From d74e08811801f2cfbe799d1405feab43d5706b27 Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Wed, 29 Jul 2026 00:27:22 +0700 Subject: [PATCH 1/4] release: prepare v0.15.1 fix-forward Signed-off-by: Jeremi Joslin --- .github/workflows/release.yml | 16 ++++-- Cargo.lock | 52 +++++++++---------- Cargo.toml | 48 ++++++++--------- SECURITY.md | 10 ++-- crates/registry-relay/CHANGELOG.md | 5 ++ crates/registry-relay/docs/release-notes.md | 5 ++ .../openapi/registry-relay.openapi.json | 2 +- .../security/advisory-baseline.json | 6 +-- crates/registryctl/CHANGELOG.md | 5 ++ .../bounded-http/registry-stack.yaml | 4 +- .../spreadsheet/registry-stack.yaml | 4 +- crates/registryctl/install.sh | 2 +- .../dhis2-tracker/registry-stack.yaml | 4 +- .../registry-stack.yaml | 4 +- .../opencrvs/registry-stack.yaml | 4 +- .../snapshot-exact/registry-stack.yaml | 4 +- .../scripts/check-registryctl-tutorials.sh | 2 +- .../deployment-documentation-truth.test.mjs | 22 +++++--- .../registryctl-release-provenance.test.mjs | 6 +-- .../scripts/registryctl-tutorial.test.mjs | 4 +- docs/site/src/components/RegistryBanner.astro | 2 +- docs/site/src/content/docs/changelog.mdx | 9 ++++ .../content/docs/reference/registryctl.mdx | 6 +-- .../tutorials/author-registry-project.mdx | 6 +-- ...blish-spreadsheet-secured-registry-api.mdx | 10 ++-- .../docs/tutorials/use-your-spreadsheet.mdx | 4 +- .../tutorials/verify-claim-registry-api.mdx | 4 +- docs/site/src/data/docsets.yaml | 31 +++++++++++ docs/site/src/data/generated/docsets.json | 41 +++++++++++++++ docs/site/src/data/generated/projects.json | 18 +++---- .../src/data/generated/standard-journeys.json | 14 ++--- docs/site/src/data/projects.yaml | 18 +++---- editors/tests/install_test.sh | 6 +-- products/manifest/CHANGELOG.md | 5 ++ products/manifest/docs/release-notes.md | 5 ++ products/manifest/fuzz/Cargo.lock | 6 +-- products/notary/CHANGELOG.md | 5 ++ products/notary/docs/release-notes.md | 5 ++ products/notary/fuzz/Cargo.lock | 22 ++++---- .../openapi/registry-notary.openapi.json | 4 +- .../notary/security/advisory-baseline.json | 6 +-- products/platform/CHANGELOG.md | 5 ++ products/platform/fuzz/Cargo.lock | 18 +++---- release/OPERATIONS.md | 16 +++--- release/REPEATABLE-BUILDS.md | 2 +- release/manifests/registry-stack-beta-21.yaml | 38 ++++++++++++++ release/notes/v0.15.1.md | 52 +++++++++++++++++++ release/scripts/registry-release | 3 ++ release/scripts/test_registry_release.py | 18 ++++++- 49 files changed, 417 insertions(+), 171 deletions(-) create mode 100644 release/manifests/registry-stack-beta-21.yaml create mode 100644 release/notes/v0.15.1.md diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2bf4fc2fd2..a8ed30ab85 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -114,9 +114,9 @@ jobs: import release_candidate message = Path(sys.argv[1]).read_text(encoding="utf-8") - if message.endswith("\n\n"): - message = message[:-1] - binding = release_candidate.parse_tag_binding(message) + if not message.endswith("\n"): + raise SystemExit("git for-each-ref did not emit a record separator") + binding = release_candidate.parse_tag_binding(message[:-1]) with Path(sys.argv[2]).open("a", encoding="utf-8") as handle: for field in ("run_id", "run_attempt", "receipt_sha256"): handle.write(f"{field}={binding[field]}\n") @@ -373,6 +373,16 @@ jobs: git for-each-ref --format='%(contents)' \ "refs/tags/${{ needs.verify.outputs.tag }}" \ > promotion/control/tag-message + python3 - promotion/control/tag-message <<'PY' + import sys + from pathlib import Path + + path = Path(sys.argv[1]) + message = path.read_text(encoding="utf-8") + if not message.endswith("\n"): + raise SystemExit("git for-each-ref did not emit a record separator") + path.write_text(message[:-1], encoding="utf-8") + PY python3 release/scripts/release_candidate.py verify-tag-binding \ --message promotion/control/tag-message \ --receipt "${receipt}" \ diff --git a/Cargo.lock b/Cargo.lock index a15fa2228c..862726e1c3 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -5184,7 +5184,7 @@ checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4" [[package]] name = "registry-config-report" -version = "0.15.0" +version = "0.15.1" dependencies = [ "jsonschema 0.46.6", "serde", @@ -5193,7 +5193,7 @@ dependencies = [ [[package]] name = "registry-language-server" -version = "0.15.0" +version = "0.15.1" dependencies = [ "anyhow", "serde_json", @@ -5206,7 +5206,7 @@ dependencies = [ [[package]] name = "registry-manifest-cli" -version = "0.15.0" +version = "0.15.1" dependencies = [ "registry-manifest-core", "serde", @@ -5217,7 +5217,7 @@ dependencies = [ [[package]] name = "registry-manifest-core" -version = "0.15.0" +version = "0.15.1" dependencies = [ "oxiri", "oxjsonld", @@ -5232,7 +5232,7 @@ dependencies = [ [[package]] name = "registry-notary" -version = "0.15.0" +version = "0.15.1" dependencies = [ "axum", "axum-test", @@ -5269,7 +5269,7 @@ dependencies = [ [[package]] name = "registry-notary-client" -version = "0.15.0" +version = "0.15.1" dependencies = [ "async-trait", "axum", @@ -5297,7 +5297,7 @@ dependencies = [ [[package]] name = "registry-notary-core" -version = "0.15.0" +version = "0.15.1" dependencies = [ "base64", "humantime-serde", @@ -5325,7 +5325,7 @@ dependencies = [ [[package]] name = "registry-notary-server" -version = "0.15.0" +version = "0.15.1" dependencies = [ "async-trait", "aws-lc-rs", @@ -5383,7 +5383,7 @@ dependencies = [ [[package]] name = "registry-notary-worker-harness" -version = "0.15.0" +version = "0.15.1" dependencies = [ "libc", "serde", @@ -5395,7 +5395,7 @@ dependencies = [ [[package]] name = "registry-platform-audit" -version = "0.15.0" +version = "0.15.1" dependencies = [ "async-trait", "hmac 0.13.0", @@ -5416,7 +5416,7 @@ dependencies = [ [[package]] name = "registry-platform-authcommon" -version = "0.15.0" +version = "0.15.1" dependencies = [ "proptest", "serde", @@ -5430,7 +5430,7 @@ dependencies = [ [[package]] name = "registry-platform-cache" -version = "0.15.0" +version = "0.15.1" dependencies = [ "async-trait", "sha2 0.11.0", @@ -5441,7 +5441,7 @@ dependencies = [ [[package]] name = "registry-platform-canonical-json" -version = "0.15.0" +version = "0.15.1" dependencies = [ "ryu-js", "serde", @@ -5451,7 +5451,7 @@ dependencies = [ [[package]] name = "registry-platform-config" -version = "0.15.0" +version = "0.15.1" dependencies = [ "base64", "registry-platform-crypto", @@ -5466,7 +5466,7 @@ dependencies = [ [[package]] name = "registry-platform-crypto" -version = "0.15.0" +version = "0.15.1" dependencies = [ "async-trait", "aws-lc-rs", @@ -5489,7 +5489,7 @@ dependencies = [ [[package]] name = "registry-platform-httpsec" -version = "0.15.0" +version = "0.15.1" dependencies = [ "axum", "http", @@ -5504,7 +5504,7 @@ dependencies = [ [[package]] name = "registry-platform-httputil" -version = "0.15.0" +version = "0.15.1" dependencies = [ "axum", "base64", @@ -5531,7 +5531,7 @@ dependencies = [ [[package]] name = "registry-platform-oid4vci" -version = "0.15.0" +version = "0.15.1" dependencies = [ "base64", "registry-platform-crypto", @@ -5546,7 +5546,7 @@ dependencies = [ [[package]] name = "registry-platform-oidc" -version = "0.15.0" +version = "0.15.1" dependencies = [ "axum", "base64", @@ -5562,7 +5562,7 @@ dependencies = [ [[package]] name = "registry-platform-ops" -version = "0.15.0" +version = "0.15.1" dependencies = [ "fs2", "jsonschema 0.46.6", @@ -5579,14 +5579,14 @@ dependencies = [ [[package]] name = "registry-platform-pdp" -version = "0.15.0" +version = "0.15.1" dependencies = [ "serde", ] [[package]] name = "registry-platform-replay" -version = "0.15.0" +version = "0.15.1" dependencies = [ "async-trait", "getrandom 0.4.3", @@ -5598,7 +5598,7 @@ dependencies = [ [[package]] name = "registry-platform-sdjwt" -version = "0.15.0" +version = "0.15.1" dependencies = [ "async-trait", "base64", @@ -5615,7 +5615,7 @@ dependencies = [ [[package]] name = "registry-platform-testing" -version = "0.15.0" +version = "0.15.1" dependencies = [ "async-trait", "axum", @@ -5641,7 +5641,7 @@ dependencies = [ [[package]] name = "registry-relay" -version = "0.15.0" +version = "0.15.1" dependencies = [ "arc-swap", "assert-json-diff", @@ -5723,7 +5723,7 @@ dependencies = [ [[package]] name = "registryctl" -version = "0.15.0" +version = "0.15.1" dependencies = [ "anyhow", "async-trait", diff --git a/Cargo.toml b/Cargo.toml index ff9819ef68..a416a925cb 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -40,7 +40,7 @@ exclude = [ resolver = "2" [workspace.package] -version = "0.15.0" +version = "0.15.1" edition = "2021" rust-version = "1.95" license = "Apache-2.0" @@ -51,29 +51,29 @@ repository = "https://github.com/registrystack/registry-stack" unsafe_code = "forbid" [workspace.dependencies] -registry-config-report = { path = "crates/registry-config-report", version = "0.15.0" } -registry-language-server = { path = "crates/registry-language-server", version = "0.15.0" } -registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.15.0" } -registry-notary-client = { path = "crates/registry-notary-client", version = "0.15.0" } -registry-notary-core = { path = "crates/registry-notary-core", version = "0.15.0" } -registry-relay = { path = "crates/registry-relay", version = "0.15.0" } -registry-notary-server = { path = "crates/registry-notary-server", version = "0.15.0", default-features = false } -registry-notary-worker-harness = { path = "crates/registry-notary-worker-harness", version = "0.15.0" } -registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.15.0" } -registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.15.0" } -registry-platform-cache = { path = "crates/registry-platform-cache", version = "0.15.0" } -registry-platform-canonical-json = { path = "crates/registry-platform-canonical-json", version = "0.15.0" } -registry-platform-config = { path = "crates/registry-platform-config", version = "0.15.0" } -registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.15.0" } -registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.15.0" } -registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.15.0" } -registry-platform-oid4vci = { path = "crates/registry-platform-oid4vci", version = "0.15.0" } -registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.15.0" } -registry-platform-ops = { path = "crates/registry-platform-ops", version = "0.15.0" } -registry-platform-pdp = { path = "crates/registry-platform-pdp", version = "0.15.0" } -registry-platform-replay = { path = "crates/registry-platform-replay", version = "0.15.0" } -registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.15.0" } -registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.15.0" } +registry-config-report = { path = "crates/registry-config-report", version = "0.15.1" } +registry-language-server = { path = "crates/registry-language-server", version = "0.15.1" } +registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.15.1" } +registry-notary-client = { path = "crates/registry-notary-client", version = "0.15.1" } +registry-notary-core = { path = "crates/registry-notary-core", version = "0.15.1" } +registry-relay = { path = "crates/registry-relay", version = "0.15.1" } +registry-notary-server = { path = "crates/registry-notary-server", version = "0.15.1", default-features = false } +registry-notary-worker-harness = { path = "crates/registry-notary-worker-harness", version = "0.15.1" } +registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.15.1" } +registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.15.1" } +registry-platform-cache = { path = "crates/registry-platform-cache", version = "0.15.1" } +registry-platform-canonical-json = { path = "crates/registry-platform-canonical-json", version = "0.15.1" } +registry-platform-config = { path = "crates/registry-platform-config", version = "0.15.1" } +registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.15.1" } +registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.15.1" } +registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.15.1" } +registry-platform-oid4vci = { path = "crates/registry-platform-oid4vci", version = "0.15.1" } +registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.15.1" } +registry-platform-ops = { path = "crates/registry-platform-ops", version = "0.15.1" } +registry-platform-pdp = { path = "crates/registry-platform-pdp", version = "0.15.1" } +registry-platform-replay = { path = "crates/registry-platform-replay", version = "0.15.1" } +registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.15.1" } +registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.15.1" } crosswalk-core = { git = "https://github.com/PublicSchema/crosswalk", rev = "1d44ec735fdc8a7c719264b339574371e8330337", version = "0.2.0" } crosswalk-functions = { git = "https://github.com/PublicSchema/crosswalk", rev = "1d44ec735fdc8a7c719264b339574371e8330337", version = "0.2.0" } diff --git a/SECURITY.md b/SECURITY.md index ab81dcf233..8ce7402886 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -44,14 +44,14 @@ include cosign