chore(release): pin the 0.8.2 image digest and shim commit (PR-B)#88
Merged
Conversation
The 0.8.2 publish ran (29914731366), so the two placeholders become real immutable identities: WALLET_DIGEST sha256:6090b0ca…5897d0 — the image the installer pulls SHIM_COMMIT 11275b2 — the merge commit of PR-2 (#87), whose cli/rustok is the 0.3.1 shim Both proven live rather than merely well-formed: the raw URL at that commit returns a shim byte-identical to cli/rustok on main, and the digest pulls from GHCR. The signature was verified from outside CI with cosign v3.0.3 against identity wallet-publish.yml@refs/heads/main (exit 0), and the same check pinned to a tag identity is refused — so the verification is not vacuous. The tag wallet-tui-v0.8.2 is cut from this commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The 0.8.2 publish ran (29914731366) — the guard printed
v0.8.2 is unpublished — proceeding, the image was built, signed and self-verified. The two fail-closed placeholders become real:WALLET_DIGESTsha256:6090b0ca16534f8fea4f6e3f89202ef754575befb386d365cd9c8bafcc5897d0SHIM_COMMIT11275b299d1f351f704433a30382030d9bfd232d— merge commit of PR-2 (#87), carrying the 0.3.1 shimNothing else changes. The
wallet-tui-v0.8.2tag is cut from this commit.Proof, not assertion
The pins resolve — a well-formed pin that 404s is exactly what this step exists to prevent:
11275b2returns 58 608 bytes, byte-identical tocli/rustokonmain;podman pull …@sha256:6090b0ca…succeeds.Verified from outside CI, not only by the workflow's self-check:
Bite control: the same command with the identity pinned to a tag is refused → the check is not vacuous.
Gates: pytest 188 · install 28/28 · shim 114/114 · shellcheck ·
bash -n.Reminder for the release step
Unchanged from 0.8.1 and still true: cosign 2.x cannot see these signatures (stored as OCI referrers). Users on 2.x reach the fail-closed branch and are told both ways forward — upgrade to cosign 3+, or install without cosign. Worth repeating in the release notes.