v0.1.33

What this is

The open build of the Crossfyre toolchain, compiled by GitHub
Actions from this tag. Engines and templates are Apache-2.0.

What this is not

This is not the binary get.crossfyre.io installs. The repo is
open-core: three things are absent from any public checkout, and
one feature that is in it is not turned on here.

not in this build	effect on this build
plessor/src/authz/private.rs	no BOLA/BFLA/BOPLA authorization oracle
core/src/egress/private.rs	no per-node egress isolation
adaptive-private/	untuned pacing, not the shipped governor
the impersonate feature	the engines use rustls, not a browser's TLS and HTTP/2 fingerprint

build.rs selects the baseline.rs stubs instead. The distributed
binary includes the real implementations and cannot be reproduced
from this source. That difference is the point of publishing this
separately rather than pretending the two are the same artifact.

This release also carries a standalone oast binary, the
out-of-band interaction server. The first-party CLI runs the same
server as crossfyre oast serve.

Verifying it

Provenance is attested, so you do not have to take our word for where
these came from:

gh attestation verify crossfyre-toolchain-x86_64-unknown-linux-gnu.tar.gz \
  --repo clickswave/crossfyre-toolchain
sha256sum -c SHA256SUMS

Or skip us entirely: clone the tag and cargo build --release.

v0.1.28

What this is

The open build of the Crossfyre toolchain, compiled by GitHub
Actions from this tag. Engines and templates are Apache-2.0.

What this is not

This is not the binary get.crossfyre.io installs. The repo is
open-core, and three things are absent from any public checkout:

absent	effect on this build
cortex/src/authz/private.rs	no BOLA/BFLA/BOPLA authorization oracle
core/src/egress/private.rs	no per-node egress isolation
adaptive-private/	untuned pacing, not the shipped governor

build.rs selects the baseline.rs stubs instead. The distributed
binary includes the real implementations and cannot be reproduced
from this source. That difference is the point of publishing this
separately rather than pretending the two are the same artifact.

Verifying it

Provenance is attested, so you do not have to take our word for where
these came from:

gh attestation verify crossfyre-toolchain-x86_64-unknown-linux-gnu.tar.gz \
  --repo clickswave/crossfyre-toolchain
sha256sum -c SHA256SUMS

Or skip us entirely: clone the tag and cargo build --release.