From e05af04f6cea05ecdb4c0d60c9e303f4107781a1 Mon Sep 17 00:00:00 2001 From: Vijit Singh Date: Fri, 14 Aug 2026 09:31:17 -0500 Subject: [PATCH 1/2] =?UTF-8?q?release:=20v1.18.1=20=E2=80=94=20supersede?= =?UTF-8?q?=20the=20unsigned=201.18.0=20bundle?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 10 +++++++++- VERSION | 2 +- build/dashboard/pyproject.toml | 2 +- build/dashboard/uv.lock | 2 +- 4 files changed, 12 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d1768c95..0df38c44 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,15 @@ Pithead ships as **one product, one version** — the version lives in the top-l [`VERSION`](VERSION) file and every released image is tagged with it. Releases are cut per the process in [`docs/dev/releasing.md`](docs/dev/releasing.md). -## [1.18.0] - 2026-08-13 +## [1.18.1] - 2026-08-14 + +Supersedes 1.18.0, withdrawn before general adoption: its install bundle published without the +cosign signature (the cut ran in a shell without the signing key's environment, and signing is +opt-in rather than refused), and the release's immutable assets cannot be amended after the fact. +Signed installs verify the bundle before extracting a byte, so they correctly refuse 1.18.0's +one-click upgrade. 1.18.1 carries every 1.18.0 change, signed end to end. + +## [1.18.0] - 2026-08-13 (withdrawn — unsigned install bundle; use 1.18.1) ### Added diff --git a/VERSION b/VERSION index 84cc5294..ec6d649b 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.18.0 +1.18.1 diff --git a/build/dashboard/pyproject.toml b/build/dashboard/pyproject.toml index 68d3d3ef..f0a91b61 100644 --- a/build/dashboard/pyproject.toml +++ b/build/dashboard/pyproject.toml @@ -7,7 +7,7 @@ name = "mining-dashboard" # Keep in lockstep with the top-level VERSION file — the single source of truth for the stack version # (#44). A shell test (tests/stack/run.sh) fails if these drift; the dashboard *displays* the version # from VERSION (baked in as PITHEAD_VERSION, #58), so this is packaging metadata only. -version = "1.18.0" +version = "1.18.1" description = "Monitoring dashboard and XvB switching engine for Pithead" readme = "README.md" requires-python = ">=3.11" diff --git a/build/dashboard/uv.lock b/build/dashboard/uv.lock index 775437f3..97f194a7 100644 --- a/build/dashboard/uv.lock +++ b/build/dashboard/uv.lock @@ -786,7 +786,7 @@ wheels = [ [[package]] name = "mining-dashboard" -version = "1.18.0" +version = "1.18.1" source = { editable = "." } dependencies = [ { name = "aiofiles" }, From fe543ac310b7b742543e2e7692f85a3c89a1a08d Mon Sep 17 00:00:00 2001 From: Vijit Singh Date: Fri, 14 Aug 2026 09:41:38 -0500 Subject: [PATCH 2/2] =?UTF-8?q?release:=20commit=20cosign.pub=20=E2=80=94?= =?UTF-8?q?=20signing=20engages=20for=20the=20first=20time=20(#376=20boots?= =?UTF-8?q?trap)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The key pair was generated on the release box in July but the public half never landed in the repo, so release.sh's signing condition (key + committed cosign.pub) has never fired and every bundle to date shipped unsigned. Committing the pub key completes the #376 rollout: the pipeline signs from the next cut, the bundle ships the key, and installs bootstrap verification on their first upgrade to it. Also corrects the 1.18.1 changelog account to this real story. Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 12 +++++++----- cosign.pub | 4 ++++ 2 files changed, 11 insertions(+), 5 deletions(-) create mode 100644 cosign.pub diff --git a/CHANGELOG.md b/CHANGELOG.md index 0df38c44..0cc1156c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,11 +11,13 @@ per the process in [`docs/dev/releasing.md`](docs/dev/releasing.md). ## [1.18.1] - 2026-08-14 -Supersedes 1.18.0, withdrawn before general adoption: its install bundle published without the -cosign signature (the cut ran in a shell without the signing key's environment, and signing is -opt-in rather than refused), and the release's immutable assets cannot be amended after the fact. -Signed installs verify the bundle before extracting a byte, so they correctly refuse 1.18.0's -one-click upgrade. 1.18.1 carries every 1.18.0 change, signed end to end. +Supersedes 1.18.0, withdrawn before general adoption. Investigating its missing bundle signature +surfaced the real state: release signing (#376) had never engaged — the key pair was generated on +the release box but `cosign.pub` was never committed, so every release to date shipped its bundle +unsigned and no install holds a key to verify with. 1.18.1 draws the line: it commits +`cosign.pub`, carries every 1.18.0 change, and is the first release signed end to end. Installs +that upgrade to it come out holding the key and verify every release after; immutable release +assets mean 1.18.0 itself can never be amended, hence the new number. ## [1.18.0] - 2026-08-13 (withdrawn — unsigned install bundle; use 1.18.1) diff --git a/cosign.pub b/cosign.pub new file mode 100644 index 00000000..92a2d11c --- /dev/null +++ b/cosign.pub @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEe1TGGjQyKKDDFtBmAU6Vg3egDXTA +9gVysXBv+ppF9f7u4LL/5uf28n8bc6pyJjqpUxkRfJYc/eKFts0ho6HEEQ== +-----END PUBLIC KEY-----