WIP: Migrate Platform public sources to git.caution.co

vincent commented

2026-10-15 12:02:53 +00:00

Owner

Move Platform’s active public Caution fetches and emitted source URLs to git.caution.co/public while retaining migration-only runtime pins. The final signed revision is 85e6300a99e5efb0badde6b74793746bb101e1a8.

Exact consumed revisions

Dependency	Platform pin	Current prerequisite branch head
STEVE #16	`6431612db09899314c7c30bc7ca0b1c54f7bc3c0`	`d80a9a3573b6e94e57e3cbbf00745946e8f09e62`
Locksmith #18	`eee2a8a3673c92b668b0a82d0da2e06c131df6e2`	`b9100df30490f5a3983705e36a277c82860c0207`
Widget #5	`7d60e623b4d1c151590d8d5dd925f88dc627e01e`	same

STEVE’s signed retention merge has the same tree as 5d30ca7 and preserves 6431612 as a parent; Platform does not adopt its newer main-based tree. The widget replacement has the identical tree to previously validated 900474a. Locksmith’s branch restores its historical Codeberg transport alias while Platform keeps its validated ancestor pin. Fresh canonical clone/checkouts and exact archives pass for all consumed revisions.

Behavior and compatibility

Update direct dependency sources, builder defaults, discovery/build-input URLs, documentation, UI references and fixtures. Verified issue links now use the canonical tracker, including Locksmith comment #issuecomment-175. Forge contributions require an account.

Cargo retries use command-scoped GitHub transport aliases for canonical and historical Codeberg sources. New Platform/EnclaveOS archives try the canonical forge then GitHub; historical archives retain Codeberg first, then the canonical forge, then GitHub. Recorded manifests and approved commits remain unchanged. Compiler settings, container digests, package versions, existing Bootproof/EnclaveOS/tee-attestation-js pins, public APIs and trusted PCR policies are unchanged.

Validation at the final revisions

Clean-cache locked Cargo/npm resolution passed. The widget lockfile differs only by its SHA substitution; no unintended package upgrades, duplicate Git identities or active legacy Caution Git fetches were found. The private registry remains excluded. A transient native crates.io timeout was resolved with a clean StageX retry for Locksmith.
Actual Cargo fallback commands passed with the primary unavailable for pinned STEVE, current Locksmith and historical Codeberg Locksmith; locks remained unchanged. Full GitHub source-clone fallback remains a landing gate.
CLI 233 passed (2 ignored), builder/archive/reproduction 111 passed, configuration 130 passed, API service observations 9 passed. Coverage includes archive ordering/fallback, serialization, commit validation and unrelated-repository isolation. Frontend 137 passed plus production build.
Locksmith head: 88 passed (3 ignored). STEVE consumed pin: SDK 69 passed, other Rust libraries 36 passed (1 ignored), StageX WASM target passed. STEVE branch head: SDK 103 passed, other Rust libraries 56 passed (1 ignored).
Both STEVE server suites: 41 passed and the previously reproduced baseline failure in upstream_idle_read_timeouts_fail_both_forwarding_paths (upstream unavailable versus upstream response unavailable).

Final build evidence

The unchanged StageX CLI recipe passed for 85e6300a99e5efb0badde6b74793746bb101e1a8. CLI SHA256: ad0bde16268188c503d33186020b1000b22c3e7d67412ffa1cf68e79bd15f4fa.

A fresh apps build --no-cache passed with STEVE and Locksmith enabled and synthetic inputs. Packaged tools and the embedded manifest match the consumed pins. EIF SHA256: 696e710e59be15498920b06b59c1aff0acc4255b9d6d96c6186d23a8f81256d5 (20,263,798 bytes).

c0b7946106a4d9a13274bec8da7d7788acb4ef07ce57d160d0df29f40a803952b36e20934e818a3229712cf50de94e66 PCR0
c0b7946106a4d9a13274bec8da7d7788acb4ef07ce57d160d0df29f40a803952b36e20934e818a3229712cf50de94e66 PCR1
21b9efbc184807662e966d34f390821309eeac6802309798826296bf3e8bec7c10edb30948c90ba67310f7b964fc500a PCR2

These are local build measurements, not live Nitro attestation, secret-release or independent reproduction evidence. Trusted PCR policies were not updated.

