From 6798febc98eb9ae9990bb75fa24d0ceae6e69bf5 Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Sat, 5 Sep 2026 10:48:05 +0200 Subject: [PATCH 1/2] Layer 2026.09.1: meld 0.52.0 -> 0.53.0, synth 0.60.0 -> 0.61.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The two tools that moved since 2026.09.0. Everything else in the layer — rivet 0.35.0, spar 0.40.0, witness 0.43.0, ordeal 0.19.0, loom 1.4.1, wsc 0.11.0, kilnd 0.4.4 — is already at its latest release. Checked before proposing, not after depositing: - Both releases publish a cosign-signed SHA256SUMS.txt with its bundle, so both clear rung 1 of the ingest ladder and neither needs an unverified opt-in. - Both asset templates still describe the releases. `varve-producer assets` (the v0.32.0 binary, from the signed release) matches all four platforms for each. That check exists because a mistyped %V template once omitted a tool from a published layer while the run went green with four notices. Deposit inputs, read out of the registry by tools/next-layer-id.sh rather than typed: layer 2026.09.1, counter 2. A layer id once published is spent, so guessing it is not an option. This deposit is also the first to exercise three things added in v0.32.0: publish-check refusing a republish before any blob is written, the per-layer concurrency group, and sign-status refusing a status document with no support window — which means 2026.09.1 will be the first layer varve has ever published that states one. Every layer so far reports "no stated support window". --- .github/workflows/deposit-layer.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/deposit-layer.yml b/.github/workflows/deposit-layer.yml index 12c7462..380c567 100644 --- a/.github/workflows/deposit-layer.yml +++ b/.github/workflows/deposit-layer.yml @@ -42,7 +42,7 @@ env: # ordeal rejoined at v0.18.0 — its first cosign-signed release (ordeal#116). # Entry shape: repo_tool:version[:binary] — binary defaults to the tool # name; kiln ships its CLI as `kilnd`. - TARBALL_TOOLS: "rivet:v0.35.0 spar:v0.40.0 synth:v0.60.0 witness:v0.43.0 ordeal:v0.19.0 loom:v1.4.1 meld:v0.52.0 kiln:v0.4.4:kilnd" + TARBALL_TOOLS: "rivet:v0.35.0 spar:v0.40.0 synth:v0.61.0 witness:v0.43.0 ordeal:v0.19.0 loom:v1.4.1 meld:v0.53.0 kiln:v0.4.4:kilnd" WSC_VERSION: v0.11.0 # VS Code extensions carried as kind="vsix" payloads (REQ-VSIX-001). # Entry shape: repo:version:extension-name:asset-template, where the From e6f79c90c8091d0206b93f7750853985d95bffeb Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Sat, 5 Sep 2026 10:51:23 +0200 Subject: [PATCH 2/2] Layer 2026.09.1: carry varve-producer in the layer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The assembler now rides in the layer like any other tool, so a layers repository gets a PINNED, signature-verified assembler instead of fetching one ad hoc — which is what REQ-PRODUCERGET-001 asked for, taken one step further than a documented download. The entry needs both optional fields because the producer is the one payload whose repo, binary and asset name all differ: the repo is `varve`, the binary is `varve-producer`, and the asset is not `--`. Spelling the template as `varve-producer-v%V-%T.tar.gz` reconstructs the tag from the bare version instead of repeating it, so bumping the version is one edit and the template cannot drift out of step with it. Validated with the released v0.32.0 binary before proposing, not after depositing: `varve-producer assets` matches all four platforms. The negative control matters here — the DEFAULT template for this entry would be `varve-v0.32.0-%T.tar.gz`, which selects varve's own archive, whose binary is named `varve` and would then fail the extraction step. Getting the template wrong fails loudly rather than depositing the wrong bytes. Bootstrapping is not circular. The deposit downloads the released archive exactly as it does for every other tool; the first assembler comes from the release, and after that a layers repo can pin the one varve signed. --- .github/workflows/deposit-layer.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/deposit-layer.yml b/.github/workflows/deposit-layer.yml index 380c567..d9e3468 100644 --- a/.github/workflows/deposit-layer.yml +++ b/.github/workflows/deposit-layer.yml @@ -42,7 +42,17 @@ env: # ordeal rejoined at v0.18.0 — its first cosign-signed release (ordeal#116). # Entry shape: repo_tool:version[:binary] — binary defaults to the tool # name; kiln ships its CLI as `kilnd`. - TARBALL_TOOLS: "rivet:v0.35.0 spar:v0.40.0 synth:v0.61.0 witness:v0.43.0 ordeal:v0.19.0 loom:v1.4.1 meld:v0.53.0 kiln:v0.4.4:kilnd" + # varve-producer rides in the layer like any other tool, so a layers + # repository gets a PINNED, signature-verified assembler instead of fetching + # one ad hoc. Its asset is not `--` — the repo is + # `varve` and the binary is `varve-producer` — so the entry spells the binary + # and the template out. `v%V` reconstructs the tag from the bare version + # rather than repeating it, so a bump is one edit and cannot drift. + # + # Bootstrapping is not circular: the deposit downloads the released archive + # exactly as it does for every other tool. The first assembler comes from the + # release; after that a layers repo can pin the one varve signed. + TARBALL_TOOLS: "rivet:v0.35.0 spar:v0.40.0 synth:v0.61.0 witness:v0.43.0 ordeal:v0.19.0 loom:v1.4.1 meld:v0.53.0 kiln:v0.4.4:kilnd pulseengine/varve:v0.32.0:varve-producer:varve-producer-v%V-%T.tar.gz" WSC_VERSION: v0.11.0 # VS Code extensions carried as kind="vsix" payloads (REQ-VSIX-001). # Entry shape: repo:version:extension-name:asset-template, where the