signatures without SLSA provenance. For each signed release asset, download three files from the GitHub Release: -- The asset, for example `registryctl-v0.15.0-linux-amd64` -- The matching signature, for example `registryctl-v0.15.0-linux-amd64.sig` -- The matching certificate, for example `registryctl-v0.15.0-linux-amd64.pem` +- The asset, for example `registryctl-v0.15.1-linux-amd64` +- The matching signature, for example `registryctl-v0.15.1-linux-amd64.sig` +- The matching certificate, for example `registryctl-v0.15.1-linux-amd64.pem` Then verify the asset: ```bash -asset=registryctl-v0.15.0-linux-amd64 +asset=registryctl-v0.15.1-linux-amd64 cosign verify-blob \ --certificate "${asset}.pem" \ @@ -69,7 +69,7 @@ For releases with SLSA provenance, download the provenance asset and verify the artifact against the release tag: ```bash -tag=v0.15.0 +tag=v0.15.1 asset=registryctl-${tag}-linux-amd64 provenance=registry-stack-${tag}-release-provenance.intoto.jsonl diff --git a/crates/registry-relay/CHANGELOG.md b/crates/registry-relay/CHANGELOG.md index 66fbec3a97..50aac241dc 100644 --- a/crates/registry-relay/CHANGELOG.md +++ b/crates/registry-relay/CHANGELOG.md @@ -2,6 +2,11 @@ ## Unreleased +## 0.15.1 - 2026-07-28 + +- No user-visible Registry Relay changes. This release fixes forward from the + failed v0.15.0 publication workflow. + ## 0.15.0 - 2026-07-28 - Validate every materialized XLSX row before activation, including rows after diff --git a/crates/registry-relay/docs/release-notes.md b/crates/registry-relay/docs/release-notes.md index 3d77ef9cc7..7a3e783eef 100644 --- a/crates/registry-relay/docs/release-notes.md +++ b/crates/registry-relay/docs/release-notes.md @@ -2,6 +2,11 @@ ## Unreleased +## 0.15.1 + +- Registry Relay has no user-visible changes. This release fixes forward from + the failed v0.15.0 publication workflow. + ## 0.15.0 - BREAKING: Attribute release is stable and enabled in the default and diff --git a/crates/registry-relay/openapi/registry-relay.openapi.json b/crates/registry-relay/openapi/registry-relay.openapi.json index ad58acb508..a6699eed1f 100644 --- a/crates/registry-relay/openapi/registry-relay.openapi.json +++ b/crates/registry-relay/openapi/registry-relay.openapi.json @@ -2809,7 +2809,7 @@ }, "summary": "Read-only data gateway exposing entity records, catalog metadata, and SHACL/DCAT-AP shapes for governed datasets.", "title": "Registry Relay API", - "version": "0.15.0" + "version": "0.15.1" }, "openapi": "3.1.0", "paths": { diff --git a/crates/registry-relay/security/advisory-baseline.json b/crates/registry-relay/security/advisory-baseline.json index 12eeee07a2..ba70650401 100644 --- a/crates/registry-relay/security/advisory-baseline.json +++ b/crates/registry-relay/security/advisory-baseline.json @@ -124,7 +124,7 @@ "severity_changed" ], "owner": "@jeremi", - "reason": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The v0.15.0 candidate changed only the two first-party Relay binaries in the enforced closure; every native runtime file retained its reviewed digest. The service still has only the reviewed fixed-format AWS-LC sscanf exposure and no effective vulnerable %mc conversion. Every file in both candidate executable closures remains digest-enforced because dynamic-symbol absence cannot truthfully express a format-string invariant.", + "reason": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The v0.15.1 candidate changed only the two first-party Relay binaries in the enforced closure; every native runtime file retained its reviewed digest. The service still has only the reviewed fixed-format AWS-LC sscanf exposure and no effective vulnerable %mc conversion. Every file in both candidate executable closures remains digest-enforced because dynamic-symbol absence cannot truthfully express a format-string invariant.", "reviewed_at": "2026-07-28", "expires_at": "2026-08-28" }, @@ -224,7 +224,7 @@ "severity_changed" ], "owner": "@jeremi", - "reason": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The v0.15.0 candidate changed only the two first-party Relay binaries in the enforced closure; every native runtime file, including the out-of-closure libstdc++ object that imports ungetwc, retained its reviewed digest. Neither first-party binary directly imports ungetwc. A static dynamic-symbol assertion remains incomplete because the executables import dlsym.", + "reason": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The v0.15.1 candidate changed only the two first-party Relay binaries in the enforced closure; every native runtime file, including the out-of-closure libstdc++ object that imports ungetwc, retained its reviewed digest. Neither first-party binary directly imports ungetwc. A static dynamic-symbol assertion remains incomplete because the executables import dlsym.", "reviewed_at": "2026-07-28", "expires_at": "2026-08-28" }, @@ -324,7 +324,7 @@ "severity_changed" ], "owner": "@jeremi", - "reason": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed upstream or Trixie version. The v0.15.0 candidate changed only the two first-party Relay binaries in the enforced closure; every native runtime file, including libresolv, retained its reviewed digest. Neither first-party binary directly imports ns_printrrf, ns_printrr, or fp_nquery. A static dynamic-symbol assertion remains incomplete because the executables import dlsym.", + "reason": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed upstream or Trixie version. The v0.15.1 candidate changed only the two first-party Relay binaries in the enforced closure; every native runtime file, including libresolv, retained its reviewed digest. Neither first-party binary directly imports ns_printrrf, ns_printrr, or fp_nquery. A static dynamic-symbol assertion remains incomplete because the executables import dlsym.", "reviewed_at": "2026-07-28", "expires_at": "2026-08-28" } diff --git a/crates/registryctl/CHANGELOG.md b/crates/registryctl/CHANGELOG.md index 8d0991c6ef..899d29367e 100644 --- a/crates/registryctl/CHANGELOG.md +++ b/crates/registryctl/CHANGELOG.md @@ -6,6 +6,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ## [Unreleased] +## [0.15.1] - 2026-07-28 + +- No user-visible Registryctl changes. This release fixes forward from the + failed v0.15.0 publication workflow. + ## [0.15.0] - 2026-07-28 ### Added diff --git a/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml b/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml index 016f594118..8234fec39a 100644 --- a/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml +++ b/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml @@ -1,8 +1,8 @@ version: 1 starter: id: http - release: 0.15.0 - content_digest: sha256:93f9afad4e0378e5562a3d81dae1a4952a8256149d7906e8779e06f330b716e0 + release: 0.15.1 + content_digest: sha256:4a4a88373668f13eb0e7c85370914e5b577fa8f593ef7da50fa9164cefef94ed registry: id: fictional-citizen-registry diff --git a/crates/registryctl/assets/project-starters/spreadsheet/registry-stack.yaml b/crates/registryctl/assets/project-starters/spreadsheet/registry-stack.yaml index 7e201f8e05..1641b6af44 100644 --- a/crates/registryctl/assets/project-starters/spreadsheet/registry-stack.yaml +++ b/crates/registryctl/assets/project-starters/spreadsheet/registry-stack.yaml @@ -1,8 +1,8 @@ version: 1 starter: id: spreadsheet - release: 0.15.0 - content_digest: sha256:36c3588322fe646538a50acca6a2cf37b82f5f9e6d7d2c44c1151b2462cf08b8 + release: 0.15.1 + content_digest: sha256:48d116897fc1128506b3ffd07750e9c822aed4a37681a913ef80a48d3be4bcea registry: id: fictional-public-works-registry diff --git a/crates/registryctl/install.sh b/crates/registryctl/install.sh index a95f557ccb..9049aeb9a1 100755 --- a/crates/registryctl/install.sh +++ b/crates/registryctl/install.sh @@ -2,7 +2,7 @@ set -euo pipefail repo="registrystack/registry-stack" -default_version="v0.15.0" +default_version="v0.15.1" script_name="${BASH_SOURCE[0]:-}" script_name="${script_name##*/}" filename_version="" diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml index a983dde5fe..238203eb7c 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml @@ -1,8 +1,8 @@ version: 1 starter: id: dhis2-tracker - release: 0.15.0 - content_digest: sha256:615d0da4e1508318e081d6e215d26c7f5549318098af8dad890c15e6a0161974 + release: 0.15.1 + content_digest: sha256:f8fb139a7cf5dc3b4a972a7f582f1c4cc75aa6ef3b9682ffd10a9541f25a5995 registry: { id: fictional-health-registry } integrations: health-record: { file: integrations/health-record/integration.yaml } diff --git a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml index dba2135289..c6464bc5f1 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml @@ -1,8 +1,8 @@ version: 1 starter: id: fhir-r4 - release: 0.15.0 - content_digest: sha256:8e1a545954d0908bcbc43923f3c055889407a663e066d06b262435eedef0429c + release: 0.15.1 + content_digest: sha256:2d45bfb905acc68c0f627b089cdcc3ac6ef7fcae3d9f135b8551972108856b84 registry: { id: fictional-fhir-registry } integrations: coverage: { file: integrations/coverage/integration.yaml } diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml index 7a22207413..89c9489cff 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml @@ -1,8 +1,8 @@ version: 1 starter: id: opencrvs-dci - release: 0.15.0 - content_digest: sha256:416e2e3c40d09372cf0d8372af718136067983ab408628474bf381d698a4c1bc + release: 0.15.1 + content_digest: sha256:c4ec7d6f8a4dc30420eefad7b4b5b4a391ba78b8c11d2484827ed8ab9464a844 registry: { id: fictional-civil-registry } integrations: birth-record: { file: integrations/birth-record/integration.yaml } diff --git a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml index 92fa99eff9..8c1db3a330 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml @@ -1,8 +1,8 @@ version: 1 starter: id: snapshot - release: 0.15.0 - content_digest: sha256:e61d7f6eefdb4fd51d4ddd3a2b84be77941a5d479343e6ae2413c4570b6d9c6c + release: 0.15.1 + content_digest: sha256:21e6d18ea3123b2802792d739820ce8084e51e4bce2d764221b56ad663a9a412 registry: { id: fictional-population-registry } integrations: person-snapshot: { file: integrations/person-snapshot/integration.yaml } diff --git a/docs/site/scripts/check-registryctl-tutorials.sh b/docs/site/scripts/check-registryctl-tutorials.sh index c33a30c440..bea3ea89ea 100755 --- a/docs/site/scripts/check-registryctl-tutorials.sh +++ b/docs/site/scripts/check-registryctl-tutorials.sh @@ -58,7 +58,7 @@ node "$HELPER" assert-layout "$TUTORIAL" \ '["Before you start","Install Registryctl","Create the sample project","Check your computer and project","Start the API","Check the API","Make one denied request","Make one allowed request","Make one allowed request","See what you can edit","Stop and clean up"]' node "$HELPER" extract-shell "$TUTORIAL" "$BLOCKS" -expected_install=$'tag=v0.15.0\ncurl -fsSLO "https://github.com/registrystack/registry-stack/releases/download/${tag}/registryctl-${tag}-install.sh"\nbash "./registryctl-${tag}-install.sh"\nregistryctl --version' +expected_install=$'tag=v0.15.1\ncurl -fsSLO "https://github.com/registrystack/registry-stack/releases/download/${tag}/registryctl-${tag}-install.sh"\nbash "./registryctl-${tag}-install.sh"\nregistryctl --version' if [[ "$(cat "$BLOCKS/02.sh")" != "$expected_install" ]]; then printf 'release-form installer block changed without updating its source contract\n' >&2 exit 1 diff --git a/docs/site/scripts/deployment-documentation-truth.test.mjs b/docs/site/scripts/deployment-documentation-truth.test.mjs index e71dc489a7..3101711633 100644 --- a/docs/site/scripts/deployment-documentation-truth.test.mjs +++ b/docs/site/scripts/deployment-documentation-truth.test.mjs @@ -22,7 +22,7 @@ const currentActivationPages = [ 'products/notary/docs/deployment-hardening-runbook.md', ]; -test('current docs stay preview while v0.15.0 is a candidate and v0.13.0 stays released', async () => { +test('current docs stay preview while v0.15.1 advances and v0.13.0 stays released', async () => { const [docsets, repoDocs, generatedDocsets] = await Promise.all([ readYaml('docs/site/src/data/docsets.yaml'), readYaml('docs/site/src/data/repo-docs.yaml'), @@ -76,22 +76,28 @@ test('current docs stay preview while v0.15.0 is a candidate and v0.13.0 stays r for (const docset of docsets.docsets) { if (docset.id === 'latest') continue; - if (docset.id === 'v0.15.0') { + if (docset.id === 'v0.15.1') { assert.match( docset.status, /^(draft|archived)$/, - 'v0.15.0 must expose a documented candidate lifecycle status', + 'v0.15.1 must expose a documented candidate lifecycle status', ); } else { assert.equal(docset.status, 'archived', `${docset.id} must expose its release-train status`); } + const expectedAvailability = + docset.id === 'v0.15.1' + ? docset.status === 'draft' + ? 'unreleased' + : 'candidate' + : docset.id === 'v0.15.0' + ? 'candidate' + : docset.id.startsWith('v') + ? 'released' + : 'candidate'; assert.equal( docset.availability, - docset.id === 'v0.15.0' - ? 'candidate' - : docset.id.startsWith('v') - ? 