Skip to content

v0.3.0

Choose a tag to compare

View all tags
@dsecurity49 dsecurity49 released this 13 Aug 03:06
· 1 commit to main since this release
Immutable release. Only release title and notes can be modified.
v0.3.0
87f0f85
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.3.0 was never published. This release exists to document the failure. Use glibcx v0.3.1 instead.

Why v0.3.0 failed

The tag was created at commit 87f0f85992a7e4a24ad2f121bbf023d9f214a316, but the protected release workflow's independent verification rejected the prepared runtime. GitHub Actions' ZIP-based artifact transport flattened the runtime's symlinks (for example lib/ld.so -> ld-linux-aarch64.so.1 was copied as an ordinary file), while the signed manifest still recorded the true link targets. The verifier refused the altered filesystem, and weakening that check would have been unsafe.

Resolution

v0.3.1 fixes the transport: the runtime profile now travels inside a deterministic .tar.xz archive that preserves symlinks and file modes, and the release workflow validates and extracts that archive without following unsafe links (PR #7, commit a95d815).

Assets 3
Loading