Skip to content

INDEPENDENCE v1.0.0 — GitHub Pages Deployment Verification Hardening

Choose a tag to compare

View all tags
@EmergentMonk EmergentMonk released this 30 Oct 19:55
Immutable release. Only release title and notes can be modified.
v1.0.0
764aec4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Overview

This update strengthens INDEPENDENCE's GitHub Pages deployment verification infrastructure by separating successful publication from subsequent public CDN observations.

It fixes a failure mode where GitHub Pages successfully published the website, but the overall deployment workflow was incorrectly marked failed because an immediate HTTPS verification returned HTTP 404.

The release preserves strict SHA-256 evidence validation while improving failure reporting, artifact retention, reproducibility, and historical deployment verification.

A successful deployment is not the same as a verified public observation. Both outcomes must be reported independently.

What's Changed

Deployment Success and CDN Verification Are Now Separate

  • GitHub Pages publication success is reported independently of public CDN availability.
  • Post-deployment verification failures no longer incorrectly invalidate a successful publication.
  • Failed public-byte checks produce explicit NOT_VERIFIED evidence and workflow warnings.
  • A successful publication does not automatically claim remote asset integrity.

Deterministic Deployment Manifest Preservation

  • Every deployment preserves its original deployment-manifest.json.
  • The manifest records the exact staged source revision and file checksums.
  • Preserved evidence remains independent of subsequent repository changes.
  • Freshly collected ledger data cannot silently alter historical deployment evidence.

Improved Artifact Retention and Fallback

The manual verification workflow now uses a two-stage retrieval strategy:

  1. Prefer the separately preserved independence-pages-manifest artifact, which follows repository artifact-retention settings.
  2. Fall back to the original github-pages/artifact.tar only when the preferred artifact is unavailable.

This addresses the short default retention period of GitHub Pages upload artifacts.

The verifier refuses missing, malformed, duplicated, substituted, or inconsistent manifest data.

New Strict Manifest Selection Tool

Introduced:

scripts/select_public_manifest.py

Capabilities include:

  • Byte-exact preservation of the original deployment manifest.
  • Strict schema and SHA-256 validation.
  • Safe extraction of the manifest from historical Pages archives.
  • Detection of duplicate or malformed archive members.
  • Fail-closed handling of unavailable or corrupted evidence.
  • Machine-readable NOT_VERIFIED receipts when selection fails.

A corrupt preferred manifest never silently triggers a fallback to another source.

Manual Public-Site Verification

Added the GitHub Actions workflow:

Verify Published INDEPENDENCE Bytes

This workflow accepts an original deployment run ID, retrieves its preserved evidence, and compares every publicly served asset against its original checksums.

Verification can be repeated without republishing the website.

The workflow retains the distinction between:

  • REMOTE_BYTES_MATCHED_UNATTESTED — observed public bytes match the preserved manifest.
  • NOT_VERIFIED — the public deployment could not be confirmed.

Improved HTTP Diagnostics

The public verifier now identifies the specific asset and HTTP status responsible for a failure, rather than producing an ambiguous HTTP 404 message.

HTTPS-only scope restrictions and fail-closed redirect handling remain enforced.

Validation

The final pull-request validation completed successfully:

Verification Result
Python regression suite 341/341 passed
Chromium browser journeys Passed
Firefox browser journeys Passed
Narrow-layout browser journeys Passed
Manifest selection and fallback tests Passed
Missing and corrupted evidence rejection Passed
Deployment artifact integrity checks Passed

These results establish successful local and CI verification. They do not independently establish that the public GitHub Pages CDN is currently serving the expected bytes.

Compatibility and Dependencies

  • No application feature changes.
  • No changes to the existing automata or formal proof semantics.
  • No additional production JavaScript dependencies.
  • No npm, Docker, Kubernetes, Selenium or Playwright requirement for the deployed website.
  • Python verification remains standard-library-only.

Provenance

Pull request:
#22

Merged commit:
764aec4bda8381de2aed620037d5ff992dba25ea

Successful pull-request validation:
https://github.com/QSOLKCB/INDEPENDENCE/actions/runs/41116558846

Historical deployment investigated:
https://github.com/QSOLKCB/INDEPENDENCE/actions/runs/41113714704

Verification Limitations

The fix corrects deployment status reporting, evidence preservation and verification retryability. It does not itself establish the root cause of a persistent public HTTP 404 or guarantee CDN availability.

Public-byte verification remains a separate, explicit observation that must succeed before remote asset integrity is claimed.

THE SOFTWARE DECLARATION OF INDEPENDENCE

This Is Not War, This Is a Divorce.

No fabricated deployment failures. No fabricated verification successes. No unnecessary dependencies.

The Gremlins may interfere with deployment, but they no longer get to rewrite the evidence.

The revolution will not be containerised.

QSOL-IMC — Independent Software Sovereignty Initiative

Assets 3
Loading