From 4464f1c442adf97b2b38d8d0563e00e526987025 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Tue, 1 Sep 2026 15:56:41 +0500 Subject: [PATCH] fix(version): every dev default tells the truth, and the channel classifies the bundle The released line is 0.8.0, yet an unstamped gds claimed a released 0.7.0, the controller claimed 0.4.0-dev, and development bundles were stamped 0.4.0-dev forever. All three defaults move to 0.8.0-dev: a dev build can never masquerade as a release, and a development bundle is dated to the line it came from. The bundle classifier had a sharper defect: provenance treated a lock as released unless its version equalled the CURRENT DevelopmentBundleVersion, so bumping that constant would have silently reclassified every not-yet-regenerated development lock as released and skipped its source verification. The channel field alone classifies now; an older dev version is still a development bundle and is verified as one. Goldens and the repository's own lock are regenerated at 0.8.0-dev. Claude-Session: https://claude.ai/code/session_01LsGid6U5RrQdFvJmvYdGCF --- .gds/bundle.lock.yaml | 14 +++++++------- .gds/compiled-policy.json | 4 ++-- .github/workflows/gds-ci.yml | 6 +++--- core/cli/root.go | 5 ++++- core/cmd/gds-controller/main.go | 4 +++- core/compiler/types.go | 6 +++++- core/context/provenance.go | 10 ++++++++-- .../projections/control-plane/.claude/CLAUDE.md | 4 ++-- .../control-plane/.gds/bundle.lock.yaml | 16 ++++++++-------- .../control-plane/.gds/compiled-policy.json | 4 ++-- .../control-plane/.github/workflows/gds-ci.yml | 4 ++-- tests/golden/projections/control-plane/AGENTS.md | 8 ++++---- 12 files changed, 50 insertions(+), 35 deletions(-) diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml index 135021a..9ac2cd9 100644 --- a/.gds/bundle.lock.yaml +++ b/.gds/bundle.lock.yaml @@ -2,17 +2,17 @@ schema_version: 1 bundle: - version: "0.4.0-dev" + version: "0.8.0-dev" release_sequence: 0 channel: "development" - source_tree_digest: "sha256:376e0d4a5c11a6214ad70d8ceff8c01645fcf5a71fba332e94e4c2e6061e22a4" - digest: "sha256:681dfce12bea5d4826ba0516c9a1112da41e160abe68d213c27c241e07740821" + source_tree_digest: "sha256:9a48edf219942643d572a0105d19411a87cf2da8a22078790e3f5db57e990bbf" + digest: "sha256:3386cb4b176eff463c4b242ca44b1bd68595d74974de924fe899c507e2e0fa0e" projection: - input_digest: "sha256:1de3673910b83ab471567d083633ec096f4436e0727d068f37daebbf3d6e9ff5" - output_digest: "sha256:0e9aa2aa74c34b912b8b93e21da1d759ba0552fc55174898f8517d92dc95719c" + input_digest: "sha256:f388cf565a327cf867c1afebba066a8b7200aa0a5fecdb5491d8748b4682eadc" + output_digest: "sha256:13184a113afabd879c6cb8b407877cac36a62231be399503ebbd92637a1eebae" files: - path: ".gds/compiled-policy.json" - digest: "sha256:78d09606bb4168d74bce1f50ab62b46a7ded34652c6b23af1badfd26dd060e94" + digest: "sha256:b5517ed46f67866220c2b18dbfbda4a40d99f00327611e56742a118d0ac59d0b" - path: ".github/workflows/gds-ci.yml" - digest: "sha256:28368b2b4b0e55ac288e9282739caf06b884a6297747c82104dd5a39bada3fce" + digest: "sha256:6e7399b2b2349ae7b3c43bca0aec2730371cd5dde04170028cb6a66845037fb6" diff --git a/.gds/compiled-policy.json b/.gds/compiled-policy.json index 15dd4da..7d1aab5 100644 --- a/.gds/compiled-policy.json +++ b/.gds/compiled-policy.json @@ -2,8 +2,8 @@ "schema_version": 1, "compiled_policy": { "repository_id": "repo_01M0EZ7TB3KNXNSP78Z8M64WXG", - "bundle_version": "0.4.0-dev", - "digest": "sha256:ebc9b06d74fa698cd1d612c7be8fb017cd76c93ba5882270e7b415b160ba7f2d" + "bundle_version": "0.8.0-dev", + "digest": "sha256:13fde780e078b9143e913db7cf706c8908b52c21ec51f28d26d3c9fdd715e080" }, "sources": [ { diff --git a/.github/workflows/gds-ci.yml b/.github/workflows/gds-ci.yml index 136fdaf..0e3db39 100644 --- a/.github/workflows/gds-ci.yml +++ b/.github/workflows/gds-ci.yml @@ -1,8 +1,8 @@ # GENERATED FILE - DO NOT EDIT