Skip to content

Release 2.1.233 (2026-10-09)

Bug fixes

  • retry 404 on just-discovered GitHub resources (list-before-readable lag) (#3139)
  • feat(retry): add retry_known_resource for 404s on just-discovered GitHub IDs

A 404 stays fatal by default. retry_known_resource is an opt-in wrapper for reads of an ID GitHub itself just reported (listed/created), retrying not-found with compute_delay backoff under a 60s time budget and then raising KnownResourceNotFoundError naming the resource (#3137).

  • fix(release): retry 404 on the just-listed CD run and just-published release in confirm

confirm reads the CD run (url, watch, jobs) by an ID gh run list just returned, and the GitHub Release the CD release job just published. A 404 there is GitHub's list-before-readable lag, not a missing resource, so each read now goes through retry_known_resource (#3137).

  • fix(release): retry 404 on just-created or just-listed release PRs and tracking issue

Release PR URLs come from gh pr create/list and the tracking issue number from gh issue create/list, so their first reads may hit GitHub's list-before-readable lag. Add release.merge.known_pr_state, use it for every PR state read in prepare/merge-release/back-merge, gate wait_and_merge on it before the shared pr_merge engine (left untouched because vrg-finalize-pr feeds it user input), and wrap read_issue_body (#3137).

  • style(release): satisfy ruff format for the known-resource retry changes

  • make the package trust bootstrap idempotent (#3138) (#3140) Re-running the bootstrap on a host that already has the org keyring wrote vergil-bootstrap.sources next to the keyring's vergil.sources (same URI and suite, different Signed-By), and apt then rejected the source list, so every second vrg-vm update on a migrated box failed.

  • Stale bootstrap source/key files are removed before any apt or dnf call.

  • When the keyring package is installed and its source and key exist, the bootstrap is skipped: the installed key's primary fingerprint is checked against the pinned one (fatal on mismatch), then only the keyring's own source is refreshed (scoped apt update / dnf makecache --repo).
  • A keyring installed without its source or key is reinstalled through the bootstrap path (apt --reinstall / dnf reinstall), since a plain install never re-runs the postinst.
  • The bootstrap keyring install reads the bootstrap source alone (apt scoped, dnf --repo), so a stray permanent source cannot conflict; afterwards the keyring's setup is verified and an incomplete one is fatal.
  • Same idempotency on the rpm path.

CI Evidence: All gates passed — full audit bundle available. Download →