Release machinery for Downloads, the root CA, demo and site updates (#126) #154

2026-11-08T02:55:09Z

rajames commented

2026-11-08 02:55:09 +00:00

Summary

Six commits from StarForth-v4.0.0, plus an empty head commit so acceptance runs:

Release machinery (#126): scripts/nightly.sh builds the PC stick image (pc-stick.img.xz), publishes it to Nexus (classifier pc-stick), and has a new gitea-release <tag> stage. release.yml runs it after the Nexus publish, using the RELEASE_TOKEN secret. The stage creates the Gitea release (a pre-release for -alpha tags) and attaches the ISO, the three images, SHA256SUMS, the docs PDFs and the root CA certificate.
PKI (#126): ci/pki/starshipos-root-ca.pem, the StarshipOS Root CA (public; valid to 2046; issued StarshipOS Capsule Signing, which openssl verify accepts), and its SHA-256 fingerprint in ci/pki/starshipos-root-ca.sha256.
Demo (#116): CPUQuota=150% in starshipos-demo.service, as set on the server.
site/com (#146): "Read the paper" links to the SSRN abstract.
FABRIC-3: XLVIII.6 (#131 closed: QEMU's capture doubled a byte; the kernel didn't) and XLVIII.7 (Downloads, the PC stick, the Gitea release, #92 into alpha.4).

No kernel source changes.

Test plan

Acceptance (.gitea/workflows/acceptance.yml): amd64/aarch64/riscv64 boots to [zuse@Hera] ok> with PARITY:V4_POST ... fail=0 and the same dict_hash, qemu-stick-high, make -C v4 test-32
gitea-release itself is first exercised by the alpha.4 tag

🤖 Generated with Claude Code

https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

## Summary Six commits from `StarForth-v4.0.0`, plus an empty head commit so acceptance runs: - **Release machinery (#126):** `scripts/nightly.sh` builds the PC stick image (`pc-stick.img.xz`), publishes it to Nexus (classifier `pc-stick`), and has a new `gitea-release <tag>` stage. `release.yml` runs it after the Nexus publish, using the `RELEASE_TOKEN` secret. The stage creates the Gitea release (a pre-release for `-alpha` tags) and attaches the ISO, the three images, `SHA256SUMS`, the docs PDFs and the root CA certificate. - **PKI (#126):** `ci/pki/starshipos-root-ca.pem`, the StarshipOS Root CA (public; valid to 2046; issued StarshipOS Capsule Signing, which `openssl verify` accepts), and its SHA-256 fingerprint in `ci/pki/starshipos-root-ca.sha256`. - **Demo (#116):** `CPUQuota=150%` in `starshipos-demo.service`, as set on the server. - **site/com (#146):** "Read the paper" links to the SSRN abstract. - **FABRIC-3:** XLVIII.6 (#131 closed: QEMU's capture doubled a byte; the kernel didn't) and XLVIII.7 (Downloads, the PC stick, the Gitea release, #92 into alpha.4). No kernel source changes. ## Test plan - [ ] Acceptance (`.gitea/workflows/acceptance.yml`): amd64/aarch64/riscv64 boots to `[zuse@Hera] ok> ` with `PARITY:V4_POST ... fail=0` and the same `dict_hash`, `qemu-stick-high`, `make -C v4 test-32` - [ ] `gitea-release` itself is first exercised by the alpha.4 tag 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

rajames added 7 commits 2026-11-08 02:55:09 +00:00

demo: CPUQuota 150%, as set on the server (#116 ) [skip ci] 55613350c4

Since #151 an idle guest halts (1% of a core at the prompt), so the cap no
longer has to hold back spinning sessions. Captain Bob set 1.5 cores for
all sessions together on the server (2026-11-08): one busy visitor a full
core, half a core always left to the wikis and Gitea. Confirmed on the
server with a live session idle for 3 minutes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

FABRIC-3 XLVIII.6: #131 closed -- QEMU's capture doubled a byte, not our kernel [skip ci] 44264d0781

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

release: the PC stick image, and a Gitea release anyone can download from (#126 )

Build / Image RASPI (push) Successful in 3m37s

Details

Build / Image PC (push) Successful in 3m40s

Details

Build / Image MILKV (push) Successful in 3m17s

Details

Build / v4 tests (32- and 64-bit cells) (push) Successful in 9m53s

Details

d54e2fe276

- scripts/nightly.sh images builds the PC's USB stick too (make boot_image
  TARGET=PC -> pc-stick.img.xz, in SHA256SUMS); publish sends it to Nexus
  as classifier pc-stick. pc stays the ISO QEMU boots.
- scripts/nightly.sh gitea-release <tag>: the tag as a Gitea release -- a
  pre-release for -alpha.N and the like -- notes from the tag's message with
  the checksums, the images, SHA256SUMS, the documents and the StarshipOS
  Root CA's certificate attached; run again, it adds only what is missing.
  release.yml runs it after the Nexus publish, with the secret RELEASE_TOKEN.

Tested here: images builds pc-stick.img.xz (785 KB); gitea-release against
a stand-in Gitea API made a pre-release with the notes and ten files, and a
second run added nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

FABRIC-3 XLVIII.7: Downloads -- the PC stick, the Gitea release, #92 into alpha.4 [skip ci] 199720e769

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

site/com: Read the paper links to the SSRN abstract (#146 ) [skip ci] cac4e7fb50

The canvas's Home artboard had left it a placeholder, which the build
pointed at the .org. Now https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5930134
(Captain Bob, 2026-11-08), on the canvas (version 14) and on the wiki.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

pki: the StarshipOS Root CA's certificate, public, in the tree (#126 ) [skip ci] a293eab1d4

ci/pki/starshipos-root-ca.pem, made on the CI box by make-ca.sh
(2026-11-07, Ed25519, to 2046-11-07; Captain Bob), and its SHA-256
DA:A7:40:56:65:41:1A:FE:E6:08:85:3F:6E:AD:83:3A:38:30:83:E6:F0:6D:69:A6:A8:9E:92:BD:85:93:39:81
in starshipos-root-ca.sha256. Verified: self-signed, CA:TRUE, and it issued
capsules/pki/starshipos-intermediate.der (openssl verify: OK). Every
release attaches it (gitea-release), and the Downloads page shows its
fingerprint; it is also the anchor #139 would build into the kernel.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

acceptance: run the gate on this branch's head before the PR into master

Acceptance / Acceptance (pull_request) Successful in 18m12s

Details

8f1ba02b3c

The commits under this one skip CI on their own push; this one does not, so the PR
into master runs acceptance.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

rajames merged commit e695eadaf7 into master

2026-11-08 03:20:43 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: rajames/LithosAnanke#154