fix(evidence)!: durable evidence copies move to the pkg bucket #2039

Merged

pipeline-bot merged 1 commit from fix/evidence-durable-home into trunk

2026-08-13 17:01:56 +00:00

sean commented

2026-08-13 17:01:11 +00:00

Owner

Closes the finding flagged in #2038: durable evidence copies lived under the work bucket's blanket 3-day ilm expiry, so every durableURI older than the window was a dead pointer.

Evidence now lands at pkg/evidence/<project>/<package-version>/ (no lifecycle rules; project segment prevents cross-project version collisions). The build key gains Get/Put on exactly that prefix — no DeleteObject, evidence is write-once for its writer. The evidence-export reader prefers the new home with a legacy-path fallback for pre-move releases.

Guards updated: provenance-contract now asserts the copy is in the no-expiry bucket; codeberg-registry-retry pins the new path shape.

41 surviving evidence dirs already rescued to the new home (root mc, one-shot pod) — every pipelines release back to 0.1.625, all of seanfarm's, the kernel's 6.18.44, and today's zig trio. The expiry scanner had not yet reaped the backlog; timing was good.

First new-path write proof: the release AFTER this one deploys (this release itself still runs the old template). Its own evidence dir will get a one-object rescue after deploy.

Closes the finding flagged in #2038: durable evidence copies lived under the work bucket's blanket 3-day ilm expiry, so every `durableURI` older than the window was a dead pointer. Evidence now lands at `pkg/evidence/<project>/<package-version>/` (no lifecycle rules; project segment prevents cross-project version collisions). The build key gains Get/Put on exactly that prefix — **no DeleteObject**, evidence is write-once for its writer. The evidence-export reader prefers the new home with a legacy-path fallback for pre-move releases. Guards updated: `provenance-contract` now asserts the copy is in the no-expiry bucket; `codeberg-registry-retry` pins the new path shape. **41 surviving evidence dirs already rescued** to the new home (root mc, one-shot pod) — every pipelines release back to 0.1.625, all of seanfarm's, the kernel's 6.18.44, and today's zig trio. The expiry scanner had not yet reaped the backlog; timing was good. First new-path write proof: the release AFTER this one deploys (this release itself still runs the old template). Its own evidence dir will get a one-object rescue after deploy.

sean added 1 commit

2026-08-13 17:01:11 +00:00

fix(evidence)!: durable evidence copies move to the pkg bucket

pipeline/ci CI green @ 45929862c9d8

Details

45929862c9

The durable evidence copy — the record that lets the codeberg export
defer — lived under the work bucket, and the work bucket carries a blanket
3-day ilm expiry with no prefix (the MinIO-exhaustion fix). MinIO lifecycle
rules cannot express "everything except evidence/", so every durableURI
older than the window was a dead pointer. "Durable" was
broken-by-configuration; only the codeberg package copies made evidence
recoverable.

Evidence now lands at pkg/evidence/<project>/<package-version>/ — the pkg
bucket has no lifecycle rules and already holds the durable published
packages. The project segment is load-bearing: package versions are
per-project, so two projects can share a version string and must not share
an evidence directory. The build-key policy gains Get/Put on exactly that
prefix, with NO DeleteObject — evidence is write-once for the key that
writes it.

The evidence-export reader prefers the new home and falls back to the
legacy work-bucket path for releases minted before the move, so a deferred
export of a pre-move release still converges while its copy survives.

Both guards that pinned the old path now pin the new one, including a new
assertion that the copy is in the no-expiry bucket.

The 41 evidence directories still alive in the work bucket were rescued to
the new home before this landed (root mc cp, one-shot pod) — including
every pipelines release back to 0.1.625, the kernel's 6.18.44, and today's
zelnet/zdns/zerotea. Historical CR durableURIs still name the old path;
the records are immutable and their bytes now survive at the new home even
after the old pointers die.

pipeline-bot merged commit 45929862c9 into trunk

2026-08-13 17:01:56 +00:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/pipelines!2039

No description provided.

Rows
Columns