Applies to all seven NDDev-OpenNetwork *-setup-system tags 0.0.1.
The release fleet works. I downloaded pi-setup-system-x86_64-unknown-linux-gnu from 0.0.1 and gh attestation verify succeeded against NDDev-OpenNetwork/pi-setup-system/.github/workflows/release.yml with a Rekor timestamp. Same shape of assets on the other six: six binaries plus SHA256SUMS. That is not the problem.
ai-stp install protocol v3 will not take the attested path without a JSON release manifest next to those bytes. The shipped consumer policy now marks these repositories as verified publishers of their attested builds (ai-engineers-guild/ai-stp@4fa361ab). Without the manifest, the only install that still works is --unverified-provider, which records provider_release_trusted false.
What is missing from every 0.0.1 release: one JSON object whose signature_subject is ai-stp:provider-release-manifest:v1, with at least:
- provider_id, provider_version, protocol_version 3
- repository as github.com/NDDev-OpenNetwork/
- commit equal to the source digest GitHub attested (tag 0.0.1 on pi is f139b2f3be3880d9643e5de28514e23b19e197ed)
- artifact_url, artifact_size, artifact_digest sha256 for that platform binary
- entry_point, supported_os, supported_arch, sequence, license
- policy_id = nddev/provider/1
- publisher, signing_key, signature_subject, signature
Ed25519 signature may be empty on the attested path. signing_key must still be a non-empty string. Do not pin bytes into ai-stp Ed25519 releases; attach the manifest here so the consumer can bind commit, digest and size to the artifact it already attests.
Contract: https://github.com/ai-engineers-guild/ai-stp/blob/4fa361ab66fa096bcf7edf68761f40bca17adbf9/docs/contracts/provider-release.md
Please ship that file from release.yml on the next tag, on all seven repos. I am not patching those trees from here.
Applies to all seven NDDev-OpenNetwork *-setup-system tags 0.0.1.
The release fleet works. I downloaded pi-setup-system-x86_64-unknown-linux-gnu from 0.0.1 and
gh attestation verifysucceeded against NDDev-OpenNetwork/pi-setup-system/.github/workflows/release.yml with a Rekor timestamp. Same shape of assets on the other six: six binaries plus SHA256SUMS. That is not the problem.ai-stp install protocol v3 will not take the attested path without a JSON release manifest next to those bytes. The shipped consumer policy now marks these repositories as verified publishers of their attested builds (ai-engineers-guild/ai-stp@4fa361ab). Without the manifest, the only install that still works is --unverified-provider, which records provider_release_trusted false.
What is missing from every 0.0.1 release: one JSON object whose signature_subject is ai-stp:provider-release-manifest:v1, with at least:
Ed25519 signature may be empty on the attested path. signing_key must still be a non-empty string. Do not pin bytes into ai-stp Ed25519 releases; attach the manifest here so the consumer can bind commit, digest and size to the artifact it already attests.
Contract: https://github.com/ai-engineers-guild/ai-stp/blob/4fa361ab66fa096bcf7edf68761f40bca17adbf9/docs/contracts/provider-release.md
Please ship that file from release.yml on the next tag, on all seven repos. I am not patching those trees from here.