v0.3.1

Signed glibcx release candidate. Publication is gated by independent asset verification.

v0.3.0

v0.3.0 was never published. This release exists to document the failure. Use glibcx v0.3.1 instead.

Why v0.3.0 failed

The tag was created at commit 87f0f85992a7e4a24ad2f121bbf023d9f214a316, but the protected release workflow's independent verification rejected the prepared runtime. GitHub Actions' ZIP-based artifact transport flattened the runtime's symlinks (for example lib/ld.so -> ld-linux-aarch64.so.1 was copied as an ordinary file), while the signed manifest still recorded the true link targets. The verifier refused the altered filesystem, and weakening that check would have been unsafe.

Resolution

v0.3.1 fixes the transport: the runtime profile now travels inside a deterministic .tar.xz archive that preserves symlinks and file modes, and the release workflow validates and extracts that archive without following unsafe links (PR #7, commit a95d815).

v0.3.0 immutable-release dry run 2 (NON-PRODUCTION)

NON-PRODUCTION TEST ONLY. Fixture OpenPGP keys and fixture runtime payload. Do not install or promote to latest. This draft validates the corrected CI path, signed asset assembly, GitHub immutable-release publication, and release-attestation verification.

v0.2.0

Install

curl -fsSL https://raw.githubusercontent.com/dsecurity49/glibcx/main/install.sh | bash

What's changed

See CHANGELOG.md for details.