Skip to content

v0.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Sep 06:21
· 10 commits to main since this release
v0.1.0
603317f

Changelog

  • 603317f debark: move Debian/Ubuntu software across an air gap, and prove it

Artifacts. debark_* is the CLI: Linux amd64/arm64 and Windows amd64 archives, plus .deb and .rpm packages. debark-gui_* is the desktop application, published onto this same release from this same tag. There are no macOS builds.

Verifying. debark_checksums.txt covers every CLI artifact and is signed with cosign in keyless mode; debark_checksums.txt.sig and debark_checksums.txt.pem are its signature and certificate. The desktop app has its own debark-gui_checksums.txt. Check each artifact against the file for its own product — sha256sum -c --ignore-missing against the wrong one exits 0 having verified nothing.

debark v0.1.0 — Apache-2.0, forever. No telemetry, no analytics, no update check, in any edition. See docs/free-paid-policy.md for exactly what stays free.

Desktop application (debark-gui)

Linux/amd64 is the supported target. The Windows build is provided because it compiles, not as a support commitment, and it carries no icon and no DPI manifest. There is no macOS build and none is planned.

Verify these artefacts against debark-gui_checksums.txt (cosign-signed; .sig and .pem beside it), not against the CLI's debark_checksums.txt — sha256sum -c --ignore-missing against the wrong file exits 0 having checked nothing.

Debark v0.1.0 — Apache-2.0. No telemetry, no analytics, no crash reporting and no update check, by construction: see gui/docs/dependency-review.md. This application never contacts a debark-operated endpoint; the only hosts it reaches are the distro archives named in the target's own sources and vendor .deb URLs the operator typed.

PROVENANCE.txt inside each archive names the exact debark engine commit this build was linked against — which, now that the engine and the desktop app live in one repository, is this release's own commit. gui/docs/release.md explains what is and is not reproducible here — in particular that the Linux binary's reproducibility is conditioned on the build image, because it links GTK3 and WebKitGTK through cgo.

Assets 23
Loading