Repository navigation

Binary attestations: phase 1 – attested release binaries with provenance and SBOMs - #1435

Draft

prk-Jr wants to merge 31 commits into

mainfrom

feature/binary-attestations-phase1

Draft

Binary attestations: phase 1 – attested release binaries with provenance and SBOMs#1435
prk-Jr wants to merge 31 commits into
mainfrom
feature/binary-attestations-phase1

Commits on Oct 22, 2026
- Phase the reviewed binary attestation contract
  prk-Jr
  committed
  b772cd3
- Map binary attestation phases to review boundaries
  prk-Jr
  committed
  be81ca8
- Build and attest phased release binaries
  prk-Jr
  committed
  ca06217
- Document binary verification and release deployment
  prk-Jr
  committed
  4dd2171
- Align Phase 1 signing and publication with the reviewed contract
  prk-Jr
  committed
  3c41de5
- Allow the exact GitHub Actions build type reference host
  prk-Jr
  committed
  cb82e4b
- Document Phase 1 compatibility and verification boundaries
  prk-Jr
  committed
  41896cb
- Avoid stale API connections during release verification
  prk-Jr
  committed
  ca902b6
- Clarify rehearsed release status and CLI verification
  prk-Jr
  committed
  f3a8696
- Retry transient post-publication verification reads
  prk-Jr
  committed
  922c221
- Document offline verification and completed release rehearsal
  prk-Jr
  committed
  ff9f9c4
- Add production Axum assets and release startup checks
  prk-Jr
  committed
  7c7f4b0
- Disable rustup self-updates in temporary build homes
  prk-Jr
  committed
  b818b59
- Expose pinned compiler binaries in the GNU builder
  prk-Jr
  committed
  16d6690
Commits on Oct 23, 2026
- Supply runtime trust data to Axum startup checks
  prk-Jr
  committed
  937214a
- Record the seven-binary release rehearsal
  prk-Jr
  committed
  6824226
- Derive immutable release build facts
  prk-Jr
  committed
  e907e26
- Allow runtime Axum bind address overrides
  prk-Jr
  committed
  72b7e1e
- Harden release eligibility and artifact validation
  prk-Jr
  committed
  81a5a72
- Align release documentation and reference-host policy
  prk-Jr
  committed
  39a769c
- Reduce startup logging and align runtime port aliases
  prk-Jr
  committed
  e22d700
- Harden release verification and preflight boundaries
  prk-Jr
  committed
  2cc39ec
- Record rehearsal failure and release recovery checks
  prk-Jr
  committed
  7a05940
- Record the successful binary attestation rehearsal
  prk-Jr
  committed
  f84ab21
- Handle attestation availability and verify published bytes
  prk-Jr
  committed
  149754d
- Record the successful ninth attestation rehearsal
  prk-Jr
  committed
  f66da48
- Clarify final release verification notes (docs-only)
  prk-Jr
  committed
  a501d1b
Commits on Oct 26, 2026
- Merge current main and clarify bind diagnostics
  prk-Jr
  committed
  afdc928
Commits on Oct 27, 2026

Navigation Menu

Repository navigation

Binary attestations: phase 1 – attested release binaries with provenance and SBOMs - #1435

Binary attestations: phase 1 – attested release binaries with provenance and SBOMs#1435
prk-Jr wants to merge 31 commits into
mainfrom
feature/binary-attestations-phase1

Commits on Oct 22, 2026

Phase the reviewed binary attestation contract

Map binary attestation phases to review boundaries

Build and attest phased release binaries

Document binary verification and release deployment

Align Phase 1 signing and publication with the reviewed contract

Allow the exact GitHub Actions build type reference host

Document Phase 1 compatibility and verification boundaries

Avoid stale API connections during release verification

Clarify rehearsed release status and CLI verification

Retry transient post-publication verification reads

Document offline verification and completed release rehearsal

Add production Axum assets and release startup checks

Disable rustup self-updates in temporary build homes

Expose pinned compiler binaries in the GNU builder

Commits on Oct 23, 2026

Supply runtime trust data to Axum startup checks

Record the seven-binary release rehearsal

Derive immutable release build facts

Allow runtime Axum bind address overrides

Harden release eligibility and artifact validation

Align release documentation and reference-host policy

Reduce startup logging and align runtime port aliases

Harden release verification and preflight boundaries

Record rehearsal failure and release recovery checks

Record the successful binary attestation rehearsal

Handle attestation availability and verify published bytes

Record the successful ninth attestation rehearsal

Clarify final release verification notes (docs-only)

Commits on Oct 26, 2026

Merge current main and clarify bind diagnostics

Commits on Oct 27, 2026

Address self-review findings in release attestations

Strengthen release build-fact and gate tests

Merge remote-tracking branch 'origin/main' into feature/binary-attestations-phase1