Skip to content

varve v0.6.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Aug 18:46
· 17 commits to main since this release
v0.6.1
This tag was signed with the committer’s verified signature.
avrabe Ralf Anton Beier
SSH Key Fingerprint: 5yELJMbRldVoXWU2u9E8p8a9GUJCyQLyinKHfADgAOE
Verified
Learn about vigilant mode.
b010a6b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

varve v0.6.1 — registry pulls of real-sized binaries

Patch to v0.6.0, found by the first real dogfood: the transport read limit (ureq's 10 MiB default) rejected the 31 MB tool blobs of layer 2026.08.0 on the first GHCR pull. Raised to an 8 GiB sanity bound — the signed digests remain the acceptance criterion. Regression-tested with a 12 MB blob through the in-process registry double.

With this release the full loop is live: layer 2026.08.0 (rolling — rivet 0.32.0, synth 0.54.0, wsc 0.10.0 × 4 platforms, every upstream release cosign-verified at deposit) installs by pin from ghcr.io/pulseengine/varve/layers, verifies offline against the rolling trust root, and dispatches through PATH shims.

Verify this release

cosign verify-blob \
  --certificate-identity-regexp 'https://github.com/pulseengine/varve/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle SHA256SUMS.txt.cosign.bundle SHA256SUMS.txt

Re-run against these published assets before these notes were written: Verified OK.

Assets 12
Loading