OXYGENHUB

The trust report prints the tagged state once edcef27575a7

Every 'built from the tagged state' line carried all of the tag's
heads (38 of them for v0.3.1), three lines per asset. The audit now
has one line, 'The tagged state has N heads', with the short heads,
and each asset's line names the run that built it. A build from
another state shows up to four of its heads, or its first and last.

closes #93
Author
Andy McCall @andymccall <[email protected]>
When
· 2026-10-04 02:32 UTC
Signature
✔ signed by Andy McCall
Hash
edcef27575a73e6acece529d1c0d3bb9f3509123de1a2c049ef4c0dd28b38bba
Depends on
42fa95540468 df940d75cd3d
Depended on by
nothing yet
In bookmarks
api-unknown-fields cancel-landed-runs clear-waiting close-proposal-140 diffusion-pin-bookmark draft-ready image-check job-waits main oh-comment-body-file proposal-list-fast run-one-job wiki-says-so
In tags
v0.4.0 v0.4.1 v0.4.2 v0.5.0 v0.5.1 v0.5.2 v0.6.0 v0.6.1 v0.7.0 v0.8.0 v0.9.0 v0.9.1 v0.9.11 v0.9.15 v0.9.16 v0.9.19 v0.9.2 v0.9.20 v0.9.21 v0.9.22 v0.9.23 v0.9.24 v0.9.3 v0.9.4 v0.9.5 v0.9.6 v0.9.7 v0.9.8 v0.9.9
Edits
6 atoms, 0 tree operations, 2 files

Browse the tree at this change

hide whitespace changes
modified crates/hub/src/web/release_trust.rs +15 −6
… 
359 unchanged lines
360 360 
        "revoked" => check(Verdict::Fail, format!("Tag {} is signed by a revoked key", t.tag), signer.unwrap_or_default()),
361 361 
        other => check(Verdict::Fail, format!("Tag {}'s signature does not verify", t.tag), other.to_string()),
362 362 
    });
363 + 
    // The heads once, here, rather than on every asset's line (oxygenhub#93).
364 + 
    let short = |h: &String| h[..12.min(h.len())].to_string();
365 + 
    out.push(match t.heads.len() {
366 + 
        1 => check(Verdict::Pass, "The tagged state is one change".into(), short(&t.heads[0])),
367 + 
        n => check(Verdict::Pass, format!("The tagged state has {n} heads"), t.heads.iter().map(short).collect::<Vec<_>>().join(" ")),
368 + 
    });
363 369 
    let sum = |f: fn(&AuthorTrust) -> usize| t.authors.iter().map(f).sum::<usize>();
364 370 
    let (unsigned, invalid, revoked) = (sum(|a| a.unsigned), sum(|a| a.invalid), sum(|a| a.revoked));
365 371 
    let scope = match &t.since {
… 
55 unchanged lines
421 427 
                    ),
422 428 
                });
423 429 
                out.push(if b.same_state_as_tag {
424 - 
                    check(
425 - 
                        Verdict::Pass,
426 - 
                        format!("{}: built from the tagged state", a.name),
427 - 
                        t.heads.iter().map(|h| &h[..12]).collect::<Vec<_>>().join("+"),
428 - 
                    )
430 + 
                    check(Verdict::Pass, format!("{}: built from the tagged state", a.name), format!("by run #{}", b.run))
429 431 
                } else {
432 + 
                    let heads: Vec<String> = b.heads.split('+').map(|h| h[..12.min(h.len())].to_string()).collect();
433 + 
                    let built = match heads.len() {
434 + 
                        0 => "nothing".to_string(),
435 + 
                        1 => heads[0].clone(),
436 + 
                        n if n <= 4 => format!("{n} heads {}", heads.join(" ")),
437 + 
                        n => format!("{n} heads {} … {}", heads[0], heads[n - 1]),
438 + 
                    };
430 439 
                    check(
431 440 
                        Verdict::Warn,
432 441 
                        format!("{}: built from another state than the tag's", a.name),
433 - 
                        format!("run #{} built {}", b.run, b.heads.split('+').map(|h| &h[..12.min(h.len())]).collect::<Vec<_>>().join("+")),
442 + 
                        format!("run #{} built {built}", b.run),
434 443 
                    )
435 444 
                });
436 445 
                let pinned = b.rootfs.len() == 64 && b.rootfs.bytes().all(|c| c.is_ascii_hexdigit()) && !b.environment.is_empty();
… 
159 unchanged lines
modified crates/hub/tests/flow.rs +1 −0
… 
953 unchanged lines
954 954 
        "The one change in the release is authenticated",
955 955 
        "tool: signed receipt from run #1 build",
956 956 
        "a runner key of this hub",
957 + 
        "The tagged state is one change",
957 958 
        "tool: built from the tagged state",
958 959 
        "tool: pinned environment",
959 960 
        "notes.txt: no build found",
… 
28 unchanged lines