eric/ReleaseKit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Bind delivered binaries to verified build source

Browse Source
This commit is contained in:
Eric Rakestraw
2026-10-06 00:51:56 +00:00
parent 1d6611601c
commit a1ee067b53
11 changed files with 154 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/consumers/build.md
View File

@@ -40,7 +40,10 @@ func build(ctx context.Context) error {
version into `buildinfo.Version`, and returns the compiler identity, normalized
targets, artifact paths, filenames, and SHA-256 digests. Names follow
`<binary>-<version>-<goos>-<goarch>`; Windows targets add `.exe`. A repeated
target pair is built once, at its first position.
target pair is built once, at its first position. Local builds may use modified
source. `SourceVerified` is true only after a complete build observes clean
source and the same HEAD before and after compilation; binary delivery requires
that fact. This observation is not a source snapshot or attestation guarantee.
The default output directory is `<repository>/dist`; a relative `OutputDir` is
resolved from the repository. Existing files with a selected artifact name are