Repository navigation
fix(release): bind SBOM main modules and GitHub tag events for 0.4.1 - #169
Merged
Merged
Conversation
Independent acceptance kept the real six-program SPDX intact and pointed every standard library's DEPENDENCY_OF at the library itself; the per-program check still passed because it only compared evident-by edges and never proved that the dependency target was the program's main module. Release construction now reads the module path that go.mod declares and requires each release program to be the evident-by file of exactly one package named by that path with package URL pkg:golang/<module>, and of exactly one standard library at the scanned version whose DEPENDENCY_OF names that same main-module package. A self-referencing, foreign or missing main module fails before signing. The shared SBOM fixture now carries package URLs, release-build fixtures declare the module it names, and a self-dependency regression joins the existing refusals; the real-Syft journey passes with its own declared module. Generated with Claude Code
… tag The first GitHub tag push of this source failed in two places that review and dev runs never reach. validate-version-tag read only GitLab's CI_COMMIT_TAG, so a GitHub tag, which names itself through GITHUB_REF_TYPE and GITHUB_REF_NAME, failed with "CI_COMMIT_TAG must use v<semver>". And sixteen candidate-mode tests in tools/release/construction and tools/ci inherited the runner's selected tag, so candidate admission refused them on every platform. validate-version-tag now uses the shared readiness.SelectedReleaseTag owner that already selects either peer's tag. Both test packages clear the runner's release-tag selection in TestMain; tests that need a tag set it explicitly. The version-tag regression adds a GitHub tag push, and every package passes under a simulated GitHub tag environment as well as a clean one. Generated with Claude Code
The v0.4.0 tag at a04e265 failed its GitHub release checks, and the release tooling and SBOM checks changed after it, so no release assets were published for it. The operator chose to keep that tag immutable and release the fixed source as 0.4.1. VERSION and the dated Changelog section move to 0.4.1, whose section names it the first published 0.4 release and notes the assetless v0.4.0 tag. Task 4.5's Desktop requalification and task 9.3 now name the 0.4.1 reader and release; the performance acceptance records that 0.4.1 ships the same product code; the Migration Plan and the late-fix record cover the failed tag run. Generated with Claude Code
Independent acceptance found the main-module identity check rejecting the real Syft SBOM whenever Go stamped the fixture's main module from version control: Syft then records the module's pseudo-version as its SPDX version and in its package URL, pkg:golang/<module>@<version>, and isModule accepted only the unversioned URL. TestReleaseSBOMCatalogsEveryNativeBinary failed whenever its temporary directory sat inside a Git checkout, as it does during ETHOS proof. isModule now accepts the unversioned package URL or one whose percent-decoded version equals the package's own SPDX version, so a +dirty pseudo-version encoded as %2B matches while a package URL naming another version does not. New regressions accept a versioned main module and refuse a package URL with a foreign version; the real-Syft journey passes with a repository-local TMPDIR. Generated with Claude Code
8ae65f8 widened validate-version-tag to read either peer's ref variables. Acceptance asked to keep the gate's explicit CI_COMMIT_TAG contract and repair the event projection instead: GitLab sets CI_COMMIT_TAG for tag pipelines, but the GitHub release-version job never passed its tag to the gate. The CUE graph now gives that step CI_COMMIT_TAG from github.ref_name, the rendered verify.yml matches it, and the projection test requires the input. validate-version-tag and its regression are back to their production form. The test packages keep clearing the runner's release-tag selection, so candidate fixtures no longer inherit a tag push. Generated with Claude Code
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release-blocking fixes found after
a04e265dand the 0.4.1 preparation that replaces the failedv0.4.0tag.e03f07fe,52392a8b): each release program must be the evident-by file of exactly one package of the main module thatgo.moddeclares (name, and a package URL whose version, if any, is the package's own) and of exactly one Go standard library, at the scanned version, that is a DEPENDENCY_OF that same main-module package. Regressions cover self-referencing, foreign and mismatched-version cases and a VCS-stamped main module; the real-Syft journey passes with a repository-local TMPDIR.8ae65f85,03e210c5): thev0.4.0tag run failed because the GitHub version job never passed its tag to the gate'sCI_COMMIT_TAGinput, and candidate-mode tests inherited the runner's tag. The CUE projection now supplies the tag, the production gate is unchanged, and the test packages clear the runner's release-tag selection.ab2167db):v0.4.0stays immutable without release assets; VERSION and the dated Changelog section move to 0.4.1.Local evidence: source gate and full ETHOS proof at
03e210c5(attestation3991ca48…); the release, construction, CI and projection packages pass in a clean and a simulated GitHub tag-push environment. Task 4.5.2 (real-Provider tool continuation) remains open.Generated with Claude Code