From ebe1c0778ecbf9d402f6cde7f1e1ed6c99a1486e Mon Sep 17 00:00:00 2001 From: ruizkinio Date: Thu, 13 Aug 2026 20:05:42 +0200 Subject: [PATCH 1/2] release: refresh Bridge candidate for VobSub UAT --- docs/RELEASE_NOTES_DRAFT.md | 4 ++-- docs/RELEASE_STATUS.md | 7 +++++-- release/candidate.json | 18 +++++++++--------- release/tests/validate-release.test.mjs | 2 +- release/validate-release.mjs | 2 +- stremio-addon | 2 +- 6 files changed, 19 insertions(+), 16 deletions(-) diff --git a/docs/RELEASE_NOTES_DRAFT.md b/docs/RELEASE_NOTES_DRAFT.md index 2f161a6..be56fcc 100644 --- a/docs/RELEASE_NOTES_DRAFT.md +++ b/docs/RELEASE_NOTES_DRAFT.md @@ -54,8 +54,8 @@ code, token, or provider URL. | `Jumpgate-22.0-ALPHA2-Jumpgate-3.0.0-armeabi-v7a.apk` | `9ff620c0d07f7dffd960a0b7620b30dfcbbdb7efcbe5e969ac719b7d643ab763` | `armeabi-v7a` | `io.github.ruizkinio.jumpgate` | `10625572b5f34c5125b030dd5ab5fd40bdcd263d0fa8e2073ddee70435970551` | - Jumpgate Kodi commit: `b105087fb2ec00db4576e2f4b1221f9c45acd84f` -- Bridge commit: `28848c13ae515c651e267e1f1ab9f24ebabd168c` -- Bridge image digest: `sha256:05e9d5a79aaff27a81b61f548bef78933ec541d5af59b1d1f2bcb2cc3ca17b6a` +- Bridge commit: `a2716ae68e9ce88561ed0ebc9ec1092cd20c3535` +- Bridge image digest: `sha256:08599364f5bfdc6573bdf8e4d0e91ee4e0d7e38433e60fc993773e55dce21618` - Candidate lock commit: `86c5ee83211c48c49b386aa0fe3df0ec3d61c47a` - Protected non-physical release validation: `https://github.com/ruizkinio/Jumpgate/actions/runs/31706953795` - Sanitized device UAT evidence: `{{UAT_EVIDENCE_URL}}` diff --git a/docs/RELEASE_STATUS.md b/docs/RELEASE_STATUS.md index 2d7ae47..325ff54 100644 --- a/docs/RELEASE_STATUS.md +++ b/docs/RELEASE_STATUS.md @@ -5,11 +5,11 @@ candidate is locked to these public component commits: | Input | Public branch | Candidate commit | | --- | --- | --- | -| Bridge | `Jumpgate-bridge/main` | `28848c13ae515c651e267e1f1ab9f24ebabd168c` | +| Bridge | `Jumpgate-bridge/main` | `a2716ae68e9ce88561ed0ebc9ec1092cd20c3535` | | Kodi | `Jumpgate-kodi/master` | `b105087fb2ec00db4576e2f4b1221f9c45acd84f` | The Bridge is deployed at immutable image digest -`sha256:05e9d5a79aaff27a81b61f548bef78933ec541d5af59b1d1f2bcb2cc3ca17b6a`. +`sha256:08599364f5bfdc6573bdf8e4d0e91ee4e0d7e38433e60fc993773e55dce21618`. Protected deployment provenance and live health checks pass for that digest. Kodi's protected stable release workflow produced signed `arm64-v8a` and @@ -24,6 +24,9 @@ physical UAT passes. - Bridge deployment attestation, live image digest, `/health/live`, `/health/ready`, and `/version` pass. - Kodi host tests and both Android ABI builds pass protected CI. +- The deterministic UAT-only VobSub provider passes live HTTPS transport and + integrity checks against the exact merged Bridge commit. Its isolated Fly image + is test infrastructure and is not part of the production candidate lock. - The reproducible public-history audit in protected run `31706953795` reports zero unresolved findings. That run also independently verified the final Jumpgate and Stremio APKs, Bridge deployment provenance, live Bridge state, and current GitHub diff --git a/release/candidate.json b/release/candidate.json index 47758ae..d5e3e7d 100644 --- a/release/candidate.json +++ b/release/candidate.json @@ -5,24 +5,24 @@ "bridge": { "repository": "https://github.com/ruizkinio/Jumpgate-bridge.git", "branch": "main", - "commit": "28848c13ae515c651e267e1f1ab9f24ebabd168c", - "imageDigest": "sha256:05e9d5a79aaff27a81b61f548bef78933ec541d5af59b1d1f2bcb2cc3ca17b6a", + "commit": "a2716ae68e9ce88561ed0ebc9ec1092cd20c3535", + "imageDigest": "sha256:08599364f5bfdc6573bdf8e4d0e91ee4e0d7e38433e60fc993773e55dce21618", "provenance": { - "runUrl": "https://github.com/ruizkinio/Jumpgate-bridge/actions/runs/31697768697", + "runUrl": "https://github.com/ruizkinio/Jumpgate-bridge/actions/runs/31727797491", "workflowId": 