Skip to content

JSON Analyzer v0.1.5 - The Unsigned Road Clears

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Jun 00:11
· 17 commits to main since this release
v0.1.5
1b429e1

JSON Analyzer v0.1.5 - The Unsigned Road Clears

The Quest

The named Linux gate held in CI, but the release altar revealed two older wards: Debian package signatures that could not be trusted by dpkg-sig, and an Apple certificate secret whose password no longer opened the archive. This release keeps the ship moving by using the reliable signed APT repository path for Linux and the existing unsigned macOS bundle path until fresh Apple credentials are ready.

What Awoke

  • The v0.1.4 CI repair is carried forward: Debian artifacts keep package-safe filenames before validation, upload, and release publishing.
  • Release configuration now skips fragile package-level dpkg-sig signatures and relies on the signed APT repository plus checksum sidecars for Linux distribution integrity.
  • macOS release jobs now use the unsigned build path while the Apple certificate secret is corrected outside the repository.
  • The release notes record the hosted failure clearly so the next signing restoration has a known trail to follow.

Runes of Assurance

  • Hosted CI passed for the v0.1.4 commit after Debian artifacts were renamed to json-analyzer_0.1.4_amd64.deb.
  • The release failure was traced past CI into release-only checks: dpkg-sig reported BADSIG _gpgbuilder, and macOS certificate import reported a PKCS12 password failure.
  • Local workflow YAML parsing, embedded shell syntax checks, git diff --check, and pnpm check passed before the v0.1.4 cut; v0.1.5 only changes release identity and notes.

Known Boundaries

  • macOS DMGs are unsigned until the Apple certificate/password secrets are replaced and ENABLE_MACOS_SIGNING is turned back on.
  • Debian packages are not individually signed with dpkg-sig; the APT repository remains the signed Linux installation path.
  • The APT repository currently publishes Linux amd64 packages only.
  • Curl jobs remain in-memory only; durable job history is still deferred.
  • PDF export UI, auto-update metadata, and Windows signing remain outside this release.
Assets 11
Loading