Repository navigation

Binary attestations: phase 2 – reproducible Fastly builds - #1449

Open

prk-Jr wants to merge 124 commits into

mainfrom

feature/binary-attestations-phase2

Open

Binary attestations: phase 2 – reproducible Fastly builds#1449
prk-Jr wants to merge 124 commits into
mainfrom
feature/binary-attestations-phase2

Commits on Oct 22, 2026
- Phase the reviewed binary attestation contract
  prk-Jr
  committed
  b772cd3
- Map binary attestation phases to review boundaries
  prk-Jr
  committed
  be81ca8
- Build and attest phased release binaries
  prk-Jr
  committed
  ca06217
- Document binary verification and release deployment
  prk-Jr
  committed
  4dd2171
- Align Phase 1 signing and publication with the reviewed contract
  prk-Jr
  committed
  3c41de5
- Allow the exact GitHub Actions build type reference host
  prk-Jr
  committed
  cb82e4b
- Document Phase 1 compatibility and verification boundaries
  prk-Jr
  committed
  41896cb
- Avoid stale API connections during release verification
  prk-Jr
  committed
  ca902b6
- Clarify rehearsed release status and CLI verification
  prk-Jr
  committed
  f3a8696
- Retry transient post-publication verification reads
  prk-Jr
  committed
  922c221
- Document offline verification and completed release rehearsal
  prk-Jr
  committed
  ff9f9c4
- Add production Axum assets and release startup checks
  prk-Jr
  committed
  7c7f4b0
- Disable rustup self-updates in temporary build homes
  prk-Jr
  committed
  b818b59
- Expose pinned compiler binaries in the GNU builder
  prk-Jr
  committed
  16d6690
Commits on Oct 23, 2026
- Supply runtime trust data to Axum startup checks
  prk-Jr
  committed
  937214a
- Record the seven-binary release rehearsal
  prk-Jr
  committed
  6824226
- Derive immutable release build facts
  prk-Jr
  committed
  e907e26
- Allow runtime Axum bind address overrides
  prk-Jr
  committed
  72b7e1e
- Harden release eligibility and artifact validation
  prk-Jr
  committed
  81a5a72
- Align release documentation and reference-host policy
  prk-Jr
  committed
  39a769c
- Reduce startup logging and align runtime port aliases
  prk-Jr
  committed
  e22d700
- Harden release verification and preflight boundaries
  prk-Jr
  committed
  2cc39ec
- Record rehearsal failure and release recovery checks
  prk-Jr
  committed
  7a05940
- Record the successful binary attestation rehearsal
  prk-Jr
  committed
  f84ab21
- Handle attestation availability and verify published bytes
  prk-Jr
  committed
  149754d
- Record the successful ninth attestation rehearsal
  prk-Jr
  committed
  f66da48
- Clarify final release verification notes (docs-only)
  prk-Jr
  committed
  a501d1b
Commits on Oct 26, 2026
- Record approved attestation phase assignment and closure checks
  prk-Jr
  committed
  26d69ce
- Require runtime source resources in release CLI builds
  prk-Jr
  committed
  4ee86da
- Propose ordinary Fastly release equality integration
  prk-Jr
  committed
  15a7b40
- Record approved Fastly gate activation and compatibility conditions
  prk-Jr
  committed
  8874e4f
- Port strict release documents and process supervision
  prk-Jr
  committed
  1534d46
- Specify reviewed ordinary Fastly gate implementation
  prk-Jr
  committed
  d0d5c37
- Align integration notes with immutable release facts
  prk-Jr
  committed
  d1c1d69
- Validate ordinary Fastly build observations
  prk-Jr
  committed
  021fdfd
- Compare complete ordinary Fastly final bytes
  prk-Jr
  committed
  ad78fc5
- Validate bounded ordinary Fastly transfer archives
  prk-Jr
  committed
  bb05d98
- Merge current main and clarify bind diagnostics
  prk-Jr
  committed
  afdc928
- Merge Phase 1 updates into Phase 2
  prk-Jr
  committed
  6de495a
- Bind ordinary uploads to current producing jobs
  prk-Jr
  committed
