Skip to content

Release 2.1.226 (2026-10-06)

Features

  • target registry, [package] config and vrg-package matrix (#3074) (#3087) Add the binary-packaging foundation for epic vergil-project/.github#356 (Task T1): the target registry (lib/package/targets.py), the [package] vergil.toml section with its spec 5.4 hard validation and nFPM overlay shape check, matrix resolution into build/test cells plus the release artifact manifest, package-name resolution, PackageError, and the vrg-package CLI with its matrix subcommand. The ubuntu/26.04 glibc is 2.43, verified with ldd in the image.

  • index: collect stable releases, verify provenance, per-line retention (#3079) (#3089) Add lib/package/index/{config,collect,retention}. packages.toml is parsed strictly; collect lists stable vX.Y.Z releases, skips releases without packages-manifest.json with a note, and fails on a missing or unlisted package; verify pins gh attestation verify to the vergil-actions cd-release.yml workflow on refs/heads/main and requires an org signature on every rpm; retention keeps the newest lines and releases per product plus the transitive dependency closure, and fails when one package identity has different bytes in two releases.

  • package / evidence gate: required with [package], harvested at release (#3081) (#3090) Require the package / evidence status check in the CI-gates ruleset exactly when vergil.toml has a [package] section, classify it as the package evidence gate so vrg-ci-evidence harvest downloads ci-evidence-package, and register ci-package.yml's evidence context as producible.

  • allow the Public Domain license in the Python dependency audit (#3091) Adds "Public Domain" to the pip-licenses allowlist so public-domain dependencies (e.g. pyelftools, needed by #3075) pass vrg-validate's audit stage. Fleet-wide policy change approved by the human on 2026-10-05. Ref #3088.

  • staged builder, nFPM packaging, glibc guard, vrg-package build (#3075) (#3092) Add the builder registry and build orchestration (lib/package/build.py), the staged builder, nFPM config rendering with overlay validation and merge plus the raw-systemctl maintainer-script check, the pyelftools-based glibc floor guard, and the vrg-package build subcommand. pyelftools>=0.31 becomes a runtime dependency.

  • org repository registry and fingerprint-pinned trust bootstrap (#3076) (#3093) Add lib/package/orgs.py (OrgRepo, ORGS with the vergil entry pinned to the OP1-attested primary fingerprint, for_vendor) and lib/package/repo_setup.py (Run, local_run, parse_primary_fingerprint, bootstrap for apt and dnf). The published key is verified to hold exactly one primary key matching the pin before any source is written; the bootstrap source and key are always removed after the keyring install. index/collect.py now takes Run/local_run from repo_setup.

  • index: apt and dnf metadata, signing, size guard, vrg-package index (#3094)

  • feat(package): index: apt and dnf metadata, signing, size guard, vrg-package index (#3080)

Adds index/apt.py (Python-generated Packages/Packages.gz/Release), index/rpm.py (createrepo_c per EL and arch over a shared rpm/pool with --baseurl), index/sign.py (env-held key and passphrase via 0600 temp files, InRelease, Release.gpg, repomd.xml.asc), index/site.py (size guard and end-to-end build_site) and the vrg-package index subcommand. collect.verify gains an optional private rpm DB so the publish-index runner never writes the system rpm database.

  • fix(package): emit SHA256-only apt metadata (#3080)

Semgrep (python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1) flagged the SHA1 field in Packages. apt verifies with SHA256, and MD5/SHA1 are not collision resistant, so Packages and Release now carry SHA256 only. The tests assert MD5 and SHA1 are absent.

  • python builder: venv from uv.lock on the pinned runtime (#3077) (#3095) Add lib/package/python_builder.py, registered as builder "python": trust the vergil repo, install vergil-python (apt in shared/native Ubuntu cells, dnf in native RHEL cells), read its PBS version, build the venv at /opt///venv from the runtime interpreter, uv sync --frozen --no-dev --no-editable --compile-bytecode, stage it, add /usr/bin shims and the vergil-python runtime dependency. A missing uv.lock is a hard config error (spec 5.4). vrg-package imports the builder so it registers.

  • vrg-package install-test: install, units, smoke, clean removal (#3078) (#3096) Adds lib/package/install_test.py (select_artifact, run_install_test) and the vrg-package install-test subcommand. Smoke and shim checks run under a sanitized env -i environment with a system-only PATH; each /usr/bin shim must resolve to itself; removal must leave no residue under /opt// or in the shims.

  • deferred package-index stage; consumer refresh waits for the index (#3097)

  • feat(release): deferred package-index stage; consumer refresh waits for the index (#3082)

  • test(release): write uv.lock in package-index test fixtures (#3082)

  • VMs install vergil-tooling from the package repository; explicit dev installs (#3083) (#3098) A release version (vX.Y line or vX.Y.Z exact) now installs vergil-tooling on Lima and cloud VMs from the vergil apt repository: trust bootstrap via repo_setup, an apt preferences pin, a candidate check that fails naming the ref and repository URL when nothing matches, then apt install. Any uv-installed copy and the dev-ref marker are removed only after the apt install succeeds. A non-release ref is an explicit uv dev install that records its ref, and vrg-vm prints a DEV banner on create, rebuild, start, update and session while it is in place. get_tooling_version falls back to the installed deb version.

CI Evidence: All gates passed — full audit bundle available. Download →