Use shared S3 compilation cache and unsigned Harbor SBOMs

Wuast94 commented

2026-10-08 22:29:47 +02:00

Owner

Releases no longer require Cosign keys or public Rekor/Sigstore. Syft SPDX inventories are published as unsigned Harbor OCI referrers; subject digest, manifest/blob integrity and downloaded bytes are verified before promotion of the identical candidate image digest.

Local Cargo/setup, CI, BuildKit and native C/C++ compilation use the same mandatory Ceph S3 cache. Private credential files and BuildKit file secrets preserve existing keys. A private filtered lifecycle/error ledger survives normal SDK daemon restarts, including S3 read failures treated as misses. Backend failures prevent success; final-daemon hit counts are labeled accurately.

Own test wall-clock watchdogs, shortened fixture shutdown budgets and kill timers have been removed. Tests observe real processing, errors, state changes and complete joins/reaps. Actual specification and library defaults remain; application timeout contracts use controlled virtual time where appropriate.

Validation: the complete local just gate returned exit 0, including 59 cache behavior cases and all required Rust, data and browser checks. Real Rust/C cache miss→hit and SDK restart/cleanup canaries passed. Already user-merged main updates are integrated. Exact protected CI and the unsigned Harbor release round-trip are still required.

Releases no longer require Cosign keys or public Rekor/Sigstore. Syft SPDX inventories are published as unsigned Harbor OCI referrers; subject digest, manifest/blob integrity and downloaded bytes are verified before promotion of the identical candidate image digest. Local Cargo/setup, CI, BuildKit and native C/C++ compilation use the same mandatory Ceph S3 cache. Private credential files and BuildKit file secrets preserve existing keys. A private filtered lifecycle/error ledger survives normal SDK daemon restarts, including S3 read failures treated as misses. Backend failures prevent success; final-daemon hit counts are labeled accurately. Own test wall-clock watchdogs, shortened fixture shutdown budgets and kill timers have been removed. Tests observe real processing, errors, state changes and complete joins/reaps. Actual specification and library defaults remain; application timeout contracts use controlled virtual time where appropriate. Validation: the complete local just gate returned exit 0, including 59 cache behavior cases and all required Rust, data and browser checks. Real Rust/C cache miss→hit and SDK restart/cleanup canaries passed. Already user-merged main updates are integrated. Exact protected CI and the unsigned Harbor release round-trip are still required.

Wuast94 added 2 commits

2026-10-08 22:29:48 +02:00

fix(release): remove signing and verify unsigned Harbor SBOMs e3bf31a5fe

perf(build): use shared S3 compiler cache across every build path

CI / Quality (pull_request) Has been cancelled

Details

CI / Build reference (production) (pull_request) Has been cancelled

Details

CI / Build reference (postgres-redis-reference) (pull_request) Has been cancelled

Details

a308e2e3bd

Wuast94 added 1 commit