Skip to content

SPORE v0.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Jul 13:28
v0.3.0
ba9ab78
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Tagged V0.3.0 at 27bea16. Release plumbing only — no Rust behaviour changed, wire
untouched. Both entries are the same finding recurring: a fix verified on the artefact
it was written for and assumed on its neighbour.

Fixed

  • S-029 The S-026 fix was racy and destroyed the release it repaired. Deleting a
    tag with --cleanup-tag and recreating it a second later left
    nightly-2026.07.27 as a live tag with no release attached, on a job that
    reported success at every step. Both release steps now clear the existing
    assets and upload over them, never touching the tag or the release. Accumulation
    is still prevented; the cost is that published_at lags again, which the release
    name and body make up for.
  • Nightly releases accumulated assets — the fix for rolling (S-021) was not
    applied to the dated nightly beside it, and the versioned filename now embeds a
    minute and a commit sha, so a second merge the same day added a pair rather than
    replacing one. 2026-07-27 ended up holding four assets with nothing marking the
    current one, and its published_at sat an hour behind its contents. Today's
    nightly is now replaced per build, like rolling (S-026).
  • The tag glob was case-sensitive. tags: ['v*'] silently ignored V0.1.0 and
    V0.2.0: GitHub created releases for both and no build ever ran, leaving a
    non-prerelease "latest" holding zero assets — so
    releases/latest/download/spore-android.apk, the link docs/APPS.md promises,
    404s from a page that looks like a real release. Worse than having no release at
    all. Now ['v*', 'V*'], and the tagged path fails loudly if the tag's
    major.minor disagrees with Cargo.toml — V0.2.0 was cut while Cargo.toml
    still said 0.1.0, and nothing complained.

Cutting this release also exercised the guard added in it. V0.3.0 was tagged while
Cargo.toml still said 0.2.0, and the build refused: "tag V0.3.0 is 0.3.x but
Cargo.toml says 0.2.0". That is the drift S-025 was about, caught before it produced
another release nobody could download — bump first, then tag.

⬇ spore-android.apk
— a permanent link that always serves the newest stable release.

This number versions the distribution, not the protocol. The SPORE v1
wire format and the crate's API shape are frozen and unaffected by it.

Before you rely on it: no radio bridge has been verified against real
hardware (every 🧪 in
BRIDGES.md),
and the Still open section of
SECURITY_FINDINGS.md lists
what is known and unfixed. Builds are debug-signed until a release keystore
is configured, so Android will warn about an unknown developer.
SHA-256 ffa05ee1a43211f824acf5e08a2fdf5f30bc9494b60665780ba667a95e45ed23

Assets 6
Loading