Skip to content

ci: fingerprint the BIND build recipe - #89

Merged
bryanwieg merged 1 commit into
masterfrom
fix/bind920-build-recipe-provenance
Aug 28, 2026
Merged

bryanwieg merged 1 commit into
masterfrom
fix/bind920-build-recipe-provenance

Conversation

@bryanwieg

Copy link
Copy Markdown
Collaborator

Summary

  • advance BIND package provenance to schema 3
  • include the build-bind920.sh SHA-256 in the reusable package fingerprint
  • treat older provenance schemas as cache misses so build-policy changes force fresh archives
  • retain strict failures for malformed current-schema metadata

Production finding

Run 33185237606 correctly installed lmdb0, but then attempted to reuse the previously published schema-2 BIND pair. That pair still depended on lmdb, so reuse failed before a fresh build. Hashing the build recipe prevents this class of stale binary reuse.

Verification

  • pytest -q .github/ci/ci-tests (293 passed, 3 subtests passed)
  • python3 -m py_compile .github/ci/bind920_profile.py .github/ci/reuse_bind920.py
  • git diff --check

@bryanwieg
bryanwieg merged commit 47feb3a into master Aug 28, 2026
5 checks passed
@bryanwieg
bryanwieg deleted the fix/bind920-build-recipe-provenance branch August 28, 2026 15:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant