[Packaging/Homebrew] Admit the reviewed #1097 rootfs build without rewriting provenance - #1108
Merged
Merged
Conversation
…nt main Package archives truthfully record the commit that built them. The original durable-generation format also required that producer to be the current-main publisher. That leaves no safe way to retain an immutable archive set across a commit change: rewriting provenance would be false, while accepting an older release by ancestry or cache key would weaken admission. Introduce generation format v2, which records immutable archive producer S separately from validated current-main authority M and the independently checked release-tag anchor R. Current-main code rederives the selected projection, expected ledger, build-input closure, ABI evidence, archive inventory, and consumer compatibility. Existing v1 releases remain readable. Carry the separate producer and main identities through publication, materialization, receipts, and the bounded rootfs/wasm32 Homebrew lane. Add fail-closed coverage for tree, projection, component, source-only dependency, architecture, and dispatch drift.
The producer/main split changes a public package-distribution contract. Without one authoritative explanation, a maintainer could mistake a release tag for archive provenance, treat ancestry as input equivalence, or expose preservation evidence as a consumable package generation. Document the roles of archive producer S, release anchor R, and current-main authority M; the v1 and v2 manifest rules; the selected build-input closure; exact consumer materialization; and the operating sequence for preservation and promotion. State the one-shot rootfs boundary and the broader browser-generation work that remains unclaimed.
A content-addressed manifest is not enough if main, the producer release, or its assets can change between draft creation, archive uploads, the application seal, and the public transition. Without repeated authorization, one release could combine observations from different source states. Capture one canonical live-source snapshot, rederive semantic evidence with current-main code, and compare a fresh snapshot immediately before every remote mutation. Upload generation.json last as the application seal, then repeat the same authority check before making the draft public. Exercise successful retry plus source movement before creation, between uploads, before the seal, and before publication so every mutation boundary fails closed.
Admitting immutable package evidence and retiring mutable PR staging are different lifecycle decisions. Letting promotion delete the staging release or remove its retention label would make a successful compatibility proof authorize unrelated destructive cleanup. Remove promotion-owned staging deletion and label mutation. Document the separate lifecycle boundary and make the focused workflow contract test reject any future source-cleanup write from promotion.
The #1097 cache bridge exists for one reviewed rootfs/wasm32 archive closure. Without explicit code-level bounds, generic v2 inputs could reuse that proof for another producer, source capture, root set, architecture, or ABI. A preservation run from an old clean checkout could also write release state after main had moved. Hard-bind the bridge to the reviewed #1097 producer, pr-1097-staging capture, schema-1 rootfs/wasm32 selection, and ABI 42. Recheck the direct main ref before tag creation, draft creation, every asset upload, the application seal, and the public transition, while keeping an exact already-public retry read-only. Remove unused pull-request write permission. Cover unauthorized selections and main movement before the first write, between uploads, and after the seal. Clarify v2 recovery and producer terminology, and remove stale comments that misstated the projection contract.
brandonpayton
added
the
ready-to-ship
Contributor
|
prepare-merge: test-gate passed against the synthetic PR merge and sealed |
Contributor
|
Canonical package activation failed closed for |
This was referenced Jul 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Every Kandelo package archive records the commit that actually built it. Pull request #1097 produced a complete 15-archive
rootfs/wasm32package set at producer commit748c2609954d2809bbcbbcb642fa7d257fc0dbc6, but the current-main commit that reviews and publishes those bytes is different.Relabeling the archives as main-built would make their provenance false. Consuming the mutable
pr-1097-stagingrelease directly would also let temporary pull-request state enter Homebrew production. Maintainers need a bounded way to admit only the package inputs that were actually audited, while currentmainremains the sole executable and mutation authority.This unblocks the first Bash/M4 Homebrew bottle lane. It does not admit the broader browser package set: that 44-root selection has different cache identities for
lamp,nginx-php-vfs, andwordpressand must be rebuilt under its real current-main producer.What changed
S, release-tag anchorR, and validated current-main authorityM.preserved-package-generation-...release whose manifest saysadmission = "none"; ordinary materializers reject it.748c260..., thepr-1097-stagingcapture, schema-1rootfs/wasm32, and ABI 42.package-generation-...release targeted at validated mainM, while archive manifests retain truthful producerS.generation.jsonlast as the application seal and reauthorize before publication.Safety boundaries
Sand this candidate.pull-requests: read; it adds no new write permission.Validation
bash scripts/dev-shell.sh bash .github/scripts/test-package-generation.shbash scripts/dev-shell.sh bash .github/scripts/test-publish-durable-package-generation.shbash scripts/dev-shell.sh bash .github/scripts/test-materialize-exact-package-generations.shbash scripts/dev-shell.sh ruby scripts/check-homebrew-publish-workflow-trust.rbbash scripts/dev-shell.sh bash scripts/test-homebrew-publish-workflow.sh— passed on the identical reviewed tree after installing lockfile-pinned root dependencies.cargo test -p xtask— 570 passed on the identical reviewed tree.bash scripts/dev-shell.sh bash scripts/check-abi-version.shlamp,nginx-php-vfs, andwordpress.range-diff, stable combined patch identity, andgit diff --checkall pass on the actual post-[Kernel/Homebrew] Land ABI 42 before activating the bottled shell #1097 base.cargo fmt --all --checkwas unavailable because the canonical dev shell does not includecargo-fmt; the Rust code compiled and all xtask tests passed.Scope and rollout
This is packaging/build workflow authority only. It does not change kernel, libc, ABI, Node.js runtime, browser runtime, package revisions, archives, indexes, or VFS images.
This PR does not publish anything. After merge, read exact
Mfrom livemain, confirm the pinned validator bytes, promote from the already-public preserved generation, verify anonymous readback, and rotate tap callers separately.Not run
No kernel, libc, POSIX, Sortix, Playwright, or manual browser suites were rerun for this replay because its final source tree is byte-identical to the independently reviewed tree and it does not change runtime surfaces. No GitHub preservation/promotion workflow was dispatched, and no public release, package archive, index, bottle, tap, or VFS artifact was created.