Skip to content

rustsdcmcp v0.1.0 lab prerelease 4

Pre-release
Pre-release

Choose a tag to compare

View all tags
@fastrevmd-lab fastrevmd-lab released this 05 Aug 19:30
· 165 commits to main since this release
v0.1.0-lab.4
ee38d08
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Lab-only prerelease. Not a public release — v0.1.0 remains blocked until
one coherent upstream mecmcp release replaces all 59 compatibility ledger
entries.

Built from ee38d0891151cfc61f5f9c6ec6deb4559e45400d with all five shared
mecmcp crates pinned to changeset-v0.3.7.

Why this re-cuts lab.3

The lab.3 archive shipped a README telling its reader to download lab.1.

The packager copied the repository README verbatim, and that file pins whichever
prerelease was current when it was written. A release is always built from a
commit that predates the documentation describing it, so every archive
carried download instructions for the previous release. lab.1 and lab.2 have the
same defect.

The package now carries a generated README describing itself — archive name,
source commit, mecmcp pin, prerequisites, verification, install, contents. It
references no release tag, so it cannot go stale. Two values are single-sourced
to keep it that way: the GLIBC floor shares BUILD-INFO's variable, and the
mecmcp reference is derived from the Cargo.toml pin rather than repeated,
with verify-packaging.sh asserting the manifest holds exactly one approved
tag.

The binary is unchanged from lab.3. If you have lab.3 installed and working,
this changes only the documentation inside the archive.

Verify the archive

Take the checksum from this release page over an authenticated connection — a
.sha256 obtained through the same channel as the archive only proves the two
agree.

gh release download v0.1.0-lab.4 \
  --repo fastrevmd-lab/rustsdcmcp \
  --pattern 'rustsdcmcp_0.1.0-lab.20260805.ee38d0891151_amd64.tar.gz*'
sha256sum -c rustsdcmcp_0.1.0-lab.20260805.ee38d0891151_amd64.tar.gz.sha256

BUILD-INFO records release_status=lab-only, the source commit, toolchain and
GLIBC floor; SBOM.cdx.json carries the CycloneDX dependency set. Both are
metadata — they confirm what the package claims to be, and do not detect a
modified binary.

Known limitation, unchanged from lab.3

The systemd IPAddress* egress directives are defence in depth only and are
likely inert on an unprivileged LXC: systemd implements them with cgroup eBPF
and fails open when it cannot attach. The installer probes and reports
ENFORCED / NO POLICY / NOT ENFORCED / UNKNOWN; docs/operations.md
covers where to enforce instead.

systemctl show rustsdcmcp.service -p IPEgressBytes --value   # [no data] = inert
Assets 4
Loading