Releases 1

Releases carry their source (issue #157). Each release now has oxy-VERSION-src.tar.gz, the source as released, reproducible (sorted, fixed times and owners, gzip without a timestamp), listed in SHA256SUMS, for packagers to fetch at a fixed checksum. packaging/haikuports/make-recipe.py oxy|oh TARBALL VERSION writes the haikuports recipe from it (oh's from OxygenHub's source tarball); the 0.8.0 recipe, which used the on-demand archive, is gone.

Added: a haikuports recipe for oxy (issue #156). packaging/haikuports/ holds the recipe that builds oxy for HaikuDepot from the release source and every crate in Cargo.lock, and the script that writes it for a new release; the 0.8.0 recipe builds with haikuporter on Haiku R1/beta6.

Fixed: an expired checkout token no longer hides your sign-in (issue #155). A checkout's own token for a remote (remote.NAME.token) is used first, so when it expired every fetch, pull and push answered 401 although oxy auth login had a good sign-in for the same hub. A checkout token the hub no longer knows (401) now falls back to that sign-in, with a warning naming oxy config --unset remote.NAME.token to drop the stale one; never to another checkout's token, and not when the token is refused for permission (403, 404), so a narrowly scoped token is never swapped for a wider sign-in. When both are refused, the error says to sign in again and unset it.

Added: the artifact object type (Cylinder C1, issue #108). An artifact is now an object of its own in the store (oxy-core's artifact module), named by its object hash as every object is, and oxy fsck checks it; its tree stays a blob. Stores written before read as they did: the type is a new one at the end of the list.

Added: artifacts (Cylinder, step C1, issue #108). oxy artifact pack DIR --kind archive|package|container|runner-image|report [--arch --os --entrypoint --env K=V --label K=V] packs a directory into an artifact: each file an ordinary blob of the repository's store, so files and chunks it holds already cost nothing, under a tree and an artifact encoding in canonical CBOR, named by the BLAKE3 of that encoding (docs/cylinder.md §4.1). oxy artifact list | show NAME | unpack NAME DEST | verify NAME (any unique prefix of six characters or more; --json on list, show and pack), and oxy gc keeps every artifact's blobs. The new cylinder crate holds the model.

Added: oxy on Haiku (issue #154). oxy builds and runs on Haiku R1/beta6 (x86_64) with HaikuPorts' Rust; oxy-VERSION-haiku-x86_64.tar.gz is on the releases page from 0.8.0, with its own SHA256SUMS-haiku. The README says how to install it and how to build it (ZSTD_SYS_USE_PKG_CONFIG=1).

Fixed: a subrepo put back after its removal is pinned in the change that registers it (issue #152). oxy submodule remove leaves a marker so the next snapshot drops the node while the directory stays; the snapshot cleared it only after reading it, so when nothing looked at the working copy between the removal's commit and the subrepo's return, the change that registered it again in .oxymodules left it out and a second commit was needed. A marker is now dropped before it is read once the removal is recorded or the path is registered again.

Fixed: oxy identity create needs no repository (issue #144). Outside one it makes a user identity: the secret and identity go to the oxy home's keys and the user file names it as the author, so a new user or machine sets up an identity first; a repository made or cloned afterwards signs with it. Only --local needs a repository, and inside one it is kept there too, as before.