Changes touching this path
- chore(release): attestations + unified sha256.sum + Linux smoke leg (#258)
Prep for cutting the real v0.1.0 release (spec §5-6):
- dist-workspace.toml: github-attestations = true (GitHub Artifact Attestations,
#221 integrity, verifiable via `gh attestation verify`) + checksum = sha256
(unified sha256.sum on the Release).
- release.yml regenerated by cargo-dist 0.32.0: adds attestations/id-token
permissions + the actions/attest step; the six target archives, both installers,
the unified sha256.sum and dist-manifest.json are unchanged.
- smoke-install.yml (standalone, so `dist generate` never clobbers it): on release
published it installs via the Linux `curl | sh` one-liner on a clean ubuntu
runner and resolves `loot --version`.
loot-cli is already 0.1.0. Firing the tag (`loot-first tag v0.1.0`) is a separate,
deliberate step. Refs #258.
924bda35 · dbf3dbe6… - Catch up to git main 809ddfe: #260 smoke default, #271 arm64 build, loot diff (#1), ADR 0034 dock retirement (#253)
587684dd · dbf3dbe6…diff - adopt: catch up to landed main 795bc2f6
58aa958a · dbf3dbe6…diff - the curl | sh smoke-install job skips itself while the repo is private, so a red release run means a real failure again (#761)
795bc2f6 · dbf3dbe6…diff - the repo never goes public, so the anonymous download path moves to R2 (#652)
#652 recorded a gate: flipping this repo public discloses sealed
docs/pitch/zk-host.md through PR #161 surviving refs/pull/161/head, verified
live 2026-07-30. Re-swept today across 321 PR head refs (up from 242), two ways
-- still exactly one carrier, unchanged. But the gate own remedy needs GitHub
Support, is not self-service, and has no date.
ADR 0045 stops waiting. The repo stays private permanently, and the anonymous
artifact path moves to Cloudflare R2 at dl.millerbyte.com instead. Attestations
are out rather than deferred; sha256 is the integrity story by decision.
Build: #806 DNS zone move, #807 R2 artifacts, #808 installer retarget and the
smoke test back on, #809 the Install page attestation claim.
ADR 0037 is superseded in two places and docs/specs/loot-site.md in three,
marked in place with dated blocks. The comments that called #652 a temporary
gate now say permanent, and CONTEXT.md no longer calls the GitHub mirror public.
9a04ab6f · dbf3dbe6…diff - installer: serve the R2 base first, and turn the curl | sh gate back on (#808)
The hero one-liner has been returning 404 in production. The site's /install.sh proxy
fetched the installer from GitHub anonymously, and the repo is private permanently
(ADR 0045), so there was nothing to fetch. #807 put the artifacts on R2; this points
the installer at them.
The proxy now reads upstream from dl.millerbyte.com and rewrites the generated
ARTIFACT_DOWNLOAD_URLS default to list the R2 base FIRST and GitHub second. dist's
installers already try each base in order, so the fallback costs nothing and keeps
working for anyone with credentials.
⭐ The rewrite derives the version from the line it is rewriting. The anchor already
contains the release tag, so capturing it means the site needs no version knowledge,
no 'latest' pointer to resolve and no credential — a test moves the tag and the R2
base follows.
⚠ The two installers genuinely differ and one regex would have silently matched
neither: sh builds a space-separated string, ps1 builds an array. The ps1 anchor is
pinned to the ASSIGNMENT rather than the URL, because the same URL also appears in
that script's help text — a loose match would rewrite the comment, leave the real
download list GitHub-only, and still pass every check that greps for the R2 base.
The rewrite THROWS if the anchor is absent. A silent no-op is the current bug wearing
a different hat: it would ship an installer pointing only at URLs that 404 for exactly
the audience the one-liner exists for, while the route returns 200 and the bytes look
like a real script. Nine tests cover both installers, both drift cases, and the
help-text trap; the anchors were also validated against the real 54 KB v0.4.2 scripts.
publish-r2 now also writes unversioned installer copies to /installers/. That is the
one deliberately mutable object in the bucket — every v{VERSION}/ prefix stays
immutable and year-cached, but 'latest' has to move or the one-liner pins itself to
whichever release shipped first. It carries max-age=300, matching the proxy.
smoke-install.yml loses its `if: false` and now defaults to the hero path rather than
a GitHub-direct URL. Testing a URL no user is told to run proved nothing; this
exercises the whole chain — proxy, rewrite, R2. The skip comment is kept as history,
because why it was disabled is why the gate is worth having.
6bf1df11 · dbf3dbe6…diff
Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.