  ce7daa5
- Port reviewed tool tree content measurement
  prk-Jr
  committed
  4447b68
- Port reviewed final executable inspection
  prk-Jr
  committed
  ee5598b
- Join ordinary archive bytes to release observations
  prk-Jr
  committed
  cb5f16a
- Port the closed recipe and composition dependency graph
  prk-Jr
  committed
  13f63f0
- Record the closed Phase 2 port and policy boundaries
  prk-Jr
  committed
  f0d00dd
- Measure ordinary recipe and private JavaScript input identities
  prk-Jr
  committed
  c8ea09d
- Port checked JavaScript preparation alongside ordinary release builds
  prk-Jr
  committed
  c0f53a5
- Align remaining source identity documentation and comments
  prk-Jr
  committed
  f721ddb
- Record compatible preparation and remaining release integration
  prk-Jr
  committed
  b2cde8b
- Link excluded compatibility notes through their committed source
  prk-Jr
  committed
  3776d27
- Record source-pinned ordinary Fastly build observations
  prk-Jr
  committed
  cc4d0f3
- Seal real ordinary equality results in fresh atomic outputs
  prk-Jr
  committed
  6e9f713
- Expose checked ordinary measurement and comparison commands
  prk-Jr
  committed
  d365f56
- Acquire ordinary transfer archives through bounded authenticated reads
  prk-Jr
  committed
  f9e6cce
- Keep diagnostic payload assertions independent of optional backtraces
  prk-Jr
  committed
  4ede699
- Record ordinary adapter progress and remaining release wiring
  prk-Jr
  committed
  1e9a209
- Compare fresh ordinary Fastly builds before signing
  prk-Jr
  committed
  cc7df93
Commits on Oct 27, 2026
- Propose Fastly path normalization after the real A/B mismatch
  prk-Jr
  committed
  604d5d8
- Bind Docker image configuration and disable inherited commands
  prk-Jr
  committed
  7885bed
- Remove owned comparison outputs after sealing failures
  prk-Jr
  committed
  18df990
- Close inherited build controls and check direct JS entrypoints
  prk-Jr
  committed
  635086d
- Normalize compiler paths before ordinary Fastly byte comparison
  prk-Jr
  committed
  7beaa54
- Attest and publish the real Fastly rebuild check
  prk-Jr
  committed
  169e2a3
- Prove failed comparison skips downstream CI stages
  prk-Jr
  committed
  6f34d62
- Pin the browser integration test job to ubuntu-24.04
  prk-Jr
  committed
  886cf33
- Verify the pinned Fastly package route without network access
  prk-Jr
  committed
  a7e2056
- Record bounded raw Fastly package header diagnostics
  prk-Jr
  committed
  a8f8bcb
- Accept the confirmed Fastly directory header forms
  prk-Jr
  committed
  7127077
- Construct duplicate-key fixtures explicitly
  prk-Jr
  committed
  3ccfe29
- Address self-review findings in release attestations
  prk-Jr
  committed
  34e7e9e
- Strengthen release build-fact and gate tests
  prk-Jr
  committed
  ab6e549
- Merge Phase 1 updates into Phase 2
  prk-Jr
  committed
  770a425
- Record verified rehearsals and online SBOM checks
  prk-Jr
  committed
  2ed1b94
- Merge remote-tracking branch 'origin/main' into feature/binary-attestations-phase1
  prk-Jr
  committed
  68eef90
Commits on Oct 28, 2026
- Record the main-merge Phase 1 rehearsal
  prk-Jr
  committed
  2015231
- Merge branch 'feature/binary-attestations-phase1' into feature/binary-attestations-phase2
  prk-Jr
  committed
  81020c0
- Record the exact Phase 2 integration commit
  prk-Jr
  committed
  3ae0e19
- Merge commit '054c7b777ce67db34744cb1f4100b14e59c4bc5a' into feature/binary-attestations-phase2
  prk-Jr
  committed
  7d55177
- Record the newer-main Phase 2 integration
  prk-Jr
  committed
  5349b7c
- Record two independent Phase 1 spec review rounds
  prk-Jr
  committed
  c9a6117
- Merge the Phase 1 spec review log into Phase 2
  prk-Jr
  committed
  08e1c33
- Merge branch 'main' into feature/binary-attestations-phase1
