v0.6.1 release fails its own clean-tree attestation; blocks downstream pinned installs
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
Start with scripts/install-prebuilt.sh and scripts/verify_prebuilt_attestation.py, then inspect the v0.6.1 release attestation and the release checklist. Confirm that a clean-tree build passes verification, installer scripts are published at an immutable ref, and the checklist requires the attestation check before tagging; signing attestations is listed as a consideration.
由索引模型根據 Issue 內容生成。
描述
Problem
The Amortyx-Stack onboarding installer verifies OpenCodifier release artifacts against the release JSON attestation before installing. v0.6.1 fails that verification: the attestation's own build metadata records a dirty working tree (30 dirty paths), so the verifier's clean-tree check rejects the release. The newest installable release is therefore v0.5.0.
Impact
- Downstream users pinned to the recommended install get v0.5.0 and miss everything since.
- The installer previously targeted a
codex/prebuilt-release-installer-20261029branch for the installer scripts rather than a release tag, which is fragile: that branch is not an immutable publication point.
Requested work
- Rebuild v0.6.x from a clean tree (or cut v0.6.2) so the attestation passes its own clean-tree check.
- Publish the installer scripts (
scripts/install-prebuilt.sh,scripts/verify_prebuilt_attestation.py) at an immutable ref (tag or release asset) instead of only on a movingcodex/*branch, so downstream pins don't dangle. - Consider signing release attestations — the current JSON verifies bytes and records build metadata but is not a cryptographic signature.
- Document the release checklist item "attestation clean-tree check must pass before tagging" so this class of release doesn't recur.
Repro anchor
Amortyx-Stack user-guides/portable-free-ai-stack/scripts/install-opencodifier.sh (pinned SHA-256 wrapper) verified against v0.6.1 assets: attestation verifier reports the dirty-tree mismatch. Verified 2026-10-29.
- 主要語言
- Rust
- 星號
- 1
- 分支
- 0
- 平均合併
- 13 小時 10 分鐘
- 30 天內合併 PR
- 12
環境準備
這個專案沒有提供開發容器、Dockerfile 或貢獻指南，環境需要你自己搭建：先看它的 README，通用步驟見我們的新手貢獻指南。
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
aliasfoxkde/OpenCodifier 的其他 Issue
-
難度 5/5 一週以上 新手友好度 25/100
維護者通常 1 天內回覆
查看 aliasfoxkde/OpenCodifier 的全部 Issue
相似的 Issue
-
難度 2/5 1-3 小時 新手友好度 88/100
software-mansion/pathfinder#3620 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 88/100
維護者通常 1 天內回覆
-
bug priority: low
難度 1/5 1 小時以內 新手友好度 90/100
storytold/wordcraft#6211 · 1 則留言 ·
維護者通常 2 天內回覆
-
backlog multiple issues priority: low
難度 2/5 1-3 小時 新手友好度 72/100
storytold/pdfcraft#6911 · 2 則留言 ·
維護者通常 2 天內回覆
-
DGNIMPORT: "The DGN model has nothing that can be imported" when the first element streams are empty未關閉
難度 2/5 1-3 小時 新手友好度 76/100
HakanSeven12/OpenCADStudio#2820 · 1 則留言 ·
維護者通常 1 天內回覆