chore(distribution): publish v0.10.8 metadata

.github/workflows/premerge.yml

@@ -495,21 +495,24 @@ jobs:
           proxy=$(podman image inspect colossus-oci-proxy:acceptance --format '{{.Id}}')
           case "$proxy" in sha256:*) ;; *) proxy="sha256:$proxy" ;; esac
           echo "proxy=$proxy" >> "$GITHUB_OUTPUT"
-          # Pay rootless Podman's one-time container bootstrap here instead of inside the
-          # first sandboxed process, whose runtime budget is enforced by the suite. The
-          # sandbox always runs workloads as `--userns=keep-id --user <uid>:<gid>`, and the
-          # first such container materializes an id-mapped copy of the workload image in
-          # Podman's store, so mirror those flags to keep that cost outside the budget too.
-          # Mirror the sandbox's resource limits, capability drop, and bind mount as well so
-          # the cgroup and id-mapped mount setup they trigger is also charged to this step.
+          # Pay the one-time rootless Podman setup under a separate bounded readiness
+          # budget. Mirror the sandbox's cleared environment, runtime path, workload,
+          # user namespace, resource limits, bind mount, working directory, and shell
+          # write so the later 90-second success budget measures an already-ready runtime.
+          # The live suite retains its separate 12-second enforcement budget.
           warmup="$(mktemp --directory)"
-          podman run --rm --pull=never --network=none --read-only \
-            --userns=keep-id --user "$(id -u):$(id -g)" \
+          timeout --foreground --kill-after=10s 300s \
+            env -i PATH=/usr/bin /usr/bin/podman run --rm --pull=never \
+            --userns=keep-id --user "$(id -u):$(id -g)" --network=none --read-only \
             --cap-drop=ALL --security-opt=no-new-privileges \
+            --name colossus-podman-readiness \
             --pids-limit=16 --memory=134217728 \
             --mount "type=bind,source=$warmup,target=$warmup" \
-            --workdir "$warmup" --entrypoint /bin/true \
-            python:3.13-slim@sha256:e544a7fcbdf8555eceda66bf86cafb006c736339f76141918bcb812f3174c00a
+            --workdir "$warmup" \
+            python:3.13-slim@sha256:e544a7fcbdf8555eceda66bf86cafb006c736339f76141918bcb812f3174c00a \
+            /bin/sh -c 'printf ready > podman-readiness.txt && cat podman-readiness.txt'
+          test "$(cat "$warmup/podman-readiness.txt")" = ready
+          rm "$warmup/podman-readiness.txt"
           rmdir "$warmup"
       - name: Run live Podman OCI escape and recovery suite
         env:

crates/colossus-cli/tests/ci_contract.rs

@@ -267,6 +267,11 @@ fn premerge_requires_an_authorized_label_and_representative_platforms() {
         "for attempt in 1 2 3",
         "docker pull \"${{ matrix.image }}\"",
         "cargo xtask check dependencies",
+        "timeout --foreground --kill-after=10s 300s",
+        "env -i PATH=/usr/bin /usr/bin/podman run",
+        "--name colossus-podman-readiness",
+        "printf ready > podman-readiness.txt && cat podman-readiness.txt",
+        "test \"$(cat \"$warmup/podman-readiness.txt\")\" = ready",
     ] {
         assert!(
             source.contains(required),

flake.nix

@@ -12,23 +12,23 @@
         "x86_64-linux"
       ];
       forAllSystems = nixpkgs.lib.genAttrs systems;
-      version = "0.10.7";
+      version = "0.10.8";
       releases = {
         aarch64-darwin = {
           target = "aarch64-apple-darwin";
-          sha256 = "035d66323a2d07026266838a0799077e16e16e1f3d8d1f803a9f5f81ee2b7d5a";
+          sha256 = "be2f6b6f2274a7e1b4db4b9856d1c4627f938b6afc77cab2ffc344bb5bef39b0";
         };
         x86_64-darwin = {
           target = "x86_64-apple-darwin";
-          sha256 = "f5ccbce846efe485e411dd9dd7bc878d847719fc6012e001f84ea8c6142b68cc";
+          sha256 = "6d6b5897bbd87afe9646dac8b34bde89a6ea5a50706bd376532dc8cc9a8ba25c";
         };
         aarch64-linux = {
           target = "aarch64-unknown-linux-musl";
-          sha256 = "c226ce55c3a99ac4a1037b013e378b2c0a966e87bd114760fa26fab96a80eef8";
+          sha256 = "c4f26bdeeb883f085289657b99bf41ce16a6e5529f000526018b9f821379c567";
         };
         x86_64-linux = {
           target = "x86_64-unknown-linux-musl";
-          sha256 = "4d357af882825d0e033a22f0ec0f914d49fbb6bf34f8a8df2721da3d80841aae";
+          sha256 = "9451a77d0d765c563c7d7aa0bab45f92bdb16e87bc956f7a3119b4aec60f3fba";
         };
       };
     in {

packaging/homebrew/Formula/colossus.rb

@@ -5,11 +5,11 @@ class Colossus < Formula
 
   on_macos do
     if Hardware::CPU.arm?
-      url "https://github.com/obscuritylabs/Colossus/releases/download/v0.10.7/colossus-0.10.7-aarch64-apple-darwin.tar.gz"
-      sha256 "035d66323a2d07026266838a0799077e16e16e1f3d8d1f803a9f5f81ee2b7d5a"
+      url "https://github.com/obscuritylabs/Colossus/releases/download/v0.10.8/colossus-0.10.8-aarch64-apple-darwin.tar.gz"
+      sha256 "be2f6b6f2274a7e1b4db4b9856d1c4627f938b6afc77cab2ffc344bb5bef39b0"
     else
-      url "https://github.com/obscuritylabs/Colossus/releases/download/v0.10.7/colossus-0.10.7-x86_64-apple-darwin.tar.gz"
-      sha256 "f5ccbce846efe485e411dd9dd7bc878d847719fc6012e001f84ea8c6142b68cc"
+      url "https://github.com/obscuritylabs/Colossus/releases/download/v0.10.8/colossus-0.10.8-x86_64-apple-darwin.tar.gz"
+      sha256 "6d6b5897bbd87afe9646dac8b34bde89a6ea5a50706bd376532dc8cc9a8ba25c"
     end
   end