From a06767ead77c23b02d52495484fddb0700348f99 Mon Sep 17 00:00:00 2001
From: Ant Somers <antsomers@gmail.com>
Date: Mon, 19 Oct 2026 20:18:13 +0300
Subject: [PATCH] chore: pin decdn to v0.2.0

Move the decdn/decdn pin from the line 0.1 (v0.1.0) to v0.2.0
(5c830ea2dae90c99410097192b558b3ac970ccc4): the role default, the onramp's installer line, the chart's
appVersion and Artifact Hub image, AGENTS.md's pinned line, and what names one
release (Compose, the examples, the generated mirrors). The PR body lists anything left.
---
 AGENTS.md                                                   | 2 +-
 ansible/inventory/group_vars/sponsord_onramp_hosts.yml      | 2 +-
 ansible/inventory/host_vars/decdn-node-1/main.yml           | 4 ++--
 ansible/inventory/host_vars/origin-1/main.yml               | 4 ++--
 ansible/roles/decdn_node/defaults/main.yml                  | 2 +-
 ansible/roles/decdn_node/vars/main/networks.yml             | 2 +-
 ansible/roles/sponsord/vars/main/networks.yml               | 2 +-
 ansible/roles/sponsord_onramp/defaults/main.yml             | 2 +-
 ansible/roles/sponsord_onramp/vars/main/networks.yml        | 2 +-
 charts/decdn-node/Chart.yaml                                | 4 ++--
 charts/decdn-node/values.yaml                               | 4 ++--
 cloud-init/user-data-publisher.yaml                         | 2 +-
 compose/.env.example                                        | 4 ++--
 compose/sponsord-onramp.env.example                         | 6 +++---
 .../inventory/group_vars/sponsord_onramp_hosts.yml          | 2 +-
 .../inventory/host_vars/decdn-node-1/main.yml               | 4 ++--
 .../collection-fleet/inventory/host_vars/origin-1/main.yml  | 4 ++--
 17 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 843abeae..6754f4a6 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -142,7 +142,7 @@ test-scripts` fails while the committed file differs from a fresh render, and `m
 lint-alloy` validates and runs it.
 
 **Pinned upstream releases.** One decdn/decdn release line (`decdn_node_version`, today
-`0.1`) and one decdn/sponsord release line (`sponsord_version` = `sponsord_onramp_version`,
+`0.2`) and one decdn/sponsord release line (`sponsord_version` = `sponsord_onramp_version`,
 today `0.1`; decdn/sponsord tags its whole workspace `vX.Y.Z`, there are no per-crate
 tags) are pinned across every path. A line, `X.Y`, is what the role defaults, the
 onramp's installer pin (`sponsord_onramp_decdn_release`, `vX.Y`) and the chart's
diff --git a/ansible/inventory/group_vars/sponsord_onramp_hosts.yml b/ansible/inventory/group_vars/sponsord_onramp_hosts.yml
index 7b1d476c..8ab8a898 100644
--- a/ansible/inventory/group_vars/sponsord_onramp_hosts.yml
+++ b/ansible/inventory/group_vars/sponsord_onramp_hosts.yml
@@ -36,6 +36,6 @@
 # role's sponsord_onramp_decdn_release line (decdn/decdn, the decdn_node role's default
 # line; a host's decdn_node_version does not move it), with the SHA-256 of its
 # verified SHA256SUMS, on each deploy. To serve one exact release, set its tag and digest:
-# sponsord_onramp_decdn_release: v0.1.0
+# sponsord_onramp_decdn_release: v0.2.0
 # sponsord_onramp_decdn_sums_sha256: "…"
 # CapacityBond and SlashJudge come from sponsord_network (group_vars/sponsord_hosts.yml).
diff --git a/ansible/inventory/host_vars/decdn-node-1/main.yml b/ansible/inventory/host_vars/decdn-node-1/main.yml