'released' - : 'candidate', + expectedAvailability, `${docset.id} must expose release availability`, ); } diff --git a/docs/site/scripts/registryctl-release-provenance.test.mjs b/docs/site/scripts/registryctl-release-provenance.test.mjs index 3b09728c36..2b78208e84 100644 --- a/docs/site/scripts/registryctl-release-provenance.test.mjs +++ b/docs/site/scripts/registryctl-release-provenance.test.mjs @@ -39,7 +39,7 @@ test('v0.15 release-form docs stay distinct from published v0.13 and current-sou assert.equal(lastRelease.availability, 'released'); const registryctlLead = registryctl.split('## Registry Stack project authoring')[0]; - assert.match(registryctlLead, /This page describes `registryctl 0\.15\.0`/); + assert.match(registryctlLead, /This page describes `registryctl 0\.15\.1`/); assert.match(registryctlLead, /binary, installer, image[\s\n]+lock, and verification material from that same release/); assert.doesNotMatch(registryctlLead, /Main source \(unreleased\)/); assert.doesNotMatch( @@ -58,7 +58,7 @@ test('v0.15 release-form docs stay distinct from published v0.13 and current-sou assert.doesNotMatch(configuration, /field baseline records when/); assert.doesNotMatch(configuration, /Configuration release: `0\.13\.0`/); - assert.match(tutorial, /uses Registryctl 0\.15\.0 and its matching release material/); + assert.match(tutorial, /uses Registryctl 0\.15\.1 and its matching release material/); assert.doesNotMatch(tutorial, /Main source \(unreleased\)/); assert.doesNotMatch(tutorial, /v0\.13\.0/); const releaseCommands = releaseSource @@ -82,7 +82,7 @@ test('v0.15 release-form docs stay distinct from published v0.13 and current-sou .split('enum AuthoringCommand {')[1] .split('#[derive(Debug, Parser)]')[0]; assert.doesNotMatch(releaseAuthoring, /\bReference\b/); - assert.match(tutorial, /Starter: http \(Registry Stack 0\.15\.0\)/); + assert.match(tutorial, /Starter: http \(Registry Stack 0\.15\.1\)/); for (const page of [registryctl, tutorial]) { assert.match(page, /--show-authored-values/); assert.match(page, /human(?:-only| output only)/i); diff --git a/docs/site/scripts/registryctl-tutorial.test.mjs b/docs/site/scripts/registryctl-tutorial.test.mjs index 1786920d7b..a7d3fa209d 100644 --- a/docs/site/scripts/registryctl-tutorial.test.mjs +++ b/docs/site/scripts/registryctl-tutorial.test.mjs @@ -383,14 +383,14 @@ test('release-form claim tutorial keeps the live no-match result bounded', () => assert.doesNotMatch(script, /project-record-exists/); }); -test('release-form claim tutorial continues the canonical v0.15.0 project live', () => { +test('release-form claim tutorial continues the canonical v0.15.1 project live', () => { const tutorial = readFileSync( new URL('../src/content/docs/tutorials/verify-claim-registry-api.mdx', import.meta.url), 'utf8', ); assert.match(tutorial, /^status: current$/m); - assert.match(tutorial, /registryctl 0\.15\.0 with its matching image lock/i); + assert.match(tutorial, /registryctl 0\.15\.1 with its matching image lock/i); assert.match(tutorial, /Continue from[\s\S]*`my-first-api`/); assert.match(tutorial, /registryctl add notary/); assert.match(tutorial, /\.registry-stack\/runtime\/local\/secrets\/local\.env/); diff --git a/docs/site/src/components/RegistryBanner.astro b/docs/site/src/components/RegistryBanner.astro index 495348f961..2aa9baa253 100644 --- a/docs/site/src/components/RegistryBanner.astro +++ b/docs/site/src/components/RegistryBanner.astro @@ -20,7 +20,7 @@ const isArchived = activeDocset?.status === 'archived'; ) : (

Documentation preview.{' '} - These pages target Registryctl v0.15.0, which is not published yet. + These pages target Registryctl v0.15.1, which is not published yet. Public download commands will not work until that release exists. For{' '} runnable released instructions, use{' '} v0.13.0. diff --git a/docs/site/src/content/docs/changelog.mdx b/docs/site/src/content/docs/changelog.mdx index ffef8bab31..fe90b2c518 100644 --- a/docs/site/src/content/docs/changelog.mdx +++ b/docs/site/src/content/docs/changelog.mdx @@ -18,6 +18,15 @@ relevant product pages on this site rather than duplicating release notes. ## 2026-07-28 +Fix-forward updates for the v0.15.1 beta-21 release candidate: + +- Preserved the immutable failed v0.15.0 tag and recorded that its workflow + stopped before any public release or image publication. +- Corrected exact annotated-tag binding extraction without weakening the + closed candidate-binding parser. +- Prepared the `v0.15.1` candidate docset while retaining the failed v0.15.0 + candidate archive and v0.13.0 as the latest published release. + Documentation updates for the v0.15.0 beta-20 release candidate: - Published the versioned Registryctl installer and the spreadsheet-first local diff --git a/docs/site/src/content/docs/reference/registryctl.mdx b/docs/site/src/content/docs/reference/registryctl.mdx index 0b86accbab..048c2114cd 100644 --- a/docs/site/src/content/docs/reference/registryctl.mdx +++ b/docs/site/src/content/docs/reference/registryctl.mdx @@ -16,7 +16,7 @@ import ProjectWorkspaceJourneys from '../../../components/ProjectWorkspaceJourne `registryctl` is the local adopter command-line tool for Registry Stack. It creates a local project, starts and stops the generated services, and runs validation and smoke checks against them. -This page describes `registryctl 0.15.0`. Use the binary, installer, image +This page describes `registryctl 0.15.1`. Use the binary, installer, image lock, and verification material from that same release. Run `registryctl --help` for built-in usage text. Most human-facing commands also perform a once-per-day update check; see @@ -436,7 +436,7 @@ Notary-only project contains source-free or self-attested evaluation-only claims ### Retired direct projects -Registryctl 0.15.0 keeps the pre-1.0 `init relay` scaffold retired. The +Registryctl 0.15.1 keeps the pre-1.0 `init relay` scaffold retired. The command returns a precise reinitialization path and does not modify the target directory. @@ -508,7 +508,7 @@ Related environment variables are listed in the [environment variable reference] ## Release boundary -This reference describes Registryctl 0.15.0. The +This reference describes Registryctl 0.15.1. The [archived 0.13.0 reference](/v/0.13.0/reference/registryctl/) remains the authority for that earlier release. Do not mix commands, binaries, image locks, or generated projects across releases. diff --git a/docs/site/src/content/docs/tutorials/author-registry-project.mdx b/docs/site/src/content/docs/tutorials/author-registry-project.mdx index 7238e20751..a2bf730609 100644 --- a/docs/site/src/content/docs/tutorials/author-registry-project.mdx +++ b/docs/site/src/content/docs/tutorials/author-registry-project.mdx @@ -21,7 +21,7 @@ You will copy the built-in starter, prove its synthetic journey offline, inspect acquisition and disclosure plan, and build separate unsigned inputs for Registry Relay and Registry Notary. -This tutorial uses Registryctl 0.15.0 and its matching release material. Do not +This tutorial uses Registryctl 0.15.1 and its matching release material. Do not mix the page with an older CLI, image lock, or starter. One project defines one registry trust domain. A deployment can use Relay only for governed @@ -33,7 +33,7 @@ registries require separate projects. outcome="A tested project workspace with reviewable bounded HTTP configuration and unsigned Relay and Notary Config Bundle inputs." time="About 10 minutes after registryctl is installed" level="Local authoring with synthetic fixtures" - prerequisites={['registryctl 0.15.0 and its matching image lock', 'A shell and a text editor']} + prerequisites={['registryctl 0.15.1 and its matching image lock', 'A shell and a text editor']} /> This tutorial uses a fictional registry and synthetic records. @@ -65,7 +65,7 @@ The human-readable result confirms the project, starter provenance, and next com ```text Initialized Registry Stack project "fictional-citizen-registry". Directory: registry-project - Starter: http (Registry Stack 0.15.0) + Starter: http (Registry Stack 0.15.1) Starter content: matches bundled digest Editor support: VS Code and Zed (registry-project/.registry-stack-editor/manifest.json) diff --git a/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx b/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx index def610fc93..1d18127a0d 100644 --- a/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx +++ b/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx @@ -56,10 +56,10 @@ perform its own stricter runtime and project checks before starting Relay. ## Install Registryctl -Download and run the Registryctl 0.15.0 installer: +Download and run the Registryctl 0.15.1 installer: ```sh -tag=v0.15.0 +tag=v0.15.1 curl -fsSLO "https://github.com/registrystack/registry-stack/releases/download/${tag}/registryctl-${tag}-install.sh" bash "./registryctl-${tag}-install.sh" registryctl --version @@ -69,13 +69,13 @@ The installer reports its chosen install directory. The last command prints exactly: ```text -registryctl 0.15.0 +registryctl 0.15.1 ``` The installer downloads release files over TLS and verifies their checksums. A checksum detects a damaged or mismatched download, but does not authenticate who published it. Follow the tag-frozen -[release verification guide](https://github.com/registrystack/registry-stack/blob/v0.15.0/release/VERIFY.md) +[release verification guide](https://github.com/registrystack/registry-stack/blob/v0.15.1/release/VERIFY.md) when you need signature and provenance verification before installation. If your shell cannot find `registryctl`, add the install directory reported by @@ -95,7 +95,7 @@ Registryctl prints: ```text Initialized Registry Stack project "fictional-public-works-registry". Directory: my-first-api - Starter: spreadsheet (Registry Stack 0.15.0) + Starter: spreadsheet (Registry Stack 0.15.1) Starter content: matches bundled digest Editor support: VS Code and Zed (my-first-api/.registry-stack-editor/manifest.json) diff --git a/docs/site/src/content/docs/tutorials/use-your-spreadsheet.mdx b/docs/site/src/content/docs/tutorials/use-your-spreadsheet.mdx index 384dc44eb6..be317a4f51 100644 --- a/docs/site/src/content/docs/tutorials/use-your-spreadsheet.mdx +++ b/docs/site/src/content/docs/tutorials/use-your-spreadsheet.mdx @@ -24,7 +24,7 @@ route. outcome="A protected local API over one reviewed spreadsheet, with the route, returned fields, purpose, and local caller derived from your own decisions." time="About 30 minutes for a small worksheet" level="Country implementer" - prerequisites={['Linux amd64', 'Registryctl 0.15.0 with its matching image lock', 'Docker Engine with Compose v2', 'curl', 'A reviewed non-personal XLSX workbook', 'A text editor'] } + prerequisites={['Linux amd64', 'Registryctl 0.15.1 with its matching image lock', 'Docker Engine with Compose v2', 'curl', 'A reviewed non-personal XLSX workbook', 'A text editor'] } /> Use a synthetic, public, or otherwise approved non-personal workbook for this @@ -89,7 +89,7 @@ Registryctl prints: ```text Initialized Registry Stack project "fictional-public-works-registry". Directory: reviewed-registry - Starter: spreadsheet (Registry Stack 0.15.0) + Starter: spreadsheet (Registry Stack 0.15.1) Starter content: matches bundled digest Editor support: VS Code and Zed (reviewed-registry/.registry-stack-editor/manifest.json) ``` diff --git a/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx b/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx index 6b8f835c29..33ab602e62 100644 --- a/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx +++ b/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx @@ -24,7 +24,7 @@ authored status policy. outcome="A live Registry Notary evaluation over the synthetic public-works workbook, with allowed, rejected, and absent-record results." time="About 15 minutes after completing the first API tutorial" level="Local single-node" - prerequisites={['The unmodified my-first-api project from the first tutorial', 'Registryctl 0.15.0 with its matching image lock', 'Linux amd64', 'Docker Engine with Compose v2', 'curl', 'Ports 4242 and 4255 available on loopback'] } + prerequisites={['The unmodified my-first-api project from the first tutorial', 'Registryctl 0.15.1 with its matching image lock', 'Linux amd64', 'Docker Engine with Compose v2', 'curl', 'Ports 4242 and 4255 available on loopback'] } /> The workbook, project identifiers, and caller credentials are synthetic and @@ -474,7 +474,7 @@ project. | Symptom | Cause | Resolution | | --- | --- | --- | -| `registryctl add notary` reports an unsupported shape | The project differs from the maintained spreadsheet starter or already has a conflicting Notary integration. | Start from the unmodified `my-first-api` project created by Registryctl 0.15.0. | +| `registryctl add notary` reports an unsupported shape | The project differs from the maintained spreadsheet starter or already has a conflicting Notary integration. | Start from the unmodified `my-first-api` project created by Registryctl 0.15.1. | | `registryctl add notary` prints `Verified local Notary add-on.