Skip to content

varve v0.11.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Aug 05:57
· 6 commits to main since this release
v0.11.0
This tag was signed with the committer’s verified signature.
avrabe Ralf Anton Beier
SSH Key Fingerprint: 5yELJMbRldVoXWU2u9E8p8a9GUJCyQLyinKHfADgAOE
Verified
Learn about vigilant mode.
d93f1af
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

varve v0.11.0 — portable wasm entries + layer runners

REQ-RUNNER-001 verified: wasm-only tools join layers with zero per-platform gaps, executed by a runner from the same verified layer.

What's in

  • Portable entries: a wasm32-* platform matches every host — the bytes ride everywhere a runner exists
  • Signed runner contracts: [tool.runner] in the deposit spec (tool, prefix args, optional per-user-argument flag — kilnd's --wasi-arg shape) lands in the signed payload; varve run and the shims dispatch through the runner from the same verified layer, never from PATH; a runnered entry without its runner fails closed
  • First real payload (scry via kilnd) awaits the meld↔kilnd entry-point contract: kiln#480 / scry#118 — a one-line roster addition once resolved

Falsification statement

This release claims: a runnered entry executes only through its layer's own runner, with exactly the signed invocation contract. To falsify: make a runnered entry execute via any binary outside the resolved layer, or with arguments deviating from the signed contract. The e2e demonstrates the exact invocation and is mutation-checked (skipping runner dispatch fails the test).

Verify this release

varve self-verify --archive varve-v0.11.0-<triple>.tar.gz --envelope SHA256SUMS.txt.dsse.json

This machine took the release via varve self-update (0.10.0 → 0.11.0, old-verifies-new).

Assets 13
Loading