index 4ec52092..fd155bc6 100644
--- a/ansible/inventory/host_vars/decdn-node-1/main.yml
+++ b/ansible/inventory/host_vars/decdn-node-1/main.yml
@@ -24,13 +24,13 @@
 # line the role pins ("X.Y": its newest release, installed by each deploy); set an
 # exact one only to hold a node on it.
 decdn_node_install_method: release
-# decdn_node_version: "0.1.0"
+# decdn_node_version: "0.2.0"
 #
 # Alternative: build on the node from a git ref (any tag, branch or SHA), as an
 # unprivileged build user with a pinned toolchain (decdn_node_version is not checked
 # in this mode):
 #     decdn_node_install_method: source
-#     decdn_node_source_ref: v0.1.0
+#     decdn_node_source_ref: v0.2.0
 # Alternative: copy binaries built on this control machine
 # (`cargo build --release -p decdn-node -p decdn-cli` in a decdn/decdn checkout):
 #     decdn_node_install_method: manual
diff --git a/ansible/inventory/host_vars/origin-1/main.yml b/ansible/inventory/host_vars/origin-1/main.yml
index 1b0b93e1..0fe88bd8 100644
--- a/ansible/inventory/host_vars/origin-1/main.yml
+++ b/ansible/inventory/host_vars/origin-1/main.yml
@@ -26,13 +26,13 @@
 # line the role pins ("X.Y": its newest release, installed by each deploy); set an
 # exact one only to hold a node on it.
 decdn_node_install_method: release
-# decdn_node_version: "0.1.0"
+# decdn_node_version: "0.2.0"
 #
 # Alternative: build on the node from a git ref (any tag, branch or SHA), as an
 # unprivileged build user with a pinned toolchain (decdn_node_version is not checked
 # in this mode):
 #     decdn_node_install_method: source
-#     decdn_node_source_ref: v0.1.0
+#     decdn_node_source_ref: v0.2.0
 # Alternative: copy binaries built on this control machine
 # (`cargo build --release -p decdn-node -p decdn-cli` in a decdn/decdn checkout):
 #     decdn_node_install_method: manual
diff --git a/ansible/roles/decdn_node/defaults/main.yml b/ansible/roles/decdn_node/defaults/main.yml
index 14cfa96e..b46fecb5 100644
--- a/ansible/roles/decdn_node/defaults/main.yml
+++ b/ansible/roles/decdn_node/defaults/main.yml
@@ -64,7 +64,7 @@ decdn_rustup_sha256:
 # default is the line this repo is synced against; a new line also moves the
 # generated mirrors, the onramp's decdn pin and the chart's appVersion (README.md,
 # "Bumping the decdn release").
-decdn_node_version: "0.1"
+decdn_node_version: "0.2"
 # Release target triple. Derived from the host's gathered architecture (x86_64 or
 # aarch64, see vars/main/arch.yml), so arm64 hosts (Graviton, Ampere, Hetzner CAX)
 # get the aarch64 tarball with no inventory change. Needs facts: a play with
diff --git a/ansible/roles/decdn_node/vars/main/networks.yml b/ansible/roles/decdn_node/vars/main/networks.yml
index 49a770ab..e968723a 100644
--- a/ansible/roles/decdn_node/vars/main/networks.yml
+++ b/ansible/roles/decdn_node/vars/main/networks.yml
@@ -1,6 +1,6 @@
 ---
 # GENERATED by scripts/sync-network-profiles.py -- do not hand-edit.
-# Source: decdn/decdn @ 538bf319631cb37854819e43998e4a73da06fd5c
+# Source: decdn/decdn @ 5c830ea2dae90c99410097192b558b3ac970ccc4
 #   crates/cli/src/known_chains.rs (KNOWN_CHAINS, KnownChain::addresses)
 #   + contracts/deployments/<chainId>.json
 #
diff --git a/ansible/roles/sponsord/vars/main/networks.yml b/ansible/roles/sponsord/vars/main/networks.yml
index b0a04057..770e4d70 100644
--- a/ansible/roles/sponsord/vars/main/networks.yml
+++ b/ansible/roles/sponsord/vars/main/networks.yml
@@ -1,6 +1,6 @@
 ---
 # GENERATED by scripts/sync-network-profiles.py -- do not hand-edit.
-# Source: decdn/decdn @ 538bf319631cb37854819e43998e4a73da06fd5c
+# Source: decdn/decdn @ 5c830ea2dae90c99410097192b558b3ac970ccc4
 #   crates/cli/src/known_chains.rs (KNOWN_CHAINS, KnownChain::addresses)
 #   + contracts/deployments/<chainId>.json
 #
diff --git a/ansible/roles/sponsord_onramp/defaults/main.yml b/ansible/roles/sponsord_onramp/defaults/main.yml
index d47dc8be..bbd89a3e 100644
--- a/ansible/roles/sponsord_onramp/defaults/main.yml
+++ b/ansible/roles/sponsord_onramp/defaults/main.yml
@@ -146,7 +146,7 @@ sponsord_onramp_gate_template_src: ""
