statecraft.
Catalog/rustev

060-the-service-image-in-the-release

The service image in the release (amends 031, 056 and 058)

Lifecycle approvedImplementation completeVerification unknownQualification unknown

An amendment of approved specs 031 (3.1 layer 7, 3.9), 056 (3.3) and 058 (3.3.4, 3.5.2), ratified (A-76) for the release after 0.4.0. Spec 042 3.16's `rustev-serve` image is built, checked, compared, described and scanned in every release run, and is not published: 058 3.3.4 gives no job `packages: write`, and the owner decided on 2026-11-02 that 0.4.0 ships without the image. This spec admits the image as a release member. One job, `publish-image`, holds `packages: write` and runs only for a release tag, never for a candidate or a dry run. It pushes the run's verified OCI archives by digest to `ghcr.io/statecrafting/rustev-serve`, joins them in one index tagged with the family version, and attests the SLSA build provenance and each platform's SBOM. The manifest names the index and platform digests, the vulnerability scan gates through an owner-approved, expiry-bounded exception file, and qualification runs 031 3.9.7 (c). Spec 053's candidate refusals are unchanged. A release also keeps its qualification evidence as `qualification-` assets, which the release comparison ignores (3.7).

Read the full pinned specification ↗

Relationships

Claimed units

  • extends
    {
  "nature": "amending",
  "spec": "031-public-api-and-release-family",
  "unit": {
    "kind": "directory",
    "path": "tools/rustev-release/"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "001-boundaries-and-authority",
  "unit": {
    "kind": "file",
    "path": "Makefile"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "001-boundaries-and-authority",
  "unit": {
    "kind": "directory",
    "path": "scripts/acceptance/"
  }
}

Source headings

  1. 060: The service image in the release (amends 031, 056 and 058)
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 3.1 Membership
  6. 3.2 The scan gate
  7. 3.3 The push
  8. 3.4 Manifest, verification and qualification
  9. 3.5 Failure and resume
  10. 3.6 What stays
  11. 3.7 Qualification evidence on the release
  12. 4. Out of scope
  13. 5. Observable negative cases
  14. Acceptance
  15. Verification
  16. Implementation record
  17. Decisions at approval

Frozen anchors

No frozen anchors declared.