v0.6.1 release fails its own clean-tree attestation; blocks downstream pinned installs
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Start with scripts/install-prebuilt.sh and scripts/verify_prebuilt_attestation.py, then inspect the v0.6.1 release attestation and the release checklist. Confirm that a clean-tree build passes verification, installer scripts are published at an immutable ref, and the checklist requires the attestation check before tagging; signing attestations is listed as a consideration.
由索引模型根据 Issue 内容生成。
描述
Problem
The Amortyx-Stack onboarding installer verifies OpenCodifier release artifacts against the release JSON attestation before installing. v0.6.1 fails that verification: the attestation's own build metadata records a dirty working tree (30 dirty paths), so the verifier's clean-tree check rejects the release. The newest installable release is therefore v0.5.0.
Impact
- Downstream users pinned to the recommended install get v0.5.0 and miss everything since.
- The installer previously targeted a
codex/prebuilt-release-installer-20261029branch for the installer scripts rather than a release tag, which is fragile: that branch is not an immutable publication point.
Requested work
- Rebuild v0.6.x from a clean tree (or cut v0.6.2) so the attestation passes its own clean-tree check.
- Publish the installer scripts (
scripts/install-prebuilt.sh,scripts/verify_prebuilt_attestation.py) at an immutable ref (tag or release asset) instead of only on a movingcodex/*branch, so downstream pins don't dangle. - Consider signing release attestations — the current JSON verifies bytes and records build metadata but is not a cryptographic signature.
- Document the release checklist item "attestation clean-tree check must pass before tagging" so this class of release doesn't recur.
Repro anchor
Amortyx-Stack user-guides/portable-free-ai-stack/scripts/install-opencodifier.sh (pinned SHA-256 wrapper) verified against v0.6.1 assets: attestation verifier reports the dirty-tree mismatch. Verified 2026-10-29.
- 主要语言
- Rust
- 星标
- 1
- 派生
- 0
- 平均合并
- 13 小时 10 分钟
- 30 天内合并 PR
- 12
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
aliasfoxkde/OpenCodifier 的其他 Issue
-
难度 5/5 一周以上 新手友好度 25/100
维护者通常 1 天内回复
查看 aliasfoxkde/OpenCodifier 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 88/100
software-mansion/pathfinder#3620 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 88/100
维护者通常 1 天内回复
-
bug priority: low
难度 1/5 1 小时以内 新手友好度 90/100
storytold/wordcraft#6211 · 1 条评论 ·
维护者通常 2 天内回复
-
backlog multiple issues priority: low
难度 2/5 1-3 小时 新手友好度 72/100
storytold/pdfcraft#6911 · 2 条评论 ·
维护者通常 2 天内回复
-
DGNIMPORT: "The DGN model has nothing that can be imported" when the first element streams are empty未关闭
难度 2/5 1-3 小时 新手友好度 76/100
HakanSeven12/OpenCADStudio#2820 · 1 条评论 ·
维护者通常 1 天内回复