` | The exact maintained add-on is already present. | Continue with the fixture check. The command made no further changes. | | `registryctl test` fails after the policy edit | The authored rule and fixture expectation disagree. | Keep the planned source output unchanged and set its `project-status-accepted` expectation to `true`. | | Notary returns `401` | The caller credential is missing or belongs to another project. | Source this project's private `local.env` again without printing it. | diff --git a/docs/site/src/data/docsets.yaml b/docs/site/src/data/docsets.yaml index c641a3caf3..bd3f828ec6 100644 --- a/docs/site/src/data/docsets.yaml +++ b/docs/site/src/data/docsets.yaml @@ -22,6 +22,37 @@ docsets: registry-manifest: version: main source (unreleased) ref: HEAD + - id: v0.15.1 + label: v0.15.1 + path: /v/0.15.1/ + status: draft + availability: unreleased + source: registry-stack-v0.15.1 + repo_docs_source: monorepo + published_at: 2026-07-28 + description: Registry Stack v0.15.1 beta-21 fix-forward candidate documentation set pinned to its prepared source. + products: + registry-stack: + version: v0.15.1 + ref: 547ecb3e3a088f00b4101ac3e4244bd9a925075c + registry-platform: + version: v0.15.1 + ref: 547ecb3e3a088f00b4101ac3e4244bd9a925075c + registry-manifest: + version: v0.15.1 + ref: 547ecb3e3a088f00b4101ac3e4244bd9a925075c + registry-notary: + version: v0.15.1 + ref: 547ecb3e3a088f00b4101ac3e4244bd9a925075c + registry-relay: + version: v0.15.1 + ref: 547ecb3e3a088f00b4101ac3e4244bd9a925075c + registry-registryctl: + version: v0.15.1 + ref: 547ecb3e3a088f00b4101ac3e4244bd9a925075c + crosswalk: + version: crosswalk-core-v0.2.0 + ref: 1d44ec735fdc8a7c719264b339574371e8330337 - id: v0.15.0 label: v0.15.0 path: /v/0.15.0/ diff --git a/docs/site/src/data/generated/docsets.json b/docs/site/src/data/generated/docsets.json index caad145d7a..c53e486791 100644 --- a/docs/site/src/data/generated/docsets.json +++ b/docs/site/src/data/generated/docsets.json @@ -30,6 +30,47 @@ } } }, + { + "id": "v0.15.1", + "label": "v0.15.1", + "path": "/v/0.15.1/", + "status": "draft", + "availability": "unreleased", + "source": "registry-stack-v0.15.1", + "repo_docs_source": "monorepo", + "published_at": "2026-07-28", + "description": "Registry Stack v0.15.1 beta-21 fix-forward candidate documentation set pinned to its prepared source.", + "products": { + "registry-stack": { + "version": "v0.15.1", + "ref": "547ecb3e3a088f00b4101ac3e4244bd9a925075c" + }, + "registry-platform": { + "version": "v0.15.1", + "ref": "547ecb3e3a088f00b4101ac3e4244bd9a925075c" + }, + "registry-manifest": { + "version": "v0.15.1", + "ref": "547ecb3e3a088f00b4101ac3e4244bd9a925075c" + }, + "registry-notary": { + "version": "v0.15.1", + "ref": "547ecb3e3a088f00b4101ac3e4244bd9a925075c" + }, + "registry-relay": { + "version": "v0.15.1", + "ref": "547ecb3e3a088f00b4101ac3e4244bd9a925075c" + }, + "registry-registryctl": { + "version": "v0.15.1", + "ref": "547ecb3e3a088f00b4101ac3e4244bd9a925075c" + }, + "crosswalk": { + "version": "crosswalk-core-v0.2.0", + "ref": "1d44ec735fdc8a7c719264b339574371e8330337" + } + } + }, { "id": "v0.15.0", "label": "v0.15.0", diff --git a/docs/site/src/data/generated/projects.json b/docs/site/src/data/generated/projects.json index 3f86d262d2..4746ce4b99 100644 --- a/docs/site/src/data/generated/projects.json +++ b/docs/site/src/data/generated/projects.json @@ -19,11 +19,11 @@ "source_docs": [ { "label": "README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.15.0/products/platform/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.15.1/products/platform/README.md" }, { "label": "Registry Platform crates", - "url": "https://github.com/registrystack/registry-stack/tree/v0.15.0/crates" + "url": "https://github.com/registrystack/registry-stack/tree/v0.15.1/crates" } ], "rename_status": "New shared workspace; not part of the 2026-05-23 rename wave." @@ -48,11 +48,11 @@ "source_docs": [ { "label": "README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.15.0/products/manifest/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.15.1/products/manifest/README.md" }, { "label": "Local examples", - "url": "https://github.com/registrystack/registry-stack/blob/v0.15.0/products/manifest/examples/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.15.1/products/manifest/examples/README.md" } ], "rename_status": "Already using the target repo name locally." @@ -81,15 +81,15 @@ "source_docs": [ { "label": "README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.15.0/crates/registry-relay/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.15.1/crates/registry-relay/README.md" }, { "label": "Local API docs", - "url": "https://github.com/registrystack/registry-stack/blob/v0.15.0/crates/registry-relay/docs/api.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.15.1/crates/registry-relay/docs/api.md" }, { "label": "Local metadata docs", - "url": "https://github.com/registrystack/registry-stack/blob/v0.15.0/crates/registry-relay/docs/metadata.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.15.1/crates/registry-relay/docs/metadata.md" } ], "rename_status": "Local checkout renamed to `registry-relay`; old worktrees under `registry_relay-*` remain for historical evidence." @@ -123,11 +123,11 @@ "source_docs": [ { "label": "README", - "url": "https://github.com/registrystack/registry-stack/blob/v0.15.0/products/notary/README.md" + "url": "https://github.com/registrystack/registry-stack/blob/v0.15.1/products/notary/README.md" }, { "label": "OpenAPI source", - "url": "https://github.com/registrystack/registry-stack/blob/v0.15.0/crates/registry-notary-server/src/openapi.rs" + "url": "https://github.com/registrystack/registry-stack/blob/v0.15.1/crates/registry-notary-server/src/openapi.rs" } ], "rename_status": "Already using the target repo name locally." diff --git a/docs/site/src/data/generated/standard-journeys.json b/docs/site/src/data/generated/standard-journeys.json index 9d943ad070..f0de6565f2 100644 --- a/docs/site/src/data/generated/standard-journeys.json +++ b/docs/site/src/data/generated/standard-journeys.json @@ -264,7 +264,7 @@ "format": "yaml", "public_boundary": "maintained_synthetic", "language": "yaml", - "content": "entities:\n projects:\n file: entities/projects.yaml\nregistry:\n id: fictional-public-works-registry\nservices:\n projects-records:\n access_rights: restricted\n api:\n filters:\n project_id:\n - eq\n pagination:\n default_limit: 50\n max_limit: 100\n projection:\n - project_id\n - district_code\n - sector\n - status\n purposes:\n - public-works-case-management\n required_principal_filters:\n - project_id\n scopes:\n aggregate: projects:aggregate\n evidence_verification: projects:evidence_verification\n metadata: projects:metadata\n rows: projects:rows\n standards:\n ogc_features: false\n sp_dci: false\n description: Protected operational view of synthetic public works projects.\n entity: projects\n kind: records_api\n owner: Public Works Delivery Unit\n sensitivity: confidential\n title: Fictional public works projects\n update_frequency: as_needed\nstarter:\n content_digest: sha256:36c3588322fe646538a50acca6a2cf37b82f5f9e6d7d2c44c1151b2462cf08b8\n id: spreadsheet\n release: 0.15.0\nversion: 1\n" + "content": "entities:\n projects:\n file: entities/projects.yaml\nregistry:\n id: fictional-public-works-registry\nservices:\n projects-records:\n access_rights: restricted\n api:\n filters:\n project_id:\n - eq\n pagination:\n default_limit: 50\n max_limit: 100\n projection:\n - project_id\n - district_code\n - sector\n - status\n purposes:\n - public-works-case-management\n required_principal_filters:\n - project_id\n scopes:\n aggregate: projects:aggregate\n evidence_verification: projects:evidence_verification\n metadata: projects:metadata\n rows: projects:rows\n standards:\n ogc_features: false\n sp_dci: false\n description: Protected operational view of synthetic public works projects.\n entity: projects\n kind: records_api\n owner: Public Works Delivery Unit\n sensitivity: confidential\n title: Fictional public works projects\n update_frequency: as_needed\nstarter:\n content_digest: sha256:48d116897fc1128506b3ffd07750e9c822aed4a37681a913ef80a48d3be4bcea\n id: spreadsheet\n release: 0.15.1\nversion: 1\n" }, { "source": "crates/registryctl/assets/project-starters/spreadsheet/environments/local.yaml", @@ -570,7 +570,7 @@ "format": "yaml", "public_boundary": "maintained_synthetic", "language": "yaml", - "content": "entities:\n projects:\n file: entities/projects.yaml\nregistry:\n id: fictional-public-works-registry\nservices:\n projects-records:\n access_rights: restricted\n api:\n filters:\n project_id:\n - eq\n pagination:\n default_limit: 50\n max_limit: 100\n projection:\n - project_id\n - district_code\n - sector\n - status\n purposes:\n - public-works-case-management\n required_principal_filters:\n - project_id\n scopes:\n aggregate: projects:aggregate\n evidence_verification: projects:evidence_verification\n metadata: projects:metadata\n rows: projects:rows\n standards:\n ogc_features: false\n sp_dci: false\n description: Protected operational view of synthetic public works projects.\n entity: projects\n kind: records_api\n owner: Public Works Delivery Unit\n sensitivity: confidential\n title: Fictional public works projects\n update_frequency: as_needed\nstarter:\n content_digest: sha256:36c3588322fe646538a50acca6a2cf37b82f5f9e6d7d2c44c1151b2462cf08b8\n id: spreadsheet\n release: 0.15.0\nversion: 1\n" + "content": "entities:\n projects:\n file: entities/projects.yaml\nregistry:\n id: fictional-public-works-registry\nservices:\n projects-records:\n access_rights: restricted\n api:\n filters:\n project_id:\n - eq\n pagination:\n default_limit: 50\n max_limit: 100\n projection:\n - project_id\n - district_code\n - sector\n - status\n purposes:\n - public-works-case-management\n required_principal_filters:\n - project_id\n scopes:\n aggregate: projects:aggregate\n evidence_verification: projects:evidence_verification\n metadata: projects:metadata\n rows: projects:rows\n standards:\n ogc_features: false\n sp_dci: false\n description: Protected operational view of synthetic public works projects.\n entity: projects\n kind: records_api\n owner: Public Works Delivery Unit\n sensitivity: confidential\n title: Fictional public works projects\n update_frequency: as_needed\nstarter:\n content_digest: sha256:48d116897fc1128506b3ffd07750e9c822aed4a37681a913ef80a48d3be4bcea\n id: spreadsheet\n release: 0.15.1\nversion: 1\n" }, { "source": "crates/registryctl/assets/project-starters/spreadsheet/environments/local.yaml", @@ -912,7 +912,7 @@ "format": "yaml", "public_boundary": "maintained_synthetic", "language": "yaml", - "content": "integrations:\n person-record:\n file: integrations/person-record/integration.yaml\nregistry:\n id: fictional-citizen-registry\nservices:\n person-verification:\n access:\n scopes:\n - evidence:person:read\n claims:\n person-active:\n disclosure: value\n output: person_record.active\n person-record-exists:\n cel: person_record.matched\n disclosure: predicate\n consent: not_required\n consultations:\n person_record:\n input:\n person_id: request.target.identifiers.registry_person_id\n integration: person-record\n credential_profiles:\n person-status:\n claims:\n - person-record-exists\n - person-active\n format: dc+sd-jwt\n type: https://credentials.invalid/person-status/v1\n validity: 10m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: public-service-person-verification\n version: 1\nstarter:\n content_digest: sha256:93f9afad4e0378e5562a3d81dae1a4952a8256149d7906e8779e06f330b716e0\n id: http\n release: 0.15.0\nversion: 1\n" + "content": "integrations:\n person-record:\n file: integrations/person-record/integration.yaml\nregistry:\n id: fictional-citizen-registry\nservices:\n person-verification:\n access:\n scopes:\n - evidence:person:read\n claims:\n person-active:\n disclosure: value\n output: person_record.active\n person-record-exists:\n cel: person_record.matched\n disclosure: predicate\n consent: not_required\n consultations:\n person_record:\n input:\n person_id: request.target.identifiers.registry_person_id\n integration: person-record\n credential_profiles:\n person-status:\n claims:\n - person-record-exists\n - person-active\n format: dc+sd-jwt\n type: https://credentials.invalid/person-status/v1\n validity: 10m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: public-service-person-verification\n version: 1\nstarter:\n content_digest: sha256:4a4a88373668f13eb0e7c85370914e5b577fa8f593ef7da50fa9164cefef94ed\n id: http\n release: 0.15.1\nversion: 1\n" }, { "source": "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", @@ -1341,7 +1341,7 @@ "format": "yaml", "public_boundary": "maintained_synthetic", "language": "yaml", - "content": "integrations:\n coverage:\n file: integrations/coverage/integration.yaml\nregistry:\n id: fictional-fhir-registry\nservices:\n