Skip to content

fix(release): make manifest media types deterministic - #608

Merged
ryan-wong-coder merged 1 commit into
mainfrom
fix/release-media-types
Jul 26, 2026
Merged

fix(release): make manifest media types deterministic#608
ryan-wong-coder merged 1 commit into
mainfrom
fix/release-media-types

Conversation

@ryan-wong-coder

Copy link
Copy Markdown
Collaborator

Summary

  • replace host MIME database lookups with deterministic release media-type mappings
  • preserve strict kind/media-type validation for offline bundles
  • add table-driven coverage for every release artifact extension

Validation

  • go vet ./internal/supplychain ./cmd/trustdb
  • go test -count=1 -mod=readonly ./...
  • go test -race -count=1 -mod=readonly ./internal/supplychain ./cmd/trustdb
  • Linux/amd64 and Windows/amd64 cross-compilation of the supply-chain test binary
  • patched CLI successfully verifies the independently downloaded v2.0.0-rc.1 bundle, including SHA-256 and SM3

Fixes #607

@ryan-wong-coder
ryan-wong-coder merged commit 59596cc into main Jul 26, 2026
17 checks passed
@ryan-wong-coder
ryan-wong-coder deleted the fix/release-media-types branch July 26, 2026 06:16
ryan-wong-coder added a commit that referenced this pull request Jul 26, 2026
## Summary
- disclose the RC.1 host-MIME verifier limitation on the website and
both READMEs
- keep the release immutable and direct users to the deterministic fix
in #608
- clarify the cross-platform verifier admission boundary in the
bilingual supply-chain guide

## Validation
- `git diff --check`
- `cd website && npm ci && npm run build`

Refs #605
Refs #607
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fix cross-platform release manifest media type validation

1 participant