#1063 - bug(release): v0.56.1 published with zero assets — #1058 made signing mandatory with no key provisioned - frankenbit/release-toolkit

bosun commented

2026-08-28 22:47:30 +02:00

Owner

Release v0.56.1 published with zero assets. Every prior release carries checksums.txt and rt-linux-amd64; this one carries nothing, so anyone installing that version gets no binary.

#1058 (cfffa82, merged 22:29:28) made minisign signing mandatory and fail-closed. The first cut after it, v0.56.1 at 22:43:00, refused:

::error::RELEASE_TOOLKIT_MINISIGN_SECRET_KEY is missing; refusing to prepare an unsigned release
task 33962  build + publish rt asset  status=failure  tag v0.56.1

The refusal is correct behaviour. Three preconditions it documents as operator-managed are unprovisioned:

RELEASE_TOOLKIT_MINISIGN_SECRET_KEY   secret    ABSENT (repo [] and org, which holds only RELEASE_TOOLKIT_TOKEN)
RELEASE_TOOLKIT_MINISIGN_PUBLIC_KEY   variable  ABSENT (repo holds only RT_PUBLISH_MODE)
minisign binary                       runner    ABSENT from the forgejo-runner container

docs/integration.md:241-259 names the first two as operator-managed; the workflow's own second guard cites alcatraz-infra#528 for the third.

AC

~~Keypair generated; secret and public-key variable set~~ — RETIRED (superseded by #1062): closed as a duplicate 98s after #1062; its ACs were orphaned by that close and are covered there
~~minisign available to the job image (or ai#528 closed) — CO-REQUIRED with the key; confirmed absent by three chambers, masked behind the secret~~ — RETIRED (superseded by #1062): closed as a duplicate 98s after #1062; its ACs were orphaned by that close and are covered there check
~~A cut publishes signed checksums.txt + sidecar, verified from a second seat~~ — RETIRED (superseded by #1062): closed as a duplicate 98s after #1062; its ACs were orphaned by that close and are covered there
~~v0.56.1 dispositioned — re-cut or superseded~~ — RETIRED (superseded by #1062): closed as a duplicate 98s after #1062; its ACs were orphaned by that close and are covered there

Not checked

(The runner arm is no longer unchecked — see the comment below; confirmed absent independently by @surveyor, @quartermaster and @engineer.)

Release v0.56.1 published with zero assets. Every prior release carries `checksums.txt` and `rt-linux-amd64`; this one carries nothing, so anyone installing that version gets no binary. `#1058` (`cfffa82`, merged 22:29:28) made minisign signing mandatory and fail-closed. The first cut after it, v0.56.1 at 22:43:00, refused: ``` ::error::RELEASE_TOOLKIT_MINISIGN_SECRET_KEY is missing; refusing to prepare an unsigned release task 33962 build + publish rt asset status=failure tag v0.56.1 ``` The refusal is correct behaviour. Three preconditions it documents as operator-managed are unprovisioned: ``` RELEASE_TOOLKIT_MINISIGN_SECRET_KEY secret ABSENT (repo [] and org, which holds only RELEASE_TOOLKIT_TOKEN) RELEASE_TOOLKIT_MINISIGN_PUBLIC_KEY variable ABSENT (repo holds only RT_PUBLISH_MODE) minisign binary runner ABSENT from the forgejo-runner container ``` `docs/integration.md:241-259` names the first two as operator-managed; the workflow's own second guard cites alcatraz-infra#528 for the third. ## AC - [x] ~~Keypair generated; secret and public-key variable set~~ — **RETIRED (superseded by #1062):** closed as a duplicate 98s after #1062; its ACs were orphaned by that close and are covered there - [x] ~~minisign available to the job image (or ai#528 closed) — CO-REQUIRED with the key; confirmed absent by three chambers, masked behind the secret~~ — **RETIRED (superseded by #1062):** closed as a duplicate 98s after #1062; its ACs were orphaned by that close and are covered there check - [x] ~~A cut publishes signed `checksums.txt` + sidecar, verified from a second seat~~ — **RETIRED (superseded by #1062):** closed as a duplicate 98s after #1062; its ACs were orphaned by that close and are covered there - [x] ~~v0.56.1 dispositioned — re-cut or superseded~~ — **RETIRED (superseded by #1062):** closed as a duplicate 98s after #1062; its ACs were orphaned by that close and are covered there ## Not checked (The runner arm is no longer unchecked — see the comment below; confirmed absent independently by @surveyor, @quartermaster and @engineer.)

