Use shared S3 compilation cache and unsigned Harbor SBOMs

Wuast94 commented

2026-10-08 23:15:49 +02:00

Owner

Releases no longer require Cosign keys or public Rekor/Sigstore. Syft SPDX inventories are published as unsigned Harbor OCI referrers; subject digest, manifest/blob integrity and downloaded bytes are verified before promotion of the identical candidate image digest.

Local Cargo/setup, CI, BuildKit and native C/C++ compilation use the mandatory shared Ceph S3 cache. Private credential files and BuildKit file secrets preserve existing keys. A private filtered lifecycle/error ledger survives normal SDK daemon restarts, including S3 read failures treated as misses. Backend failures prevent success; final-daemon hit counts are labeled accurately.

Own test wall-clock watchdogs, shortened fixture shutdown budgets and kill timers are removed. Tests observe actual processing, errors, state changes and complete joins/reaps. Specification and library defaults remain; application timeout contracts use controlled virtual time where appropriate.

Validation: complete local just gate exit 0 at final source, log SHA256 d57ddeadc8fde3552042ea67a9755f1d15e7eb208e03c2781cd342b5fbe6b703. Native CI1127 Quality and Build production both succeeded at exact head 184faac. The final image ran the actual tool, Git/SSH, import, API, data/sequence restore, native restart/follow-up and legacy rollback scenarios under nonroot/read-only execution. Rust/C cache miss→hit and SDK restart/cleanup canaries passed. The Linux-only unused-mut failure was corrected without suppression.

The protected PR is merged as main bde0214. Main release1129, planned v0.12.0, was cancelled before publication. Native PR CI1127 remains successful. No production deployment switch is part of this standard correction.

Work is stopped for a shared-cache policy decision. Native VRDS compilation observed the pinned sccache 0.18 idle default shutting down an active compile after 600 seconds without a new RPC, followed by a 10-second drain and the client's UnexpectedEof local fallback. The current standard explicitly forbids disabling that idle default. No override, SDK fork or keepalive workaround has been applied. VRDS CI1331 and Updatarr main release1129 were cancelled through the supported Forgejo API; resume only after the user's explicit decision.

Releases no longer require Cosign keys or public Rekor/Sigstore. Syft SPDX inventories are published as unsigned Harbor OCI referrers; subject digest, manifest/blob integrity and downloaded bytes are verified before promotion of the identical candidate image digest. Local Cargo/setup, CI, BuildKit and native C/C++ compilation use the mandatory shared Ceph S3 cache. Private credential files and BuildKit file secrets preserve existing keys. A private filtered lifecycle/error ledger survives normal SDK daemon restarts, including S3 read failures treated as misses. Backend failures prevent success; final-daemon hit counts are labeled accurately. Own test wall-clock watchdogs, shortened fixture shutdown budgets and kill timers are removed. Tests observe actual processing, errors, state changes and complete joins/reaps. Specification and library defaults remain; application timeout contracts use controlled virtual time where appropriate. Validation: complete local just gate exit 0 at final source, log SHA256 d57ddeadc8fde3552042ea67a9755f1d15e7eb208e03c2781cd342b5fbe6b703. Native CI1127 Quality and Build production both succeeded at exact head 184faac. The final image ran the actual tool, Git/SSH, import, API, data/sequence restore, native restart/follow-up and legacy rollback scenarios under nonroot/read-only execution. Rust/C cache miss→hit and SDK restart/cleanup canaries passed. The Linux-only unused-mut failure was corrected without suppression. The protected PR is merged as main bde0214. Main release1129, planned v0.12.0, was cancelled before publication. Native PR CI1127 remains successful. No production deployment switch is part of this standard correction. Work is stopped for a shared-cache policy decision. Native VRDS compilation observed the pinned sccache 0.18 idle default shutting down an active compile after 600 seconds without a new RPC, followed by a 10-second drain and the client's UnexpectedEof local fallback. The current standard explicitly forbids disabling that idle default. No override, SDK fork or keepalive workaround has been applied. VRDS CI1331 and Updatarr main release1129 were cancelled through the supported Forgejo API; resume only after the user's explicit decision.

Wuast94 added 2 commits

2026-10-08 23:15:50 +02:00

fix(release): remove signing and verify unsigned Harbor SBOMs 6bdb67a585

perf(build): use shared S3 compiler cache across every build path

CI / Quality (pull_request) Has been cancelled

Details

CI / Build production (pull_request) Has been cancelled

Details

e1e002db6c

Wuast94 scheduled this pull request to auto merge when all checks succeed

2026-10-08 23:17:17 +02:00

Wuast94 canceled auto merging this pull request when all checks succeed