DIRECTLY # generator: gds -# bundle: 0.4.0-dev -# source-tree-digest: sha256:376e0d4a5c11a6214ad70d8ceff8c01645fcf5a71fba332e94e4c2e6061e22a4 -# input-digest: sha256:1de3673910b83ab471567d083633ec096f4436e0727d068f37daebbf3d6e9ff5 +# bundle: 0.8.0-dev +# source-tree-digest: sha256:9a48edf219942643d572a0105d19411a87cf2da8a22078790e3f5db57e990bbf +# input-digest: sha256:f388cf565a327cf867c1afebba066a8b7200aa0a5fecdb5491d8748b4682eadc # output-digest: sha256:01fb4854784be9e4564bcc84e70786484b370879be5e5ab1dd49f8b73ea2dea4 # edit-source: # - .gds/repository.yaml diff --git a/core/cli/root.go b/core/cli/root.go index 95261c8..0d39cec 100644 --- a/core/cli/root.go +++ b/core/cli/root.go @@ -19,7 +19,10 @@ import ( "github.com/NDDev-OpenNetwork/github-device-sync/core/harness" ) -var Version = "0.7.0" +// Version is the development default; a release build overrides it with the +// exact tag via -X. It carries the -dev suffix so an unstamped binary can +// never claim to be a released one. +var Version = "0.8.0-dev" type options struct { json bool diff --git a/core/cmd/gds-controller/main.go b/core/cmd/gds-controller/main.go index e48155b..aa73e63 100644 --- a/core/cmd/gds-controller/main.go +++ b/core/cmd/gds-controller/main.go @@ -23,7 +23,9 @@ import ( "github.com/NDDev-OpenNetwork/github-device-sync/core/webhooks" ) -var version = "0.4.0-dev" +// version is the development default; the release builder stamps the exact +// tag via -X main.version. The -dev suffix keeps an unstamped binary honest. +var version = "0.8.0-dev" func main() { ctx, stop := signal.NotifyContext( diff --git a/core/compiler/types.go b/core/compiler/types.go index 0ce56f1..91c3704 100644 --- a/core/compiler/types.go +++ b/core/compiler/types.go @@ -8,7 +8,11 @@ import ( "github.com/NDDev-OpenNetwork/github-device-sync/core/domain" ) -const DevelopmentBundleVersion = "0.4.0-dev" +// DevelopmentBundleVersion stamps bundles compiled from policy sources on a +// policy-owner checkout. It tracks the current release line with a -dev +// suffix so a development bundle is dated honestly; the development channel +// field, not this string, is what classifies the bundle. +const DevelopmentBundleVersion = "0.8.0-dev" type PolicySource struct { SchemaVersion int `json:"schema_version"` diff --git a/core/context/provenance.go b/core/context/provenance.go index f531374..9659b65 100644 --- a/core/context/provenance.go +++ b/core/context/provenance.go @@ -68,8 +68,7 @@ func (prover *CanonicalPolicyProver) Verify( err, )} } - if document.Bundle.Channel != "development" || - document.Bundle.Version != compiler.DevelopmentBundleVersion { + if document.Bundle.Channel != "development" { // Released candidates can only be produced from an archive that passed // full envelope, manifest and member verification. The committed lock // retains that artifact/content/attestation identity and the exact @@ -77,6 +76,13 @@ func (prover *CanonicalPolicyProver) Verify( // in every consumer repository. return nil } + // The channel alone classifies the bundle. This used to also require the + // version to equal the current DevelopmentBundleVersion, which meant that + // bumping that constant silently reclassified every not-yet-regenerated + // development lock as released and skipped its source verification — the + // opposite of what a version bump should do. A development bundle carrying + // an older dev version is still a development bundle and is verified as + // one. if estateRoot == "" { return []domain.Finding{policyProvenanceFinding( "GDS_CONTEXT_POLICY_ESTATE_NOT_PROVEN", diff --git a/tests/golden/projections/control-plane/.claude/CLAUDE.md b/tests/golden/projections/control-plane/.claude/CLAUDE.md index 75cf770..ab48e3c 100644 --- a/tests/golden/projections/control-plane/.claude/CLAUDE.md +++ b/tests/golden/projections/control-plane/.claude/CLAUDE.md @@ -1,9 +1,9 @@