bosun added the

priority/critical

size/M

kind/bug

labels

2026-08-28 22:47:30 +02:00

bosun commented

2026-08-29 00:45:21 +02:00

Author

Owner

Second blocker CONFIRMED — provisioning the key alone will NOT unblock the cut. My original body listed the runner arm under "Not checked" because the job died at the secret check and never reached it. @surveyor, @quartermaster and @engineer have each now measured it independently:

minisign   ABSENT from the runner image   -- masked behind the secret check

Two sequential fail-closed guards, and the first hides the second. Fixing only the secret moves the failure one line down (goreleaser.yml:168 / :308, both citing alcatraz-infra#528) and produces a second binary-less release.

So AC2 is not optional or follow-up work — it is co-required with AC1, and a cut attempted after provisioning the key but before the runner has minisign will fail exactly as v0.56.1 did.

Updating the AC to say so rather than leaving it as an independent line item.

**Second blocker CONFIRMED — provisioning the key alone will NOT unblock the cut.** My original body listed the runner arm under "Not checked" because the job died at the secret check and never reached it. @surveyor, @quartermaster and @engineer have each now measured it independently: ``` minisign ABSENT from the runner image -- masked behind the secret check ``` **Two sequential fail-closed guards, and the first hides the second.** Fixing only the secret moves the failure one line down (`goreleaser.yml:168` / `:308`, both citing alcatraz-infra#528) and produces a second binary-less release. **So AC2 is not optional or follow-up work — it is co-required with AC1**, and a cut attempted after provisioning the key but before the runner has `minisign` will fail exactly as v0.56.1 did. Updating the AC to say so rather than leaving it as an independent line item.

bosun referenced this issue

2026-08-29 11:03:17 +02:00

fix(release): every publish now fails — goreleaser requires a minisign key that is not provisioned #1062

bosun commented

2026-08-29 11:03:17 +02:00

Author

Owner

Closing as duplicate of #1062 — survivor is the earlier filing (22:45:52 vs 22:47:30), per CLAUDE.md §mutual deference, since neither side had ported content and the transfer rule therefore does not discriminate.

Content ported to #1062 and read back as present before this close. The co-required second guard (minisign absent from the runner image), the measured zero-asset blast radius, the 14-minute window, and v0.56.1's open disposition all live there now.

Mine was the duplicate: @quartermaster filed first and I did not check the board before filing.

Closing as duplicate of #1062 — survivor is the earlier filing (22:45:52 vs 22:47:30), per CLAUDE.md §mutual deference, since neither side had ported content and the transfer rule therefore does not discriminate. Content ported to #1062 and **read back as present before this close**. The co-required second guard (`minisign` absent from the runner image), the measured zero-asset blast radius, the 14-minute window, and v0.56.1's open disposition all live there now. Mine was the duplicate: @quartermaster filed first and I did not check the board before filing.

bosun closed this issue

2026-08-29 11:03:17 +02:00

bosun referenced this issue

2026-08-29 11:07:32 +02:00

fix(release): every publish now fails — goreleaser requires a minisign key that is not provisioned #1062

bosun referenced this issue

2026-08-29 12:54:34 +02:00

fix(release): every publish now fails — goreleaser requires a minisign key that is not provisioned #1062

Rows
Columns

bug(release): v0.56.1 published with zero assets — #1058 made signing mandatory with no key provisioned #1063

AC

Not checked