  prk-Jr
  authored
  4940928
- Merge the updated Phase 1 branch into Phase 2
  prk-Jr
  committed
  8a797db
- Retain structured ordinary comparison failure diagnostics
  prk-Jr
  committed
  f2b2fa8
- Record Phase 2 spec reviews and reconcile readiness evidence
  prk-Jr
  committed
  5fa3843
- Record the exact-source Phase 2 rehearsal and completed checks
  prk-Jr
  committed
  fb48433
- Observe process groups without signalling after reaping
  prk-Jr
  committed
  927109f
- Record the runtime verification and current phase tracking
  prk-Jr
  committed
  36454c5
- Record the remaining rehearsal gate and runner failures
  prk-Jr
  committed
  5163241
Commits on Oct 29, 2026
- Record the successful Phase 2 release rehearsal
  prk-Jr
  committed
  0f89eae
- Address attested release review feedback
  prk-Jr
  committed
  79b1188
- Merge branch 'main' into feature/binary-attestations-phase1
  prk-Jr
  authored
  990509b
Commits on Nov 2, 2026
- Address maintainer review of Phase 1 attested releases
  prk-Jr
  committed
  c827eb2
- Merge main into feature/binary-attestations-phase1
  prk-Jr
  committed
  5f0139b
- Record Phase 1 fork rehearsal .22 at the current head
  prk-Jr
  committed
  890acd2
- Merge main into feature/binary-attestations-phase1
  prk-Jr
  committed
  029f204
- Bound release-attestation availability checks by their deadline
  prk-Jr
  committed
  69b74e2
- Merge main into feature/binary-attestations-phase1
  prk-Jr
  committed
  ba54b27
Commits on Nov 3, 2026
Commits on Nov 5, 2026
- Address third maintainer review of Phase 1 attested releases
  prk-Jr
  committed
  07c2bdf
- Raise the bundle check output limit and pin its real output size
  prk-Jr
  committed
  739016b
- Test the remaining publisher and SPDX guards
  prk-Jr
  committed
  3e2dd48
- Merge the narrowed Phase 1 into Phase 2
  prk-Jr
  committed
  3ddcd19
- Restore the Cargo metadata file the ordinary capture reads
  prk-Jr
  committed
  9eeccbb
- Record rehearsal .27 of the narrowed Phase 2
  prk-Jr
  committed
  c8c1efd
- Refuse release tags on commits that are on no branch
  prk-Jr
  committed
  861ed76
- Merge the Phase 1 branch check into Phase 2
  prk-Jr
  committed
  4455722
- Address Phase 2 review: drop inert canaries and unrelated churn
  prk-Jr
  committed
  1858b6d
- Document Phase 2 review follow-ups
  prk-Jr
  committed
  1860b99
Commits on Nov 10, 2026
- Address fourth maintainer review of Phase 1 attested releases
  prk-Jr
  committed
  3e6bb0f
- Merge the Phase 1 fourth review round into Phase 2
  prk-Jr
  committed
  61fd178
- Address the CHANGES_REQUESTED review of Phase 2 attested releases
  prk-Jr
  committed
  f243408
- Give each Fastly role a private remapped Cargo home
  prk-Jr
  committed
  e63ca7e
- Pin the remaining comparison and signing checks and drop unused code
  prk-Jr
  committed
  092de44
- Address the optional Phase 2 review suggestions
  prk-Jr
  committed
  0b1e350
- Authenticate packaged Wasm before parsing and keep children waitable
  prk-Jr
  committed
  37dfc6d
Commits on Nov 11, 2026
- Pin the round-3 release checks and correct the Phase 2 docs
  prk-Jr
  committed
  ba05cab
- Merge main into Phase 2
  prk-Jr
  committed
  e9e46e5
Commits on Nov 12, 2026
- Narrow producer and attest Fastly packages
  prk-Jr
  committed
  27361ec
- Point release deployment links at the Fastly package section
  prk-Jr
  committed
  17e509b
- Merge main into Phase 2
  prk-Jr
  committed
  fd33f2c

Commits

Commits on Oct 22, 2026

Commits on Oct 23, 2026

Commits on Oct 26, 2026

Commits on Oct 27, 2026

Commits on Oct 28, 2026

Commits on Oct 29, 2026

Commits on Nov 2, 2026

Commits on Nov 3, 2026

Commits on Nov 5, 2026

Commits on Nov 10, 2026

Commits on Nov 11, 2026

Commits on Nov 12, 2026