Skip to content

v4.169.48 — Archive deployment provenance

Choose a tag to compare

View all tags
@IvanSkainet IvanSkainet released this 17 Aug 13:11
· 125 commits to master since this release
v4.169.48
9b66e74
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Archive deployment provenance and rollback identity

Release ZIPs now carry canonical source identity: repository, exact source commit, strict release tag, and candidate workflow run. Installation writes DEPLOYED_PROVENANCE.json, binding that identity to the downloaded ZIP SHA-256 and install time. authenticated=true is reported only when the installed asset also matches official GitHub Release metadata.

Archive updates retain identified rollback trees, restore complete target shape after failure, quarantine malformed historical provenance, and remove explicitly retired release files transactionally. The obsolete root version.json marker is removed from both new archives and existing installations.

Public /v1/version exposes only a minimal deployment summary. Exact source/run/SHA and rollback identity remain on authenticated /v1/info and /v1/status.

Accepted candidate

  • source commit: 9b66e745e6d83f8f6889efb8fc5045d77c829681
  • candidate run: 32032140006
  • ZIP SHA-256: b88f7220db12b83d5aad2c50b670c34b0c3c286ee38efa4790527e08b701d672
  • APK SHA-256: 7d75889fcd36d2b83539f1d12fc2ed6fb3aaa28064200aaed7c8eb6fb95a5281

The exact candidate passed independent A/B byte comparison, build provenance and SPDX SBOM attestations, the pinned Book of Eternity Windows contract, full CI/security matrices, and real Windows installation acceptance. The installed tree matched 1,022/1,022 release-target files; the retired root marker was absent and preserved only inside the identified rollback snapshot.

Assets 14
Loading