[Homebrew/ABI] Promote exact pre-merge bottle candidates - #1183
Draft
brandonpayton wants to merge 4 commits into
Draft
[Homebrew/ABI] Promote exact pre-merge bottle candidates#1183brandonpayton wants to merge 4 commits into
brandonpayton wants to merge 4 commits into
Conversation
Plan the exact Homebrew closure for an unmerged Kandelo ABI change before any bottle is built. Bind the protected base, producer, tap, native Homebrew source, package catalog, ABI snapshot, guest layout, public destination observations, and workflow evidence in a noncanonical candidate release. Allow an older catalog to seed a newer ABI only by forcing every mismatched variant to rebuild. Reject newer catalogs, mutable inputs, changed derivations, and merges that do not preserve the exact producer tree.
Keep unmerged bottle bytes noncanonical while preserving enough protected evidence to promote the exact bytes after an exact merge. Bind the package input, build handoff, OCI child, source, and workflow identities in the candidate manifest. Authenticate immutable public release bytes with a bounded protected sealer receipt, complete asset inventory, and anonymous SHA-256 readback. Promotion accepts no extra or missing file and never relies on mutable pull-request head metadata.
Make the protected tap publish candidate bytes only after an immutable merge object proves exact parents, complete tree equality, and reachability from current main. Authenticate each exact successful run attempt through its 90-day sealer receipt, regenerate and bind the package input, pin reusable callers to reviewed Kandelo SHAs, and re-read every public release byte before handing it to the canonical publisher. Keep package credentials isolated from candidate code and let bulky two-day artifacts expire.
Keep repository copies as nondeployable templates and render them with literal protected base and merge SHAs before installing them in the live tap. Validate campaign, bottle, and promotion references against the exact caller commit that GitHub reports. Document the staging bridge, exact merge, 90-day promotion window, full-rerun rule, and pending live-tap installation. This prevents the documentation from promising the lane before its coordinated tap commit exists.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Kandelo ABI changes may need matching Homebrew bottles before the
change can merge. Rebuilding those bottles after merge wastes time,
but publishing unmerged bytes as normal bottles would let unreviewed
code become canonical.
This change adds a bounded candidate lane. It keeps bottles built
from an open same-repository PR noncanonical, seals their exact public
bytes and workflow evidence, and promotes only those bytes after an
exact merge proves that the reviewed candidate tree reached protected
mainunchanged.What changes
wasm32Formula.
expire without losing promotion evidence.
[B, S],tree(M) == tree(S), and protectedmainreachability before promotion.metadata before promotion.
mutable
@mainreferences.The lane is not live until the rendered callers are installed in
Kandelo-dev/homebrew-tap-corein one coordinated tap commit.Current boundary
Version 1 supports one dependency-free
wasm32Formula. It does notpublish VFS images, finalize live tap metadata during candidate builds,
or support dependency-bearing candidate closures.
Validation
Run through
scripts/dev-shell.sh:All passed.
The four commits were replayed onto exact protected-main commit
a59d77804a6b67291999636aea3aa8d291b1689d.git range-diffreports every replayed commit as equivalent to its reviewed source.
The cumulative binary diff is byte-for-byte identical, and none of
the eight stale pre-squash base differences appears in this PR.
This remains a draft while the coordinated live-tap installation and
end-to-end candidate proof are prepared.