Conary v0.17.2 synchronized suite

Security update

Conary 0.17.2 repairs privileged Kitchen and recipe-recording sandbox isolation. Users of the affected 0.17.1 preview should upgrade before running these paths with elevated privileges on untrusted inputs. See GHSA-6qhh-qcc5-fxxg for impact, mitigation, and patch details.

Conary v0.17.2 synchronized pre-alpha suite

This one source release contains the Conary, Remi, conaryd, and
conary-test artifacts at version 0.17.2. It is an early preview
for disposable, snapshotted, or explicitly non-critical systems, not
a production recommendation.

Artifact evaluation boundary

The Conary native packages target x86_64 Fedora 44, Ubuntu 26.04 LTS,
and Arch Linux. Publication and released-package proof do not make
this the pinned external-tester release. Assignment is owned by the
repository's versioned launch-status resource. The tester loop stays
paused until that resource assigns this exact tag.

Download SHA256SUMS and the required artifact. Native Conary
packages are named:

• Fedora 44: conary-0.17.2-1.fc44.x86_64.rpm
• Ubuntu 26.04 LTS: conary_0.17.2-1_amd64.deb
• Arch Linux: conary-0.17.2-1-x86_64.pkg.tar.zst

The release-owned bootstrap entry point downloads and verifies the
product-signed conary-bootstrap-v1.manifest, selects only the
exact supported host artifact, and defaults to a non-mutating preview:

curl --proto '=https' --tlsv1.2 -fLO https://conary.io/install-conary-preview.sh
less install-conary-preview.sh
bash ./install-conary-preview.sh
bash ./install-conary-preview.sh --apply --yes

Do not pipe the installer into a shell. The explicit apply mode uses
the native package manager only to install Conary itself; the package
owns system initialization and built-in repository enrollment.

Verify downloaded files with:

sha256sum -c SHA256SUMS --ignore-missing

The release also contains raw and tarred Linux x86_64 binaries for
Remi, conaryd, and conary-test. SBOM and provenance sidecars are not
published yet.

Defects can be reported with the pre-alpha tester feedback template.

Changes

What's Changed

• release: build the artifact-proof harness with the test-hooks feature by @TusanHomichi in #925
• fix(remi): bind survey outcomes and recover helper failures by @TusanHomichi in #916
• docs(release): close out v0.17.1 by @TusanHomichi in #926
• fix(parity): project retained RPM package facts to native identities by @TusanHomichi in #929
• fix(repository): retain complete Debian and ALPM source requirements by @TusanHomichi in #932
• perf(oracle): batch private native package spool writes by @TusanHomichi in #934
• perf(oracle): index exact Debian resolution identities by @TusanHomichi in #938
• perf(ci): batch release-policy fixture copies by @TusanHomichi in #943
• perf(resolver): remove candidate loading and relation-planning amplification by @TusanHomichi in #944
• perf(transaction): reuse borrowed relation facts by @TusanHomichi in #951
• fix(parity): preserve absent native package releases by @TusanHomichi in #952
• fix(install): preserve dependency state during dry runs by @TusanHomichi in #953
• test(bootstrap): use a stable failing EFI formatter fixture by @TusanHomichi in #954
• docs(roadmap): prioritize CLI usability before external testing by @TusanHomichi in #955
• fix(ui): clear and coordinate transient package progress by @TusanHomichi in #957
• fix(ui): render actionable typed CLI diagnostics by @TusanHomichi in #958
• fix(ui): preserve typed CCS verification and preflight diagnostics by @TusanHomichi in #959
• feat(cli): expose typed CCS verification through JSON and MCP by @TusanHomichi in #960
• fix(cli): report collection update previews and outcomes accurately by @TusanHomichi in #961
• fix(cli): explain collection selection without claiming skipped packages are current by @TusanHomichi in #962
• feat(cli): group removal and rollback results by @TusanHomichi in #963
• feat(cli): group install and update transaction summaries by @TusanHomichi in #964
• fix(cli): clarify enabled repository discovery by @TusanHomichi in #966
• fix(cli): preserve native preflight refusals and earlier commits by @TusanHomichi in #967
• fix(cli): preserve repository detail identity and installed variants by @TusanHomichi in #969
• fix(cli): preserve exact installed release selection through update by @TusanHomichi in #974
• perf(update): reuse admitted artifacts without delta downloads by @TusanHomichi in #975
• test(packaging): make trusted fixtures independent of caller umask by @TusanHomichi in #979
• fix(update): serialize pinning with package mutation and removal by @TusanHomichi in #977
• fix(model): serialize package metadata mutations by @TusanHomichi in #980
• build(deps): retire rpm-rs fork and fix export fixtures by @TusanHomichi in #983
• test(packages): isolate missing authority command fixture by @TusanHomichi in #984
• test(bootstrap): make phase scheduling tests independent of cwd by @TusanHomichi in #986
• perf(ci): cache verified pinned sccache archives by @TusanHomichi in #987
• fix(model): select packages for metadata mutations by @TusanHomichi in #988
• perf(ci): batch isolated release-policy mutations by @TusanHomichi in #990
• security(container): confine privileged builds for v0.17.2 by @TusanHomichi in #989

Full Changelog: v0.17.1...v0.17.2