 # verified against sponsord_onramp_decdn_keyring first. An exact tag, "vX.Y.Z",
 # needs that digest set beside it (`sha256sum SHA256SUMS` after verifying its .asc);
 # preflight refuses a tag without one and a line with one.
-sponsord_onramp_decdn_release: v0.1       # decdn/decdn line or tag
+sponsord_onramp_decdn_release: v0.2       # decdn/decdn line or tag
 sponsord_onramp_decdn_sums_sha256: ""     # with a tag only
 sponsord_onramp_decdn_release_index: "https://api.github.com/repos/decdn/decdn/releases?per_page=100"
 # Where the role reads a line's SHA256SUMS: the installers' own download location
diff --git a/ansible/roles/sponsord_onramp/vars/main/networks.yml b/ansible/roles/sponsord_onramp/vars/main/networks.yml
index 63f107b2..9a228c79 100644
--- a/ansible/roles/sponsord_onramp/vars/main/networks.yml
+++ b/ansible/roles/sponsord_onramp/vars/main/networks.yml
@@ -1,6 +1,6 @@
 ---
 # GENERATED by scripts/sync-network-profiles.py -- do not hand-edit.
-# Source: decdn/decdn @ 538bf319631cb37854819e43998e4a73da06fd5c
+# Source: decdn/decdn @ 5c830ea2dae90c99410097192b558b3ac970ccc4
 #   crates/cli/src/known_chains.rs (KNOWN_CHAINS, KnownChain::addresses)
 #   + contracts/deployments/<chainId>.json
 #
diff --git a/charts/decdn-node/Chart.yaml b/charts/decdn-node/Chart.yaml
index 634540d6..8a953787 100644
--- a/charts/decdn-node/Chart.yaml
+++ b/charts/decdn-node/Chart.yaml
@@ -15,7 +15,7 @@ version: 0.2.0
 # restarted pod runs the newest). Keep it equal to the decdn_node role's
 # decdn_node_version, and the tag of the one image in the artifacthub.io/images
 # annotation below (make test-scripts checks both).
-appVersion: "0.1"
+appVersion: "0.2"
 kubeVersion: ">=1.25.0-0"
 home: https://decdn.org
 icon: https://decdn.org/icon.svg
@@ -39,7 +39,7 @@ annotations:
   artifacthub.io/license: MIT
   artifacthub.io/images: |
     - name: decdn-node
-      image: ghcr.io/decdn/decdn-node:0.1
+      image: ghcr.io/decdn/decdn-node:0.2
   artifacthub.io/links: |
     - name: Chart source
       url: https://github.com/decdn/devops/tree/main/charts/decdn-node
diff --git a/charts/decdn-node/values.yaml b/charts/decdn-node/values.yaml
index c4ff8f7a..f3f2036c 100644
--- a/charts/decdn-node/values.yaml
+++ b/charts/decdn-node/values.yaml
@@ -14,8 +14,8 @@ image:
   tag: ""
   # sha256:... — takes precedence over tag when set. Prefer it: a tag can be moved.
   # Take it from the release's signed decdn-node-image-digest.txt (v0.0.1:
-  # image-digest.txt), e.g. for v0.1.0
-  # sha256:848532722735b4a115aca9606230d951c25f2dab06a7345305ecf67c7a0244b5
+  # image-digest.txt), e.g. for v0.2.0
+  # sha256:03a9f2e1167db31bb9a95af0b6672916300f86191a41db75db4c568c94899e60
   digest: ""
   # "" picks Always for a release-line tag (X.Y, the default), so a restarted pod
   # pulls the newest release in it rather than whatever the node cached first, and
diff --git a/cloud-init/user-data-publisher.yaml b/cloud-init/user-data-publisher.yaml
index a8b68767..999c0232 100644
--- a/cloud-init/user-data-publisher.yaml
+++ b/cloud-init/user-data-publisher.yaml
@@ -143,7 +143,7 @@ write_files:
           # the digest read from it. To serve one exact release, set its tag with the
           # SHA-256 of its SHA256SUMS (`sha256sum SHA256SUMS` once its SHA256SUMS.asc
           # verifies), e.g.:
-          # sponsord_onramp_decdn_release: "v0.1.0"
+          # sponsord_onramp_decdn_release: "v0.2.0"
           # sponsord_onramp_decdn_sums_sha256: "<64 lowercase hex>"
 