coverage-verification:\n access:\n scopes:\n - evidence:coverage:read\n claims:\n coverage-active:\n cel: |-\n coverage.coverage_status != null\n ? coverage.matched && coverage.coverage_status == \"active\"\n : false\n disclosure: predicate\n insurer-name:\n disclosure: value\n output: coverage.insurer_name\n patient-record-exists:\n cel: coverage.matched\n disclosure: predicate\n consent: not_required\n consultations:\n coverage:\n input:\n birthdate: request.target.identifiers.birthdate\n family: request.target.identifiers.family\n given: request.target.identifiers.given\n integration: coverage\n credential_profiles:\n coverage-status:\n claims:\n - patient-record-exists\n - coverage-active\n - insurer-name\n format: dc+sd-jwt\n type: https://credentials.invalid/coverage-status/v1\n validity: 5m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: coverage-verification\n version: 1\nstarter:\n content_digest: sha256:8e1a545954d0908bcbc43923f3c055889407a663e066d06b262435eedef0429c\n id: fhir-r4\n release: 0.15.0\nversion: 1\n" + "content": "integrations:\n coverage:\n file: integrations/coverage/integration.yaml\nregistry:\n id: fictional-fhir-registry\nservices:\n coverage-verification:\n access:\n scopes:\n - evidence:coverage:read\n claims:\n coverage-active:\n cel: |-\n coverage.coverage_status != null\n ? coverage.matched && coverage.coverage_status == \"active\"\n : false\n disclosure: predicate\n insurer-name:\n disclosure: value\n output: coverage.insurer_name\n patient-record-exists:\n cel: coverage.matched\n disclosure: predicate\n consent: not_required\n consultations:\n coverage:\n input:\n birthdate: request.target.identifiers.birthdate\n family: request.target.identifiers.family\n given: request.target.identifiers.given\n integration: coverage\n credential_profiles:\n coverage-status:\n claims:\n - patient-record-exists\n - coverage-active\n - insurer-name\n format: dc+sd-jwt\n type: https://credentials.invalid/coverage-status/v1\n validity: 5m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: coverage-verification\n version: 1\nstarter:\n content_digest: sha256:2d45bfb905acc68c0f627b089cdcc3ac6ef7fcae3d9f135b8551972108856b84\n id: fhir-r4\n release: 0.15.1\nversion: 1\n" }, { "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/environments/local.yaml", @@ -1758,7 +1758,7 @@ "format": "yaml", "public_boundary": "maintained_synthetic", "language": "yaml", - "content": "entities:\n people:\n file: entities/people.yaml\nintegrations:\n person-snapshot:\n file: integrations/person-snapshot/integration.yaml\nregistry:\n id: fictional-population-registry\nservices:\n benefits-eligibility:\n access:\n scopes:\n - evidence:population:read\n claims:\n population-record-exists:\n cel: person.matched\n disclosure: predicate\n population-registration-status:\n disclosure: value\n output: person.registration_status\n residency-confirmed:\n disclosure: predicate\n output: person.residency_confirmed\n consent: not_required\n consultations:\n person:\n input:\n person_id: request.target.identifiers.population_person_id\n integration: person-snapshot\n credential_profiles:\n population-evidence:\n claims:\n - population-record-exists\n - population-registration-status\n - residency-confirmed\n format: dc+sd-jwt\n type: https://credentials.invalid/population-evidence/v1\n validity: 10m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: benefits-eligibility\n version: 1\n emergency-assistance:\n access:\n scopes:\n - evidence:population:emergency\n claims:\n emergency-record-exists:\n cel: person.matched\n disclosure: predicate\n emergency-status:\n disclosure: redacted\n output: person.registration_status\n consent: not_required\n consultations:\n person:\n input:\n person_id: request.target.identifiers.population_person_id\n integration: person-snapshot\n credential_profiles:\n emergency-status:\n claims:\n - emergency-record-exists\n - emergency-status\n format: dc+sd-jwt\n type: https://credentials.invalid/emergency-status/v1\n validity: 5m\n kind: evidence\n legal_basis: vital-interests\n purpose: emergency-assistance\n version: 1\nstarter:\n content_digest: sha256:e61d7f6eefdb4fd51d4ddd3a2b84be77941a5d479343e6ae2413c4570b6d9c6c\n id: snapshot\n release: 0.15.0\nversion: 1\n" + "content": "entities:\n people:\n file: entities/people.yaml\nintegrations:\n person-snapshot:\n file: integrations/person-snapshot/integration.yaml\nregistry:\n id: fictional-population-registry\nservices:\n benefits-eligibility:\n access:\n scopes:\n - evidence:population:read\n claims:\n population-record-exists:\n cel: person.matched\n disclosure: predicate\n population-registration-status:\n disclosure: value\n output: person.registration_status\n residency-confirmed:\n disclosure: predicate\n output: person.residency_confirmed\n consent: not_required\n consultations:\n person:\n input:\n person_id: request.target.identifiers.population_person_id\n integration: person-snapshot\n credential_profiles:\n population-evidence:\n claims:\n - population-record-exists\n - population-registration-status\n - residency-confirmed\n format: dc+sd-jwt\n type: https://credentials.invalid/population-evidence/v1\n validity: 10m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: benefits-eligibility\n version: 1\n emergency-assistance:\n access:\n scopes:\n - evidence:population:emergency\n claims:\n emergency-record-exists:\n cel: person.matched\n disclosure: predicate\n emergency-status:\n disclosure: redacted\n output: person.registration_status\n consent: not_required\n consultations:\n person:\n input:\n person_id: request.target.identifiers.population_person_id\n integration: person-snapshot\n credential_profiles:\n emergency-status:\n claims:\n - emergency-record-exists\n - emergency-status\n format: dc+sd-jwt\n type: https://credentials.invalid/emergency-status/v1\n validity: 5m\n kind: evidence\n legal_basis: vital-interests\n purpose: emergency-assistance\n version: 1\nstarter:\n content_digest: sha256:21e6d18ea3123b2802792d739820ce8084e51e4bce2d764221b56ad663a9a412\n id: snapshot\n release: 0.15.1\nversion: 1\n" }, { "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml", @@ -2172,7 +2172,7 @@ "format": "yaml", "public_boundary": "maintained_synthetic", "language": "yaml", - "content": "entities:\n people:\n file: entities/people.yaml\nintegrations:\n person-snapshot:\n file: integrations/person-snapshot/integration.yaml\nregistry:\n id: fictional-population-registry\nservices:\n benefits-eligibility:\n access:\n scopes:\n - evidence:population:read\n claims:\n population-record-exists:\n cel: person.matched\n disclosure: predicate\n population-registration-status:\n disclosure: value\n output: person.registration_status\n residency-confirmed:\n disclosure: predicate\n output: person.residency_confirmed\n consent: not_required\n consultations:\n person:\n input:\n person_id: request.target.identifiers.population_person_id\n integration: person-snapshot\n credential_profiles:\n population-evidence:\n claims:\n - population-record-exists\n - population-registration-status\n - residency-confirmed\n format: dc+sd-jwt\n type: https://credentials.invalid/population-evidence/v1\n validity: 10m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: benefits-eligibility\n version: 1\n emergency-assistance:\n access:\n scopes:\n - evidence:population:emergency\n claims:\n emergency-record-exists:\n cel: person.matched\n disclosure: predicate\n emergency-status:\n disclosure: redacted\n output: person.registration_status\n consent: not_required\n consultations:\n person:\n input:\n person_id: request.target.identifiers.population_person_id\n integration: person-snapshot\n credential_profiles:\n emergency-status:\n claims:\n - emergency-record-exists\n - emergency-status\n format: dc+sd-jwt\n type: https://credentials.invalid/emergency-status/v1\n validity: 5m\n kind: evidence\n legal_basis: vital-interests\n purpose: emergency-assistance\n version: 1\nstarter:\n content_digest: sha256:e61d7f6eefdb4fd51d4ddd3a2b84be77941a5d479343e6ae2413c4570b6d9c6c\n id: snapshot\n release: 0.15.0\nversion: 1\n" + "content": "entities:\n people:\n file: entities/people.yaml\nintegrations:\n person-snapshot:\n file: integrations/person-snapshot/integration.yaml\nregistry:\n id: fictional-population-registry\nservices:\n benefits-eligibility:\n access:\n scopes:\n - evidence:population:read\n claims:\n population-record-exists:\n cel: person.matched\n disclosure: predicate\n population-registration-status:\n disclosure: value\n output: person.registration_status\n residency-confirmed:\n disclosure: predicate\n output: person.residency_confirmed\n consent: not_required\n consultations:\n person:\n input:\n person_id: request.target.identifiers.population_person_id\n integration: person-snapshot\n credential_profiles:\n population-evidence:\n claims:\n - population-record-exists\n - population-registration-status\n - residency-confirmed\n format: dc+sd-jwt\n type: https://credentials.invalid/population-evidence/v1\n validity: 10m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: benefits-eligibility\n version: 1\n emergency-assistance:\n access:\n scopes:\n - evidence:population:emergency\n claims:\n emergency-record-exists:\n cel: person.matched\n disclosure: predicate\n emergency-status:\n disclosure: redacted\n output: person.registration_status\n consent: not_required\n consultations:\n person:\n input:\n person_id: request.target.identifiers.population_person_id\n integration: person-snapshot\n credential_profiles:\n emergency-status:\n claims:\n - emergency-record-exists\n - emergency-status\n format: dc+sd-jwt\n type: https://credentials.invalid/emergency-status/v1\n validity: 5m\n kind: evidence\n legal_basis: vital-interests\n purpose: emergency-assistance\n version: 1\nstarter:\n content_digest: sha256:21e6d18ea3123b2802792d739820ce8084e51e4bce2d764221b56ad663a9a412\n id: snapshot\n release: 0.15.1\nversion: 1\n" }, { "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml", @@ -2612,7 +2612,7 @@ "format": "yaml", "public_boundary": "maintained_synthetic", "language": "yaml", - "content": "integrations:\n person-record:\n file: integrations/person-record/integration.yaml\nregistry:\n id: fictional-citizen-registry\nservices:\n person-verification:\n access:\n scopes:\n - evidence:person:read\n claims:\n person-active:\n disclosure: value\n output: person_record.active\n person-record-exists:\n cel: person_record.matched\n disclosure: predicate\n consent: not_required\n consultations:\n person_record:\n input:\n person_id: request.target.identifiers.registry_person_id\n integration: person-record\n credential_profiles:\n person-status:\n claims:\n - person-record-exists\n - person-active\n format: dc+sd-jwt\n type: https://credentials.invalid/person-status/v1\n validity: 10m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: public-service-person-verification\n version: 1\nstarter:\n content_digest: sha256:93f9afad4e0378e5562a3d81dae1a4952a8256149d7906e8779e06f330b716e0\n id: http\n release: 0.15.0\nversion: 1\n" + "content": "integrations:\n person-record:\n file: integrations/person-record/integration.yaml\nregistry:\n id: fictional-citizen-registry\nservices:\n person-verification:\n access:\n scopes:\n - evidence:person:read\n claims:\n person-active:\n disclosure: value\n output: person_record.active\n person-record-exists:\n cel: person_record.matched\n disclosure: predicate\n consent: not_required\n consultations:\n person_record:\n input:\n person_id: request.target.identifiers.registry_person_id\n integration: person-record\n credential_profiles:\n person-status:\n claims:\n - person-record-exists\n - person-active\n format: dc+sd-jwt\n type: https://credentials.invalid/person-status/v1\n validity: 10m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: public-service-person-verification\n version: 1\nstarter:\n content_digest: sha256:4a4a88373668f13eb0e7c85370914e5b577fa8f593ef7da50fa9164cefef94ed\n id: http\n release: 0.15.1\nversion: 1\n" }, { "source": "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", diff --git a/docs/site/src/data/projects.yaml b/docs/site/src/data/projects.yaml index fbdeb9b17f..df2d506e53 100644 --- a/docs/site/src/data/projects.yaml +++ b/docs/site/src/data/projects.yaml @@ -14,9 +14,9 @@ - Product-level authorization policy, tenant isolation, audit retention, secret provisioning, or deployment configuration. source_docs: - label: README - url: https://github.com/registrystack/registry-stack/blob/v0.15.0/products/platform/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.15.1/products/platform/README.md - label: Registry Platform crates - url: https://github.com/registrystack/registry-stack/tree/v0.15.0/crates + url: https://github.com/registrystack/registry-stack/tree/v0.15.1/crates rename_status: New shared workspace; not part of the 2026-05-23 rename wave. - id: registry-manifest name: Registry Manifest @@ -34,9 +34,9 @@ - Production source configuration. source_docs: - label: README - url: https://github.com/registrystack/registry-stack/blob/v0.15.0/products/manifest/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.15.1/products/manifest/README.md - label: Local examples - url: https://github.com/registrystack/registry-stack/blob/v0.15.0/products/manifest/examples/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.15.1/products/manifest/examples/README.md rename_status: Already using the target repo name locally. - id: registry-relay name: Registry Relay @@ -58,11 +58,11 @@ - Storage table ids or arbitrary SQL in public APIs. source_docs: - label: README - url: https://github.com/registrystack/registry-stack/blob/v0.15.0/crates/registry-relay/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.15.1/crates/registry-relay/README.md - label: Local API docs - url: https://github.com/registrystack/registry-stack/blob/v0.15.0/crates/registry-relay/docs/api.md + url: https://github.com/registrystack/registry-stack/blob/v0.15.1/crates/registry-relay/docs/api.md - label: Local metadata docs - url: https://github.com/registrystack/registry-stack/blob/v0.15.0/crates/registry-relay/docs/metadata.md + url: https://github.com/registrystack/registry-stack/blob/v0.15.1/crates/registry-relay/docs/metadata.md rename_status: Local checkout renamed to `registry-relay`; old worktrees under `registry_relay-*` remain for historical evidence. - id: registry-notary name: Registry Notary @@ -89,9 +89,9 @@ - Credential issuance from source-free or self-attested evidence. source_docs: - label: README - url: https://github.com/registrystack/registry-stack/blob/v0.15.0/products/notary/README.md + url: https://github.com/registrystack/registry-stack/blob/v0.15.1/products/notary/README.md - label: OpenAPI source - url: https://github.com/registrystack/registry-stack/blob/v0.15.0/crates/registry-notary-server/src/openapi.rs + url: https://github.com/registrystack/registry-stack/blob/v0.15.1/crates/registry-notary-server/src/openapi.rs rename_status: Already using the target repo name locally. - id: solmara-lab name: Solmara Lab diff --git a/editors/tests/install_test.sh b/editors/tests/install_test.sh index a38220a509..5462635779 100755 --- a/editors/tests/install_test.sh +++ b/editors/tests/install_test.sh @@ -57,7 +57,7 @@ readonly FAKE_OPEN_CANONICAL printf '%s\n' \ '[workspace]' \ '[workspace.package]' \ - 'version = "0.15.0"' \ + 'version = "0.15.1"' \ > "${FAKE_REPO_ROOT}/Cargo.toml" printf '{}\n' > "${FAKE_REPO_ROOT}/editors/vscode/package.json" printf '[package]\nname = "registry-stack-zed"\n' \ @@ -79,7 +79,7 @@ command_name="$(basename -- "$0")" case "${command_name}" in registryctl) if [[ "${1:-}" == "--version" ]]; then - printf 'registryctl %s\n' "${FAKE_REGISTRYCTL_VERSION:-0.15.0}" + printf 'registryctl %s\n' "${FAKE_REGISTRYCTL_VERSION:-0.15.1}" fi ;; node) @@ -176,7 +176,7 @@ if FAKE_REGISTRYCTL_VERSION=0.10.0 "${INSTALLER}" vscode \ > "${mismatch_output}" 2>&1; then fail 'version mismatch should fail' fi -assert_contains 'this checkout is 0.15.0 but registryctl is 0.10.0' "${mismatch_output}" +assert_contains 'this checkout is 0.15.1 but registryctl is 0.10.0' "${mismatch_output}" assert_not_contains 'npm <' "${COMMAND_LOG}" reset_log diff --git a/products/manifest/CHANGELOG.md b/products/manifest/CHANGELOG.md index ff1da3fdbf..ad7372d26c 100644 --- a/products/manifest/CHANGELOG.md +++ b/products/manifest/CHANGELOG.md @@ -7,6 +7,11 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm ## [Unreleased] +## [0.15.1] - 2026-07-28 + +- No user-visible Registry Manifest changes. This release fixes forward from + the failed v0.15.0 publication workflow. + ## [0.15.0] - 2026-07-28 - No user-visible Registry Manifest changes. diff --git a/products/manifest/docs/release-notes.md b/products/manifest/docs/release-notes.md index 977e7cf425..012f69e900 100644 --- a/products/manifest/docs/release-notes.md +++ b/products/manifest/docs/release-notes.md @@ -2,6 +2,11 @@ ## Unreleased +## 0.15.1 + +- Registry Manifest has no user-visible changes. This release fixes forward + from the failed v0.15.0 publication workflow. + ## 0.15.0 - Registry Manifest has no user-visible changes in this release. diff --git a/products/manifest/fuzz/Cargo.lock b/products/manifest/fuzz/Cargo.lock index 8550c8cb20..70f06f4a89 100644 --- a/products/manifest/fuzz/Cargo.lock +++ b/products/manifest/fuzz/Cargo.lock @@ -188,7 +188,7 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" [[package]] name = "registry-manifest-cli" -version = "0.15.0" +version = "0.15.1" dependencies = [ "registry-manifest-core", "serde", @@ -199,7 +199,7 @@ dependencies = [ [[package]] name = "registry-manifest-core" -version = "0.15.0" +version = "0.15.1" dependencies = [ "oxiri", "registry-platform-canonical-json", @@ -223,7 +223,7 @@ dependencies = [ [[package]] name = "registry-platform-canonical-json" -version = "0.15.0" +version = "0.15.1" dependencies = [ "ryu-js", "serde", diff --git a/products/notary/CHANGELOG.md b/products/notary/CHANGELOG.md index 21e40c7a92..a755f048d8 100644 --- a/products/notary/CHANGELOG.md +++ b/products/notary/CHANGELOG.md @@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.15.1] - 2026-07-28 + +- No user-visible Registry Notary changes. This release fixes forward from the + failed v0.15.0 publication workflow. + ## [0.15.0] - 2026-07-28 ### Added diff --git a/products/notary/docs/release-notes.md b/products/notary/docs/release-notes.md index d492eca1a0..e322a54fd1 100644 --- a/products/notary/docs/release-notes.md +++ b/products/notary/docs/release-notes.md @@ -2,6 +2,11 @@ ## Unreleased +## 0.15.1 + +- Registry Notary has no user-visible changes. This release fixes forward from + the failed v0.15.0 publication workflow. + ## 0.15.0 - Registry Notary now requires every configured CEL worker to complete one diff --git a/products/notary/fuzz/Cargo.lock b/products/notary/fuzz/Cargo.lock index 02ee181df6..f26960f57b 100644 --- a/products/notary/fuzz/Cargo.lock +++ b/products/notary/fuzz/Cargo.lock @@ -1509,7 +1509,7 @@ dependencies = [ [[package]] name = "registry-notary-core" -version = "0.15.0" +version = "0.15.1" dependencies = [ "base64", "humantime-serde", @@ -1543,7 +1543,7 @@ dependencies = [ [[package]] name = "registry-platform-authcommon" -version = "0.15.0" +version = "0.15.1" dependencies = [ "serde", "sha2 0.11.0", @@ -1554,7 +1554,7 @@ dependencies = [ [[package]] name = "registry-platform-cache" -version = "0.15.0" +version = "0.15.1" dependencies = [ "async-trait", "sha2 0.11.0", @@ -1564,7 +1564,7 @@ dependencies = [ [[package]] name = "registry-platform-canonical-json" -version = "0.15.0" +version = "0.15.1" dependencies = [ "ryu-js", "serde", @@ -1574,7 +1574,7 @@ dependencies = [ [[package]] name = "registry-platform-config" -version = "0.15.0" +version = "0.15.1" dependencies = [ "base64", "registry-platform-crypto", @@ -1588,7 +1588,7 @@ dependencies = [ [[package]] name = "registry-platform-crypto" -version = "0.15.0" +version = "0.15.1" dependencies = [ "async-trait", "aws-lc-rs", @@ -1609,7 +1609,7 @@ dependencies = [ [[package]] name = "registry-platform-httputil" -version = "0.15.0" +version = "0.15.1" dependencies = [ "base64", "bytes", @@ -1632,7 +1632,7 @@ dependencies = [ [[package]] name = "registry-platform-oid4vci" -version = "0.15.0" +version = "0.15.1" dependencies = [ "base64", "registry-platform-crypto", @@ -1645,7 +1645,7 @@ dependencies = [ [[package]] name = "registry-platform-ops" -version = "0.15.0" +version = "0.15.1" dependencies = [ "fs2", "registry-platform-config", @@ -1660,7 +1660,7 @@ dependencies = [ [[package]] name = "registry-platform-replay" -version = "0.15.0" +version = "0.15.1" dependencies = [ "async-trait", "getrandom 0.4.3", @@ -1671,7 +1671,7 @@ dependencies = [ [[package]] name = "registry-platform-sdjwt" -version = "0.15.0" +version = "0.15.1" dependencies = [ "base64", "getrandom 0.4.3", diff --git a/products/notary/openapi/registry-notary.openapi.json b/products/notary/openapi/registry-notary.openapi.json index 333262974f..bdbac473f1 100644 --- a/products/notary/openapi/registry-notary.openapi.json +++ b/products/notary/openapi/registry-notary.openapi.json @@ -1794,7 +1794,7 @@ }, "summary": "Standalone evidence evaluation, rendering, and credential issuance service.", "title": "Registry Notary API", - "version": "0.15.0" + "version": "0.15.1" }, "openapi": "3.1.0", "paths": { @@ -3192,7 +3192,7 @@ "example": { "info": { "title": "Registry Notary API", - "version": "0.15.0" + "version": "0.15.1" }, "openapi": "3.1.0", "paths": { diff --git a/products/notary/security/advisory-baseline.json b/products/notary/security/advisory-baseline.json index 9a568ba0a5..ebd5dbec90 100644 --- a/products/notary/security/advisory-baseline.json +++ b/products/notary/security/advisory-baseline.json @@ -124,7 +124,7 @@ "severity_changed" ], "owner": "@jeremi", - "reason": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The v0.15.0 candidate rereview found that only the service binaries changed and every native closure dependency remained identical. Registry Notary still imports __isoc23_sscanf through the unchanged aws-lc dependency, whose reviewed call sites retain only fixed-format %lu and %lx conversions; neither exact candidate binary contains an effective vulnerable %mc format. Every file in both candidate executable closures remains digest-enforced because dynamic-symbol absence cannot truthfully express a format-string invariant.", + "reason": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The v0.15.1 candidate rereview found that only the service binaries changed and every native closure dependency remained identical. Registry Notary still imports __isoc23_sscanf through the unchanged aws-lc dependency, whose reviewed call sites retain only fixed-format %lu and %lx conversions; neither exact candidate binary contains an effective vulnerable %mc format. Every file in both candidate executable closures remains digest-enforced because dynamic-symbol absence cannot truthfully express a format-string invariant.", "reviewed_at": "2026-07-28", "expires_at": "2026-08-28" }, @@ -224,7 +224,7 @@ "severity_changed" ], "owner": "@jeremi", - "reason": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The v0.15.0 candidate rereview found that only the service binaries changed, every native closure dependency remained identical, and neither executable directly imports ungetwc. Every file in both candidate executable closures plus the out-of-closure libstdc++ object that imports ungetwc remains digest-enforced. A static dynamic-symbol assertion is incomplete because registry-notary imports dlsym.", + "reason": "Debian classifies the Trixie issue as minor/no-DSA and has no Trixie fix. The v0.15.1 candidate rereview found that only the service binaries changed, every native closure dependency remained identical, and neither executable directly imports ungetwc. Every file in both candidate executable closures plus the out-of-closure libstdc++ object that imports ungetwc remains digest-enforced. A static dynamic-symbol assertion is incomplete because registry-notary imports dlsym.", "reviewed_at": "2026-07-28", "expires_at": "2026-08-28" }, @@ -324,7 +324,7 @@ "severity_changed" ], "owner": "@jeremi", - "reason": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed upstream or Trixie version. The v0.15.0 candidate rereview found that only the service binaries changed, every native closure dependency remained identical, and neither executable directly imports ns_printrrf, ns_printrr, or fp_nquery. Every file in both candidate executable closures plus libresolv remains digest-enforced. A static dynamic-symbol assertion is incomplete because registry-notary imports dlsym.", + "reason": "Debian classifies the Trixie issue as minor/no-DSA and has no fixed upstream or Trixie version. The v0.15.1 candidate rereview found that only the service binaries changed, every native closure dependency remained identical, and neither executable directly imports ns_printrrf, ns_printrr, or fp_nquery. Every file in both candidate executable closures plus libresolv remains digest-enforced. A static dynamic-symbol assertion is incomplete because registry-notary imports dlsym.", "reviewed_at": "2026-07-28", "expires_at": "2026-08-28" } diff --git a/products/platform/CHANGELOG.md b/products/platform/CHANGELOG.md index cb8e7d280a..39d8981dd9 100644 --- a/products/platform/CHANGELOG.md +++ b/products/platform/CHANGELOG.md @@ -2,6 +2,11 @@ ## Unreleased +## v0.15.1 - 2026-07-28 + +- No user-visible Registry Platform changes. This release fixes forward from + the failed v0.15.0 publication workflow. + ## v0.15.0 - 2026-07-28 - No separately versioned Registry Platform API changes. This release carries diff --git a/products/platform/fuzz/Cargo.lock b/products/platform/fuzz/Cargo.lock index 72d2f3da26..c7c44046e5 100644 --- a/products/platform/fuzz/Cargo.lock +++ b/products/platform/fuzz/Cargo.lock @@ -1433,7 +1433,7 @@ dependencies = [ [[package]] name = "registry-platform-authcommon" -version = "0.15.0" +version = "0.15.1" dependencies = [ "serde", "sha2 0.11.0", @@ -1444,7 +1444,7 @@ dependencies = [ [[package]] name = "registry-platform-cache" -version = "0.15.0" +version = "0.15.1" dependencies = [ "async-trait", "sha2 0.11.0", @@ -1454,7 +1454,7 @@ dependencies = [ [[package]] name = "registry-platform-canonical-json" -version = "0.15.0" +version = "0.15.1" dependencies = [ "ryu-js", "serde", @@ -1464,7 +1464,7 @@ dependencies = [ [[package]] name = "registry-platform-crypto" -version = "0.15.0" +version = "0.15.1" dependencies = [ "async-trait", "aws-lc-rs", @@ -1504,7 +1504,7 @@ dependencies = [ [[package]] name = "registry-platform-httputil" -version = "0.15.0" +version = "0.15.1" dependencies = [ "base64", "bytes", @@ -1527,7 +1527,7 @@ dependencies = [ [[package]] name = "registry-platform-oid4vci" -version = "0.15.0" +version = "0.15.1" dependencies = [ "base64", "registry-platform-crypto", @@ -1540,7 +1540,7 @@ dependencies = [ [[package]] name = "registry-platform-oidc" -version = "0.15.0" +version = "0.15.1" dependencies = [ "base64", "jsonwebtoken", @@ -1555,7 +1555,7 @@ dependencies = [ [[package]] name = "registry-platform-replay" -version = "0.15.0" +version = "0.15.1" dependencies = [ "async-trait", "getrandom 0.4.3", @@ -1566,7 +1566,7 @@ dependencies = [ [[package]] name = "registry-platform-sdjwt" -version = "0.15.0" +version = "0.15.1" dependencies = [ "base64", "getrandom 0.4.3", diff --git a/release/OPERATIONS.md b/release/OPERATIONS.md index fc710435f2..f93194c119 100644 --- a/release/OPERATIONS.md +++ b/release/OPERATIONS.md @@ -110,8 +110,8 @@ git fetch origin main source_sha="$(git rev-parse origin/main)" release/scripts/registry-release request-candidate \ - --version 0.15.0 \ - --release-id beta-20 \ + --version 0.15.1 \ + --release-id beta-21 \ --source-sha "${source_sha}" \ --proof-level auto ``` @@ -126,8 +126,8 @@ the one instrumented measurement run through the supported release command: ```sh release/scripts/registry-release request-candidate \ - --version 0.15.0 \ - --release-id beta-20 \ + --version 0.15.1 \ + --release-id beta-21 \ --source-sha "${source_sha}" \ --proof-level extended \ --milestone beta \ @@ -151,8 +151,8 @@ Run the local verifier before creating a tag: candidate_run="${CANDIDATE_RUN_ID:?set CANDIDATE_RUN_ID to the exact run}" release/scripts/registry-release finalize \ - --version 0.15.0 \ - --release-id beta-20 \ + --version 0.15.1 \ + --release-id beta-21 \ --promotion-commit "$(git rev-parse origin/main)" \ --candidate-run "${candidate_run}" ``` @@ -166,7 +166,7 @@ binds the run ID, run attempt, and receipt SHA-256. Run that printed command, inspect the tag, and push only that exact ref: ```sh -tag=v0.15.0 +tag=v0.15.1 git show --show-signature "${tag}" git push origin "refs/tags/${tag}" ``` @@ -234,7 +234,7 @@ requires it: ```sh gh api --method POST repos/registrystack/registry-stack/dispatches \ -f event_type=release-repeatability \ - -f 'client_payload[tag]=v0.15.0' + -f 'client_payload[tag]=v0.15.1' ``` The job compares the clean rebuild with published hashes and image digests, diff --git a/release/REPEATABLE-BUILDS.md b/release/REPEATABLE-BUILDS.md index f8a2d07241..435bc7a094 100644 --- a/release/REPEATABLE-BUILDS.md +++ b/release/REPEATABLE-BUILDS.md @@ -43,7 +43,7 @@ An external reviewer can run the same job for an exact tag: ```sh gh api --method POST repos/registrystack/registry-stack/dispatches \ -f event_type=release-repeatability \ - -f 'client_payload[tag]=v0.15.0' + -f 'client_payload[tag]=v0.15.1' ``` The automated path applies to releases that include diff --git a/release/manifests/registry-stack-beta-21.yaml b/release/manifests/registry-stack-beta-21.yaml new file mode 100644 index 0000000000..27e6ffff72 --- /dev/null +++ b/release/manifests/registry-stack-beta-21.yaml @@ -0,0 +1,38 @@ +stack: + release: beta-21 + version: 0.15.1 + source_repo: registrystack/registry-stack + source_ref: 547ecb3e3a088f00b4101ac3e4244bd9a925075c + source_tag: v0.15.1 + status: draft + +artifacts: + registry-notary: 0.15.1 + registry-notary-cel-worker: 0.15.1 + registry-relay: 0.15.1 + registry-relay-rhai-worker: 0.15.1 + registry-manifest-cli: 0.15.1 + registryctl: 0.15.1 + registryctl-image-lock: 0.15.1 + registryctl-installer: 0.15.1 + registry-docs: 0.15.1 + +external: + crosswalk: + repo: PublicSchema/crosswalk + ref: 1d44ec735fdc8a7c719264b339574371e8330337 + status: tested external input + +warnings: + - code: draft-source-ref + classification: release-preparation + detail: The fix-forward source ref intentionally points at the protected-main base until this preparation merges; the finalization change will replace it with the exact merge commit before candidate dispatch. + - code: prior-tag-publication-failed + classification: failed-train-recorded + detail: The immutable v0.15.0 tag exists, but its workflow failed before any public write because the frozen workflow did not remove Git's for-each-ref record separator before parsing the candidate binding. This release fixes forward without retagging. + - code: hosted-publication-held + classification: hosted-gate-held + detail: Source beta may ship; hosted/public announcement remains held until Solmara Lab is atomically repinned to the published v0.15.1 digests and its adopter smoke passes. + - code: solmara-adopter-repin-pending + classification: adopter-gate-pending + detail: Solmara Lab consumes released images and will be repinned and validated only after immutable v0.15.1 digests exist. diff --git a/release/notes/v0.15.1.md b/release/notes/v0.15.1.md new file mode 100644 index 0000000000..2e8a295279 --- /dev/null +++ b/release/notes/v0.15.1.md @@ -0,0 +1,52 @@ +# Registry Stack v0.15.1 + +Registry Stack v0.15.1 is the beta-21 fix-forward release. It carries the +v0.15.0 candidate product behavior unchanged and repairs the release +publication path. The immutable v0.15.0 tag remains as failed-train evidence: +its workflow stopped before any public write because the frozen workflow did +not remove Git's `for-each-ref` record-separator newline before parsing the +candidate binding. + +## Adopter onboarding and authoring + +- Registryctl publishes a versioned installer and a canonical `spreadsheet` + starter for creating, validating, starting, testing, and stopping a protected + local Registry Relay API on Linux amd64. +- Project authoring adds value-free explanation, offline preflight, capability + inventory, semantic comparison, promotion analysis, migration, fixture + coverage, and generated-artifact provenance reports. +- Generated references cover the complete authoring and runtime configuration + domains while keeping authoring, fixture, and operator diagnostics separate. +- Generated local runtime credentials remain owner-only, local listeners bind + IPv4 loopback, and Registryctl validates through the exact digest-pinned + Compose service instead of an ambient product executable. + +## Relay and Notary + +- Relay validates every materialized spreadsheet row before activation and + rejects formulas, duplicate keys, strict-column drift, nulls, and incompatible + types with bounded value-free diagnostics. +- BREAKING: governed attribute release is stable and enabled in canonical + builds. Profiles require purpose, the exact identity-release scope, and + subject type; expressions see only redacted rows and responses are + non-storable. +- Relay rechecks consultation contract closure before source continuation, so a + stale contract hash fails with zero source calls. +- Notary string claims can retain authored UTF-8 byte bounds. CEL workers must + complete one bounded, type-correct protocol probe before activation, while a + mixed replacement failure retains healthy workers. + +## Release evidence and scope + +- The tag workflow removes only Git's one `for-each-ref` record separator before + applying the existing exact closed candidate-binding parser. +- The finalizer removes temporary download archives after verified extraction, + so archive transport files cannot contaminate the candidate file inventory. +- The pre-tag candidate path verifies binary bytes, image configuration and + ordered layers, scans, SBOMs, release-form behavior, candidate receipts, and + immutable documentation archives before promotion. +- Registry Manifest has no user-visible change. Crosswalk remains pinned at + `1d44ec735fdc8a7c719264b339574371e8330337`. +- Solmara Lab repinning, hosted publication, external OpenID, OpenCRVS, DHIS2, + wallet, verifier, and country-acceptance evidence remain separate gates. + This source release does not claim those results. diff --git a/release/scripts/registry-release b/release/scripts/registry-release index 75a41c885e..861363734b 100755 --- a/release/scripts/registry-release +++ b/release/scripts/registry-release @@ -2528,6 +2528,7 @@ def download_candidate_artifact( *, expected_archive_sha256: str, ) -> None: + destination.parent.mkdir(parents=True, exist_ok=True) archive = destination.parent / f"artifact-{artifact_id}.zip" download_gh_api_bytes( f"repos/{repository}/actions/artifacts/{artifact_id}/zip", @@ -2543,6 +2544,8 @@ def download_candidate_artifact( raise ReleasePlanError( f"cannot verify candidate artifact {artifact_id}: {exc}" ) from exc + finally: + archive.unlink(missing_ok=True) def verify_candidate_run_for_finalize( diff --git a/release/scripts/test_registry_release.py b/release/scripts/test_registry_release.py index 013754813b..6d9bf9afe8 100755 --- a/release/scripts/test_registry_release.py +++ b/release/scripts/test_registry_release.py @@ -1459,6 +1459,22 @@ def test_candidate_promotion_has_closed_no_rebuild_publish_gates(self) -> None: self.assertIn("reconcile", extended["needs"]) self.assertNotRegex(text, r"(?m)^\s*git (?:push|tag|update-ref)\b") + def test_release_workflow_removes_for_each_ref_record_separators(self) -> None: + workflow = yaml.safe_load( + (ROOT / ".github/workflows/release.yml").read_text(encoding="utf-8") + ) + scripts = [ + step["run"] + for job in workflow["jobs"].values() + for step in job.get("steps", []) + if "git for-each-ref --format='%(contents)'" in step.get("run", "") + ] + + self.assertEqual(2, len(scripts)) + for script in scripts: + self.assertIn('message.endswith("\\n")', script) + self.assertIn("message[:-1]", script) + def test_release_workflow_publishes_digest_bound_release_file_sboms(self) -> None: workflow = (ROOT / ".github/workflows/release.yml").read_text(encoding="utf-8") candidate = (ROOT / ".github/workflows/release-candidate.yml").read_text( @@ -1618,7 +1634,7 @@ def test_validate_docsets_matches_release_manifests(self) -> None: result = run_tool("validate-docsets") self.assertEqual(0, result.returncode, result.stderr) - self.assertIn("validated 12 versioned docsets", result.stdout) + self.assertIn("validated 13 versioned docsets", result.stdout) def test_validate_docsets_rejects_external_ref_drift(self) -> None: with tempfile.TemporaryDirectory() as tmp: From b30516113c34b056a7715fb1c5979c05d2efd8a3 Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Wed, 29 Jul 2026 00:31:59 +0700 Subject: [PATCH 2/4] test: update v0.15.1 authoring digest Signed-off-by: Jeremi Joslin --- crates/registryctl/tests/project_authoring.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/registryctl/tests/project_authoring.rs b/crates/registryctl/tests/project_authoring.rs index 71e8497c05..b31a6e55a5 100644 --- a/crates/registryctl/tests/project_authoring.rs +++ b/crates/registryctl/tests/project_authoring.rs @@ -5816,7 +5816,7 @@ fn check_and_build_produce_deterministic_product_inputs() { assert_eq!(first_closure, directory_closure(&output)); assert_eq!