Landing gates and boundaries

Keep all four PRs as drafts. GitHub mirror setup is a separate gate; native push mirrors were absent for STEVE, Locksmith and Bootproof when inspected. Preserve branch-only Bootproof 2590edb durably, merge prerequisites with signed ancestry-preserving commits, and verify fresh GitHub clone/checkouts of the exact STEVE, Locksmith and Bootproof pins before landing Platform.

Rechecked #477 at e1f86a0a68e4cb399baedd029922e694c9a0822b, #478 at ead94d2b6954cae369989353dd9f8121cad611c1, and #469 at d17307e2813d80b88f2e76ef3119cbaf83b22e6a. Shared-file overlap is recorded; #477’s new dashboard layout changes are separate from the migration’s source-link locations. No feature PR was incorporated. Its ONPREM_PROVISIONER_IMAGE reference in tests/e2e/test_app_deployments.sh:70 remains part of the separate registry migration.

No main-branch merges, tags, mirror configuration, deployments or trust-policy changes. Historical Locksmith redirect expansion, Codeberg retirement, private repositories, Keyfork, _cargo-index and unrelated feature worktrees remain outside this delivery.

Move Platform’s active public Caution fetches and emitted source URLs to git.caution.co/public while retaining migration-only runtime pins. The final signed revision is `85e6300a99e5efb0badde6b74793746bb101e1a8`. ## Exact consumed revisions | Dependency | Platform pin | Current prerequisite branch head | | --- | --- | --- | | [STEVE #16](https://git.caution.co/public/steve/pulls/16) | `6431612db09899314c7c30bc7ca0b1c54f7bc3c0` | `d80a9a3573b6e94e57e3cbbf00745946e8f09e62` | | [Locksmith #18](https://git.caution.co/public/locksmith/pulls/18) | `eee2a8a3673c92b668b0a82d0da2e06c131df6e2` | `b9100df30490f5a3983705e36a277c82860c0207` | | [Widget #5](https://git.caution.co/public/attestation-widget/pulls/5) | `7d60e623b4d1c151590d8d5dd925f88dc627e01e` | same | STEVE’s signed retention merge has the same tree as `5d30ca7` and preserves `6431612` as a parent; Platform does not adopt its newer main-based tree. The widget replacement has the identical tree to previously validated `900474a`. Locksmith’s branch restores its historical Codeberg transport alias while Platform keeps its validated ancestor pin. Fresh canonical clone/checkouts and exact archives pass for all consumed revisions. ## Behavior and compatibility Update direct dependency sources, builder defaults, discovery/build-input URLs, documentation, UI references and fixtures. Verified issue links now use the canonical tracker, including Locksmith comment `#issuecomment-175`. Forge contributions require an account. Cargo retries use command-scoped GitHub transport aliases for canonical and historical Codeberg sources. New Platform/EnclaveOS archives try the canonical forge then GitHub; historical archives retain Codeberg first, then the canonical forge, then GitHub. Recorded manifests and approved commits remain unchanged. Compiler settings, container digests, package versions, existing Bootproof/EnclaveOS/tee-attestation-js pins, public APIs and trusted PCR policies are unchanged. ## Validation at the final revisions - Clean-cache locked Cargo/npm resolution passed. The widget lockfile differs only by its SHA substitution; no unintended package upgrades, duplicate Git identities or active legacy Caution Git fetches were found. The private registry remains excluded. A transient native crates.io timeout was resolved with a clean StageX retry for Locksmith. - Actual Cargo fallback commands passed with the primary unavailable for pinned STEVE, current Locksmith and historical Codeberg Locksmith; locks remained unchanged. Full GitHub source-clone fallback remains a landing gate. - CLI 233 passed (2 ignored), builder/archive/reproduction 111 passed, configuration 130 passed, API