|
|
|
@@ -207,10 +207,10 @@ Two builds of the same commit produce byte-identical tarballs, and CI proves it
|
|
|
|
|
|
|
|
|
|
## Publishing the train
|
|
|
|
|
|
|
|
|
|
The registry is the Gitea npm registry under the `River_of_Glory_Church` owner:
|
|
|
|
|
The registry is the Gitea npm registry under the `Zayin` owner:
|
|
|
|
|
|
|
|
|
|
```text
|
|
|
|
|
https://git.riverofglorymn.org/api/packages/River_of_Glory_Church/npm/
|
|
|
|
|
https://git.zayin.net/api/packages/Zayin/npm/
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
| Who | May |
|
|
|
|
@@ -272,7 +272,7 @@ Evidence that one train was published, not a second package catalog, and never a
|
|
|
|
|
{
|
|
|
|
|
"publicationRecord": 1,
|
|
|
|
|
"packageTrain": { "version": "0.2.0", "revision": "<commit>", "manifestSha256": "<hex>" },
|
|
|
|
|
"registry": "https://git.riverofglorymn.org/api/packages/River_of_Glory_Church/npm/",
|
|
|
|
|
"registry": "https://git.zayin.net/api/packages/Zayin/npm/",
|
|
|
|
|
"finalTag": "latest",
|
|
|
|
|
"completedAt": "<ISO time>",
|
|
|
|
|
"packages": [
|
|
|
|
@@ -297,7 +297,7 @@ Evidence that one train was published, not a second package catalog, and never a
|
|
|
|
|
|
|
|
|
|
- **One credential:** `EKKLESIA_PACKAGES_PUBLISH_TOKEN`, a repository Actions secret, used only by
|
|
|
|
|
the publish step. Nobody needs a token to read or install.
|
|
|
|
|
- **The publisher** is a dedicated account, member only of a `River_of_Glory_Church` team whose one
|
|
|
|
|
- **The publisher** is a dedicated account, member only of a `Zayin` team whose one
|
|
|
|
|
permission is Packages: Write. Its token has only the `write:package` scope. Gitea's
|
|
|
|
|
`write:package` also allows deleting packages; the tool never does, and nothing else uses the
|
|
|
|
|
token.
|
|
|
|
@@ -319,7 +319,7 @@ guarantee:
|
|
|
|
|
- **A published version is never deleted,** by anyone, for any reason short of a security incident.
|
|
|
|
|
- **A version number is never reused with other bytes.** A version found on the registry with other
|
|
|
|
|
bytes is burned: investigate how it got there, and publish the train under a new version.
|
|
|
|
|
- **No package cleanup rule** may be configured for the `River_of_Glory_Church` owner.
|
|
|
|
|
- **No package cleanup rule** may be configured for the `Zayin` owner.
|
|
|
|
|
- **The publisher never deletes.** The tool has no delete, unpublish, or overwrite, and its tests
|
|
|
|
|
check that.
|
|
|
|
|
|
|
|
|
@@ -359,7 +359,7 @@ claim to be source that 0.1.2 never contained.
|
|
|
|
|
Before it, an administrator of the Gitea instance:
|
|
|
|
|
|
|
|
|
|
1. creates the dedicated publisher account;
|
|
|
|
|
2. creates a `River_of_Glory_Church` team, for example `package-publishers`, with only the Packages
|
|
|
|
|
2. creates a `Zayin` team, for example `package-publishers`, with only the Packages
|
|
|
|
|
unit at Write, and adds the account to it;
|
|
|
|
|
3. creates a token for the account with only `write:package`, and stores it as the repository
|
|
|
|
|
Actions secret `EKKLESIA_PACKAGES_PUBLISH_TOKEN`;
|
|
|
|
|