   # What an interactive login prints while the bootstrap is unfinished. It is written
diff --git a/compose/.env.example b/compose/.env.example
index 0cbea2ff..0739c944 100644
--- a/compose/.env.example
+++ b/compose/.env.example
@@ -29,8 +29,8 @@ COMPOSE_PROFILES=node
 # Compose names one release of it (README.md, the node's "Operate").
 
 # --- node -----------------------------------------------------------------------
-# decdn/decdn v0.1.0
-DECDN_IMAGE_DIGEST=sha256:848532722735b4a115aca9606230d951c25f2dab06a7345305ecf67c7a0244b5
+# decdn/decdn v0.2.0
+DECDN_IMAGE_DIGEST=sha256:03a9f2e1167db31bb9a95af0b6672916300f86191a41db75db4c568c94899e60
 # DECDN_IMAGE_REPO=ghcr.io/decdn/decdn-node
 
 # uid/gid of the host's dedicated `decdn` system account, which owns /var/lib/decdn
diff --git a/compose/sponsord-onramp.env.example b/compose/sponsord-onramp.env.example
index 8145d66a..9b288fa6 100644
--- a/compose/sponsord-onramp.env.example
+++ b/compose/sponsord-onramp.env.example
@@ -22,9 +22,9 @@ ONRAMP_TURNSTILE_SITEKEY=
 # SHA-256 of that release's SHA256SUMS file (`sha256sum SHA256SUMS` once its .asc
 # verifies). The Ansible role serves the newest release of its decdn line; Compose
 # has no resolver, so this names one, the newest when this file last moved:
-# decdn/decdn v0.1.0.
-ONRAMP_DECDN_RELEASE=v0.1.0
-ONRAMP_DECDN_SUMS_SHA256=c88ad5479f31bb0857db2c0205c54b240cbceb33a96724e4f8a288b6d866ab66
+# decdn/decdn v0.2.0.
+ONRAMP_DECDN_RELEASE=v0.2.0
+ONRAMP_DECDN_SUMS_SHA256=f4f0a16f1a3896c729bba21ece023f00cae89bea51369047fa7a03f6c7f088d4
 
 # --- Client address ---------------------------------------------------------------
 # The header the proxy puts the client address in; the onramp rate limits by it.
diff --git a/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml b/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
index 7b1d476c..8ab8a898 100644
--- a/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
+++ b/examples/collection-fleet/inventory/group_vars/sponsord_onramp_hosts.yml
@@ -36,6 +36,6 @@
 # role's sponsord_onramp_decdn_release line (decdn/decdn, the decdn_node role's default
 # line; a host's decdn_node_version does not move it), with the SHA-256 of its
 # verified SHA256SUMS, on each deploy. To serve one exact release, set its tag and digest:
-# sponsord_onramp_decdn_release: v0.1.0
+# sponsord_onramp_decdn_release: v0.2.0
 # sponsord_onramp_decdn_sums_sha256: "…"
 # CapacityBond and SlashJudge come from sponsord_network (group_vars/sponsord_hosts.yml).
diff --git a/examples/collection-fleet/inventory/host_vars/decdn-node-1/main.yml b/examples/collection-fleet/inventory/host_vars/decdn-node-1/main.yml
index 4ec52092..fd155bc6 100644
--- a/examples/collection-fleet/inventory/host_vars/decdn-node-1/main.yml
+++ b/examples/collection-fleet/inventory/host_vars/decdn-node-1/main.yml
@@ -24,13 +24,13 @@
 # line the role pins ("X.Y": its newest release, installed by each deploy); set an
 # exact one only to hold a node on it.
 decdn_node_install_method: release
-# decdn_node_version: "0.1.0"
+# decdn_node_version: "0.2.0"
 #
 # Alternative: build on the node from a git ref (any tag, branch or SHA), as an
 # unprivileged build user with a pinned toolchain (decdn_node_version is not checked
 # in this mode):
 #     decdn_node_install_method: source
-#     decdn_node_source_ref: v0.1.0
+#     decdn_node_source_ref: v0.2.0
 # Alternative: copy binaries built on this control machine
 # (`cargo build --release -p decdn-node -p decdn-cli` in a decdn/decdn checkout):
 #     decdn_node_install_method: manual
diff --git a/examples/collection-fleet/inventory/host_vars/origin-1/main.yml b/examples/collection-fleet/inventory/host_vars/origin-1/main.yml
index 1b0b93e1..0fe88bd8 100644
--- a/examples/collection-fleet/inventory/host_vars/origin-1/main.yml
+++ b/examples/collection-fleet/inventory/host_vars/origin-1/main.yml
@@ -26,13 +26,13 @@
 # line the role pins ("X.Y": its newest release, installed by each deploy); set an
 # exact one only to hold a node on it.
 decdn_node_install_method: release
-# decdn_node_version: "0.1.0"
+# decdn_node_version: "0.2.0"
 #
 # Alternative: build on the node from a git ref (any tag, branch or SHA), as an
 # unprivileged build user with a pinned toolchain (decdn_node_version is not checked
 # in this mode):
 #     decdn_node_install_method: source
-#     decdn_node_source_ref: v0.1.0
+#     decdn_node_source_ref: v0.2.0
 # Alternative: copy binaries built on this control machine
 # (`cargo build --release -p decdn-node -p decdn-cli` in a decdn/decdn checkout):
 #     decdn_node_install_method: manual