service observations 9 passed. Coverage includes archive ordering/fallback, serialization, commit validation and unrelated-repository isolation. Frontend 137 passed plus production build. - Locksmith head: 88 passed (3 ignored). STEVE consumed pin: SDK 69 passed, other Rust libraries 36 passed (1 ignored), StageX WASM target passed. STEVE branch head: SDK 103 passed, other Rust libraries 56 passed (1 ignored). - Both STEVE server suites: 41 passed and the previously reproduced baseline failure in `upstream_idle_read_timeouts_fail_both_forwarding_paths` (`upstream unavailable` versus `upstream response unavailable`). ## Final build evidence The unchanged StageX CLI recipe passed for `85e6300a99e5efb0badde6b74793746bb101e1a8`. CLI SHA256: `ad0bde16268188c503d33186020b1000b22c3e7d67412ffa1cf68e79bd15f4fa`. A fresh `apps build --no-cache` passed with STEVE and Locksmith enabled and synthetic inputs. Packaged tools and the embedded manifest match the consumed pins. EIF SHA256: `696e710e59be15498920b06b59c1aff0acc4255b9d6d96c6186d23a8f81256d5` (20,263,798 bytes). ```text c0b7946106a4d9a13274bec8da7d7788acb4ef07ce57d160d0df29f40a803952b36e20934e818a3229712cf50de94e66 PCR0 c0b7946106a4d9a13274bec8da7d7788acb4ef07ce57d160d0df29f40a803952b36e20934e818a3229712cf50de94e66 PCR1 21b9efbc184807662e966d34f390821309eeac6802309798826296bf3e8bec7c10edb30948c90ba67310f7b964fc500a PCR2 ``` These are local build measurements, not live Nitro attestation, secret-release or independent reproduction evidence. Trusted PCR policies were not updated. ## Landing gates and boundaries Keep all four PRs as drafts. GitHub mirror setup is a separate gate; native push mirrors were absent for STEVE, Locksmith and Bootproof when inspected. Preserve branch-only Bootproof `2590edb` durably, merge prerequisites with signed ancestry-preserving commits, and verify fresh GitHub clone/checkouts of the exact STEVE, Locksmith and Bootproof pins before landing Platform. Rechecked #477 at `e1f86a0a68e4cb399baedd029922e694c9a0822b`, #478 at `ead94d2b6954cae369989353dd9f8121cad611c1`, and #469 at `d17307e2813d80b88f2e76ef3119cbaf83b22e6a`. Shared-file overlap is recorded; #477’s new dashboard layout changes are separate from the migration’s source-link locations. No feature PR was incorporated. Its `ONPREM_PROVISIONER_IMAGE` reference in `tests/e2e/test_app_deployments.sh:70` remains part of the separate registry migration. No main-branch merges, tags, mirror configuration, deployments or trust-policy changes. Historical Locksmith redirect expansion, Codeberg retirement, private repositories, Keyfork, `_cargo-index` and unrelated feature worktrees remain outside this delivery.

vincent added 1 commit

2026-10-15 12:02:53 +00:00

Migrate public source fetches to the Caution forge a2b52dd06b

vincent added 1 commit

2026-10-15 12:06:01 +00:00

Pin widget revision with migrated installation instructions 234ff6c32c

vincent referenced this pull request from public/attestation-widget

2026-10-15 12:56:19 +00:00

WIP: Migrate dependency sources to the Caution forge #5

vincent added 1 commit

2026-10-15 12:56:50 +00:00

fix: complete forge dependency migration and STEVE fallback 5d9cecfd70

vincent referenced this pull request from public/steve

2026-10-15 12:57:55 +00:00

WIP: Migrate pinned STEVE dependency sources to the Caution forge #16

vincent referenced this pull request from public/locksmith

2026-10-15 12:58:48 +00:00

WIP: Migrate dependency sources to the Caution forge #18

vincent added 1 commit

2026-10-15 15:16:50 +00:00

Stabilize widget pin and migrated issue references 85e6300a99

Pin the reachable widget revision with identical source content and update verified issue links on the canonical forge. Keep the validated STEVE and Locksmith revisions unchanged.