( closure_digest(&first_closure), - "4013efd2871b76091289c58dbf071e673ff626ac885e20f46efdc84c16a552ff", + "7f5ff13f352ff60cceb509342ef1327560d7400531fe0e8fbb13d21efd24f071", "project output, including its deterministic manifest, must match the cross-machine golden digest" ); } From 2b444641b9da344edfad0fdf86b169418f4e6de6 Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Wed, 29 Jul 2026 00:44:50 +0700 Subject: [PATCH 3/4] release: refresh beta-21 preparation base Signed-off-by: Jeremi Joslin --- docs/site/src/data/docsets.yaml | 12 ++++++------ docs/site/src/data/generated/docsets.json | 12 ++++++------ release/manifests/registry-stack-beta-21.yaml | 2 +- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/docs/site/src/data/docsets.yaml b/docs/site/src/data/docsets.yaml index bd3f828ec6..0ab0eedcb9 100644 --- a/docs/site/src/data/docsets.yaml +++ b/docs/site/src/data/docsets.yaml @@ -34,22 +34,22 @@ docsets: products: registry-stack: version: v0.15.1 - ref: 547ecb3e3a088f00b4101ac3e4244bd9a925075c + ref: cef8fb90d67e741aba8999d552ffcd31fbe7933d registry-platform: version: v0.15.1 - ref: 547ecb3e3a088f00b4101ac3e4244bd9a925075c + ref: cef8fb90d67e741aba8999d552ffcd31fbe7933d registry-manifest: version: v0.15.1 - ref: 547ecb3e3a088f00b4101ac3e4244bd9a925075c + ref: cef8fb90d67e741aba8999d552ffcd31fbe7933d registry-notary: version: v0.15.1 - ref: 547ecb3e3a088f00b4101ac3e4244bd9a925075c + ref: cef8fb90d67e741aba8999d552ffcd31fbe7933d registry-relay: version: v0.15.1 - ref: 547ecb3e3a088f00b4101ac3e4244bd9a925075c + ref: cef8fb90d67e741aba8999d552ffcd31fbe7933d registry-registryctl: version: v0.15.1 - ref: 547ecb3e3a088f00b4101ac3e4244bd9a925075c + ref: cef8fb90d67e741aba8999d552ffcd31fbe7933d crosswalk: version: crosswalk-core-v0.2.0 ref: 1d44ec735fdc8a7c719264b339574371e8330337 diff --git a/docs/site/src/data/generated/docsets.json b/docs/site/src/data/generated/docsets.json index c53e486791..f4891aebcf 100644 --- a/docs/site/src/data/generated/docsets.json +++ b/docs/site/src/data/generated/docsets.json @@ -43,27 +43,27 @@ "products": { "registry-stack": { "version": "v0.15.1", - "ref": "547ecb3e3a088f00b4101ac3e4244bd9a925075c" + "ref": "cef8fb90d67e741aba8999d552ffcd31fbe7933d" }, "registry-platform": { "version": "v0.15.1", - "ref": "547ecb3e3a088f00b4101ac3e4244bd9a925075c" + "ref": "cef8fb90d67e741aba8999d552ffcd31fbe7933d" }, "registry-manifest": { "version": "v0.15.1", - "ref": "547ecb3e3a088f00b4101ac3e4244bd9a925075c" + "ref": "cef8fb90d67e741aba8999d552ffcd31fbe7933d" }, "registry-notary": { "version": "v0.15.1", - "ref": "547ecb3e3a088f00b4101ac3e4244bd9a925075c" + "ref": "cef8fb90d67e741aba8999d552ffcd31fbe7933d" }, "registry-relay": { "version": "v0.15.1", - "ref": "547ecb3e3a088f00b4101ac3e4244bd9a925075c" + "ref": "cef8fb90d67e741aba8999d552ffcd31fbe7933d" }, "registry-registryctl": { "version": "v0.15.1", - "ref": "547ecb3e3a088f00b4101ac3e4244bd9a925075c" + "ref": "cef8fb90d67e741aba8999d552ffcd31fbe7933d" }, "crosswalk": { "version": "crosswalk-core-v0.2.0", diff --git a/release/manifests/registry-stack-beta-21.yaml b/release/manifests/registry-stack-beta-21.yaml index 27e6ffff72..5e23649452 100644 --- a/release/manifests/registry-stack-beta-21.yaml +++ b/release/manifests/registry-stack-beta-21.yaml @@ -2,7 +2,7 @@ stack: release: beta-21 version: 0.15.1 source_repo: registrystack/registry-stack - source_ref: 547ecb3e3a088f00b4101ac3e4244bd9a925075c + source_ref: cef8fb90d67e741aba8999d552ffcd31fbe7933d source_tag: v0.15.1 status: draft From e9107e097f40da705441fa51b93a49912d1c73d3 Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Wed, 29 Jul 2026 01:24:09 +0700 Subject: [PATCH 4/4] test(release): cover candidate artifact cleanup Refresh the v0.15.1 Relay and Notary advisory evidence from canonical binaries and review images. Signed-off-by: Jeremi Joslin --- .../security/advisory-baseline.json | 30 +++--- .../notary/security/advisory-baseline.json | 30 +++--- release/scripts/test_registry_release.py | 100 ++++++++++++++++++ 3 files changed, 130 insertions(+), 30 deletions(-) diff --git a/crates/registry-relay/security/advisory-baseline.json b/crates/registry-relay/security/advisory-baseline.json index ba70650401..37e607e160 100644 --- a/crates/registry-relay/security/advisory-baseline.json +++ b/crates/registry-relay/security/advisory-baseline.json @@ -67,7 +67,7 @@ }, "exposure_assertion": { "kind": "file_digest_equals", - "definition_digest": "sha256:ace115a06bacf1a649ae660f0c426eaf99441e9042629941a74a4260ce2b396a", + "definition_digest": "sha256:2831adb58aa6e3f0b1dc0f3e15e0ca5952133d025e95965cbbb7637a0fba7f0a", "files": [ { "path": "/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2", @@ -103,16 +103,16 @@ }, { "path": "/usr/local/bin/registry-relay", - "sha256": "sha256:f3c6f38c1e214cf3e3f1f64ced038fcc22d167914bb56e1e6a6c566552022d19" + "sha256": "sha256:8342d4707584ab3bc9d325da91960e8f25adfa394fb72bebb792cde4de0c340b" }, { "path": "/usr/local/bin/registry-relay-rhai-worker", - "sha256": "sha256:603a2a1aec49ca155dc402e8785c77652e69f2cc856dbcc60df12e86d01541f5" + "sha256": "sha256:25f9a3da144cc9561e2a5ced7bd035f65bc037bd6968580082295ac9f552dcc6" } ] }, - "evidence_image_digest": "sha256:7d89baf9102b883cd6cc07dac840971b9378af75e4030c135753487e2ffb2675", - "evidence_revision": "d8ad512051a08f9a2a238805dfcd49dbbe883883", + "evidence_image_digest": "sha256:9b6d214d62317822e3927a8e13a363f7ad6c8591713259c0a435fa3edc366273", + "evidence_revision": "2b444641b9da344edfad0fdf86b169418f4e6de6", "rereview_triggers": [ "component_layer_changed", "expired", @@ -202,17 +202,17 @@ }, { "path": "/usr/local/bin/registry-relay", - "sha256": "sha256:f3c6f38c1e214cf3e3f1f64ced038fcc22d167914bb56e1e6a6c566552022d19" + "sha256": "sha256:8342d4707584ab3bc9d325da91960e8f25adfa394fb72bebb792cde4de0c340b" }, { "path": "/usr/local/bin/registry-relay-rhai-worker", - "sha256": "sha256:603a2a1aec49ca155dc402e8785c77652e69f2cc856dbcc60df12e86d01541f5" + "sha256": "sha256:25f9a3da144cc9561e2a5ced7bd035f65bc037bd6968580082295ac9f552dcc6" } ], - "definition_digest": "sha256:744a55be275286aac714383b37caf412d866c8e77a0e01bfd0995164f7467e4f" + "definition_digest": "sha256:78a5e62a88488fc26f7c02823a59c86fe885e006d8db71d4fb66b4671ecbf947" }, - "evidence_image_digest": "sha256:7d89baf9102b883cd6cc07dac840971b9378af75e4030c135753487e2ffb2675", - "evidence_revision": "d8ad512051a08f9a2a238805dfcd49dbbe883883", + "evidence_image_digest": "sha256:9b6d214d62317822e3927a8e13a363f7ad6c8591713259c0a435fa3edc366273", + "evidence_revision": "2b444641b9da344edfad0fdf86b169418f4e6de6", "rereview_triggers": [ "component_layer_changed", "expired", @@ -302,17 +302,17 @@ }, { "path": "/usr/local/bin/registry-relay", - "sha256": "sha256:f3c6f38c1e214cf3e3f1f64ced038fcc22d167914bb56e1e6a6c566552022d19" + "sha256": "sha256:8342d4707584ab3bc9d325da91960e8f25adfa394fb72bebb792cde4de0c340b" }, { "path": "/usr/local/bin/registry-relay-rhai-worker", - "sha256": "sha256:603a2a1aec49ca155dc402e8785c77652e69f2cc856dbcc60df12e86d01541f5" + "sha256": "sha256:25f9a3da144cc9561e2a5ced7bd035f65bc037bd6968580082295ac9f552dcc6" } ], - "definition_digest": "sha256:52135a981c3d245c4ac16da88b449961e6998e4867fc6d0519e1fd9276a720f8" + "definition_digest": "sha256:2e8edf893f1a3a83615ceecaecd08c08168763a8012f19ed0fb01f49848830d9" }, - "evidence_image_digest": "sha256:7d89baf9102b883cd6cc07dac840971b9378af75e4030c135753487e2ffb2675", - "evidence_revision": "d8ad512051a08f9a2a238805dfcd49dbbe883883", + "evidence_image_digest": "sha256:9b6d214d62317822e3927a8e13a363f7ad6c8591713259c0a435fa3edc366273", + "evidence_revision": "2b444641b9da344edfad0fdf86b169418f4e6de6", "rereview_triggers": [ "component_layer_changed", "expired", diff --git a/products/notary/security/advisory-baseline.json b/products/notary/security/advisory-baseline.json index ebd5dbec90..e8079c0f25 100644 --- a/products/notary/security/advisory-baseline.json +++ b/products/notary/security/advisory-baseline.json @@ -102,17 +102,17 @@ }, { "path": "/usr/local/bin/registry-notary", - "sha256": "sha256:27a4573d4dcdd27dc7d310598583f9da9fdc7f8f36d7af648fc4f1182b64a6dc" + "sha256": "sha256:15805896fae0d2876bb8c8ce3cc8b6ab687ba9bb84487b9e713c9cc26607b0ff" }, { "path": "/usr/local/bin/registry-notary-cel-worker", - "sha256": "sha256:8b5ff84dbb74873530e222983fe86ef976bd3ca36ef4811e2ec9a80e310a2a7b" + "sha256": "sha256:dcc46aab81d29bdc1947747a80d72ca49bb1d54e496512323f813afb59ac6bac" } ], - "definition_digest": "sha256:7830e6bb58e94a42745d4e270b681e3041266472584af11cf8d1a64c115acc10" + "definition_digest": "sha256:e8655e54bb4f415669ff3043e3d9a996b9454889da7667213ec845b2665fef85" }, - "evidence_image_digest": "sha256:c2d4b865440d10beff3795363a5798fff217de111da1be5e496f7e4797cd5a93", - "evidence_revision": "efdb1c0f553c540a3f902640d59698cb59b4e18c", + "evidence_image_digest": "sha256:c9bab10adfd2521b39b076cee98d9cccc89f438fa2ba9969ff3395298f95ecdc", + "evidence_revision": "2b444641b9da344edfad0fdf86b169418f4e6de6", "rereview_triggers": [ "component_layer_changed", "expired", @@ -202,17 +202,17 @@ }, { "path": "/usr/local/bin/registry-notary", - "sha256": "sha256:27a4573d4dcdd27dc7d310598583f9da9fdc7f8f36d7af648fc4f1182b64a6dc" + "sha256": "sha256:15805896fae0d2876bb8c8ce3cc8b6ab687ba9bb84487b9e713c9cc26607b0ff" }, { "path": "/usr/local/bin/registry-notary-cel-worker", - "sha256": "sha256:8b5ff84dbb74873530e222983fe86ef976bd3ca36ef4811e2ec9a80e310a2a7b" + "sha256": "sha256:dcc46aab81d29bdc1947747a80d72ca49bb1d54e496512323f813afb59ac6bac" } ], - "definition_digest": "sha256:527bc4e0035bfdbe5addc05bac16a4e613764a7a19b4d409b030f7e8dd8a072d" + "definition_digest": "sha256:3050814b54cf47bca50ca2037b3c6dcae4e0da82e1740bd4ec0f8df25bcb8652" }, - "evidence_image_digest": "sha256:c2d4b865440d10beff3795363a5798fff217de111da1be5e496f7e4797cd5a93", - "evidence_revision": "efdb1c0f553c540a3f902640d59698cb59b4e18c", + "evidence_image_digest": "sha256:c9bab10adfd2521b39b076cee98d9cccc89f438fa2ba9969ff3395298f95ecdc", + "evidence_revision": "2b444641b9da344edfad0fdf86b169418f4e6de6", "rereview_triggers": [ "component_layer_changed", "expired", @@ -302,17 +302,17 @@ }, { "path": "/usr/local/bin/registry-notary", - "sha256": "sha256:27a4573d4dcdd27dc7d310598583f9da9fdc7f8f36d7af648fc4f1182b64a6dc" + "sha256": "sha256:15805896fae0d2876bb8c8ce3cc8b6ab687ba9bb84487b9e713c9cc26607b0ff" }, { "path": "/usr/local/bin/registry-notary-cel-worker", - "sha256": "sha256:8b5ff84dbb74873530e222983fe86ef976bd3ca36ef4811e2ec9a80e310a2a7b" + "sha256": "sha256:dcc46aab81d29bdc1947747a80d72ca49bb1d54e496512323f813afb59ac6bac" } ], - "definition_digest": "sha256:450a437ceb397d28d651cd8d9a245b8498db06f3e81dc5354f9f6c4fa2596720" + "definition_digest": "sha256:5186e368c1fa05302eab88133866a6e88954ef2c1b6b1c9d883d982e410a3003" }, - "evidence_image_digest": "sha256:c2d4b865440d10beff3795363a5798fff217de111da1be5e496f7e4797cd5a93", - "evidence_revision": "efdb1c0f553c540a3f902640d59698cb59b4e18c", + "evidence_image_digest": "sha256:c9bab10adfd2521b39b076cee98d9cccc89f438fa2ba9969ff3395298f95ecdc", + "evidence_revision": "2b444641b9da344edfad0fdf86b169418f4e6de6", "rereview_triggers": [ "component_layer_changed", "expired", diff --git a/release/scripts/test_registry_release.py b/release/scripts/test_registry_release.py index 6d9bf9afe8..759396e266 100755 --- a/release/scripts/test_registry_release.py +++ b/release/scripts/test_registry_release.py @@ -8,7 +8,9 @@ import sys import tempfile import unittest +from importlib.machinery import SourceFileLoader from pathlib import Path +from unittest import mock import yaml @@ -68,7 +70,105 @@ def load_registryctl_image_lock(): return module +def load_registry_release(): + module_name = "registry_release_module" + loader = SourceFileLoader(module_name, str(TOOL)) + spec = importlib.util.spec_from_loader(module_name, loader) + if spec is None: + raise ImportError(f"could not load module spec from {TOOL}") + module = importlib.util.module_from_spec(spec) + sys.path.insert(0, str(TOOL.parent)) + try: + loader.exec_module(module) + finally: + sys.path.pop(0) + return module + + class RegistryReleaseTest(unittest.TestCase): + def test_candidate_artifact_download_removes_transport_archive(self) -> None: + registry_release = load_registry_release() + with tempfile.TemporaryDirectory() as tmp: + root = Path(tmp) + destination = root / "candidate" / "payload" + archive = destination.parent / "artifact-42.zip" + + def download(_endpoint: str, path: Path) -> None: + self.assertTrue(path.parent.is_dir()) + path.write_bytes(b"archive") + + def extract( + path: Path, + output: Path, + *, + expected_sha256: str, + ) -> None: + self.assertEqual(archive, path) + self.assertEqual("a" * 64, expected_sha256) + output.mkdir() + (output / "payload.txt").write_text("verified\n", encoding="utf-8") + + with ( + mock.patch.object( + registry_release, + "download_gh_api_bytes", + side_effect=download, + ), + mock.patch.object( + registry_release.release_candidate, + "extract_artifact_archive", + side_effect=extract, + ), + ): + registry_release.download_candidate_artifact( + "registrystack/registry-stack", + 42, + destination, + expected_archive_sha256="a" * 64, + ) + + self.assertFalse(archive.exists()) + self.assertEqual( + "verified\n", + (destination / "payload.txt").read_text(encoding="utf-8"), + ) + + def test_candidate_artifact_download_removes_archive_after_rejection(self) -> None: + registry_release = load_registry_release() + with tempfile.TemporaryDirectory() as tmp: + destination = Path(tmp) / "candidate" / "payload" + archive = destination.parent / "artifact-42.zip" + + def download(_endpoint: str, path: Path) -> None: + path.write_bytes(b"archive") + + with ( + mock.patch.object( + registry_release, + "download_gh_api_bytes", + side_effect=download, + ), + mock.patch.object( + registry_release.release_candidate, + "extract_artifact_archive", + side_effect=registry_release.release_candidate.CandidateError( + "digest mismatch" + ), + ), + self.assertRaisesRegex( + registry_release.ReleasePlanError, + "cannot verify candidate artifact 42: digest mismatch", + ), + ): + registry_release.download_candidate_artifact( + "registrystack/registry-stack", + 42, + destination, + expected_archive_sha256="a" * 64, + ) + + self.assertFalse(archive.exists()) + def test_registryctl_image_lock_schema_boundary_preserves_historical_v1( self, ) -> None: