7 Commits

Include renames

Author	SHA1	Message	Date
mokhtar	22abcd9b7b	release: nix flake with tag-pinned hashes, reproducible tarballs (milestone 40) ... flake.nix fetches the release tarballs and carries their SRI hashes in a generated block. The cut tool builds the release locally with the toolchain gates.yml pins, in a normalized nine-variable environment, writes the hashes into flake.nix, and commits it with build.zig.zon as the single bump commit. The package job verifies the pins on the bump commit and the publish job verifies them again on the tag, before anything is uploaded. The tarballs are written by dist_stage (std.tar.Writer, flate gzip) instead of the runner's tar and gzip, and -ffile-prefix-map keeps checkout paths out of the C objects; two checkouts at different absolute paths produce byte-identical archives. nxdns version, /api/version and the admin footer report the version only: the bump commit cannot know its own sha.	2026-09-08 21:45:22 +02:00
mokhtar	1e97c80f6b	rename web/ to admin/, along with the web-named build and cli identifiers	2026-08-16 00:17:58 +02:00
mokhtar	1a82b0491a	release: name the image by the public registry host, not the internal server url	2026-08-08 21:14:37 +02:00
mokhtar	d7f63b9f6e	release: move publication orchestration into tools/release.zig, pin rotated subkey	2026-08-08 20:22:04 +02:00
mokhtar	fbd70e6a70	release: refetch the annotated tag object that checkout replaces	2026-08-08 16:03:04 +02:00
mokhtar	75038b61a6	release: pin the artifact-signing subkey fingerprint	2026-08-08 14:44:07 +02:00
mokhtar	cdacc560b7	milestone 14: build, package, sign and publish releases	2026-08-08 12:38:29 +02:00