Skip to content

varve v0.9.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Aug 19:37
· 14 commits to main since this release
v0.9.0
This tag was signed with the committer’s verified signature.
avrabe Ralf Anton Beier
SSH Key Fingerprint: 5yELJMbRldVoXWU2u9E8p8a9GUJCyQLyinKHfADgAOE
Verified
Learn about vigilant mode.
ef9d209
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

varve v0.9.0 — signed source provenance + Bazel interop

REQ-BAZEL-001 verified: Bazel uses varve, never reimplements it.

What's in

  • Deposit spec files (varve deposit --spec deposit.toml): CI-authored TOML carrying, per tool, its upstream source provenance — repo, release, asset name, and the sha256 of the asset as downloaded — recorded inside the signed payload, so downstream lockfiles inherit the signature anchor
  • varve export-bazel --layer <id> --out <dir>: compiles rules_wasm_component-shaped checksum registries from a verified installed layer (trust root required and re-verified; platform keys in the rules vocabulary; tools without provenance skipped loudly). Every hash Bazel enforces becomes a transcription from a signed, counter-protected manifest instead of trust-on-first-use
  • The primary integration ships in rules_wasm_component#606: a module extension where the project's varve.toml pin governs terminal and Bazel — live-tested against the real GHCR layer, with a corrupted-trust-root negative control refusing the build

Verify this release

cosign verify-blob \
  --certificate-identity-regexp 'https://github.com/pulseengine/varve/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle SHA256SUMS.txt.cosign.bundle SHA256SUMS.txt
varve self-verify --archive varve-v0.9.0-<triple>.tar.gz --envelope SHA256SUMS.txt.dsse.json

Cosign re-run against these published assets: Verified OK.

Assets 13
Loading