.5.34 downloads contain a custom WSL kernel and APFS/HFS modules without a verified corresponding-source package. This PR builds new v1.5.35 binaries from pinned upstream commits, records the final kernel config, toolchain, patch and output hashes, and packages their exact source beside both Windows downloads. The historical v1.5.34 binaries remain explicitly unverified.
The release audit now checks the bundled binaries, module ABI, kernel config, source ZIP contents and packaged shell-script line endings. CI builds the source ZIP and rejects temporary checkout files in it. Signed release paths require all three assets; the manual publisher also supports an explicit
-AllowUnsignedpath that labels the release and publishes the installer, portable executable and source ZIP together. Installer builds remove stale versioned outputs before rebuilding.Validation: a full Ubuntu WSL kernel/module build succeeded; rebuilt module versions match
6.6.87.2-microsoft-standard-WSL2. The explicit unsigned candidate built both v1.5.35 Windows executables and the matching source ZIP locally. Product, dependency, commercial, unsigned release and strict GPL source audits passed. A deliberate binary-hash mismatch and an oversized source ZIP containing Git checkouts were both rejected. Both Windows executables reportNotSigned.Review notes: the v1.5.35 source ZIP is about 226 MB and is built on demand from pinned upstream archives. The user chose an unsigned public v1.5.35 release and removal of the old v1.5.34 downloads after the new version is online. No public release is created by this PR itself.