320575057, "workflowPath": ".github/workflows/fly-deploy.yml", "event": "push", "branch": "main", "headRepository": "ruizkinio/Jumpgate-bridge", "imageArtifact": { - "id": 9180010405, - "name": "jumpgate-image-28848c13ae515c651e267e1f1ab9f24ebabd168c", - "archiveDigest": "sha256:44a64b91982fcacf271ddd2c8567ef42491ac25db7820aa5144e2f1fa02dbc9d" + "id": 9191991638, + "name": "jumpgate-image-a2716ae68e9ce88561ed0ebc9ec1092cd20c3535", + "archiveDigest": "sha256:b67971493345e5c4f7004ba48ea4ed04084899ec02082935bcb5e36ea4650403" }, "deploymentAttestationArtifact": { - "id": 9180257108, - "name": "jumpgate-deployment-attestation-31697768697-1-28848c13ae515c651e267e1f1ab9f24ebabd168c", - "archiveDigest": "sha256:e0f3767582911653c3a937b0409e9fa4c0677f0dfbe15b3bcd30cef193d9490c" + "id": 9192230605, + "name": "jumpgate-deployment-attestation-31727797491-1-a2716ae68e9ce88561ed0ebc9ec1092cd20c3535", + "archiveDigest": "sha256:99dfb5fd3a749648c0e6e5a36cd682008d9eee4e46ea5d4c14a2a3a580cbc96a" } } }, diff --git a/release/tests/validate-release.test.mjs b/release/tests/validate-release.test.mjs index 3474aaa..c6ce3a4 100644 --- a/release/tests/validate-release.test.mjs +++ b/release/tests/validate-release.test.mjs @@ -596,7 +596,7 @@ test("audited component executable closures are exact and reject byte or policy ["scripts/ci/fly-managed-rollout.js", "9cc954b815c012130e636f9fc2944873561efe7d1b3cf9f1bb7068f9cee7245f"], ["scripts/ci/deployment-attestation.js", "8bdd29ef1c9ae853bf90ed438f39d1083ea05526779e553971833ee00c87ffc0"], ["scripts/ci/http-smoke.js", "c1a658a8e17d4eed4041c71ac8834fe9ef254a59c9f075a81b10cdd83a223ff0"], - ["package.json", "0afead6fde8d3ed72e8f98d49f2883ef10d3917cbf646ce7a8828c1cdbe05d51"], + ["package.json", "9676fb8056525cc68504fb91565c857f81fa5a12f75548b8b8ba0be65534c2c7"], ["package-lock.json", "00e73f23ee5363e2e753d81e28cba047bc8bce7ba5a360be00608b792dd18016"], [".npmrc", "89570b4333de5a4920e113d299e774c671b4e83ebfe34757ad27c3960a7bd269"], ["fly.toml", "723cfbe7a912d2d2bd0b70f7e113d6e676349825a5a875d250a891a09dc05c99"], diff --git a/release/validate-release.mjs b/release/validate-release.mjs index 5ca11cc..5811b75 100644 --- a/release/validate-release.mjs +++ b/release/validate-release.mjs @@ -36,7 +36,7 @@ export const COMPONENT_POLICIES = Object.freeze({ }), Object.freeze({ path: "package.json", - sha256: "0afead6fde8d3ed72e8f98d49f2883ef10d3917cbf646ce7a8828c1cdbe05d51", + sha256: "9676fb8056525cc68504fb91565c857f81fa5a12f75548b8b8ba0be65534c2c7", }), Object.freeze({ path: "package-lock.json", diff --git a/stremio-addon b/stremio-addon index 28848c1..a2716ae 160000 --- a/stremio-addon +++ b/stremio-addon @@ -1 +1 @@ -Subproject commit 28848c13ae515c651e267e1f1ab9f24ebabd168c +Subproject commit a2716ae68e9ce88561ed0ebc9ec1092cd20c3535 From 3f45978395425f12edf0123c71735536974c611e Mon Sep 17 00:00:00 2001 From: ruizkinio Date: Thu, 13 Aug 2026 20:06:33 +0200 Subject: [PATCH 2/2] release: bind Bridge VobSub review --- release/tests/validate-release.test.mjs | 2 +- release/validate-release.mjs | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/release/tests/validate-release.test.mjs b/release/tests/validate-release.test.mjs index c6ce3a4..c4141ff 100644 --- a/release/tests/validate-release.test.mjs +++ b/release/tests/validate-release.test.mjs @@ -509,7 +509,7 @@ test("rewritten Kodi history requires the exact clean anchor and protected PR ch ); assert.deepEqual(COMPONENT_POLICIES.bridge.requiredPullRequests, [ - 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, + 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, ]); }); diff --git a/release/validate-release.mjs b/release/validate-release.mjs index 5811b75..e4e5932 100644 --- a/release/validate-release.mjs +++ b/release/validate-release.mjs @@ -52,7 +52,7 @@ export const COMPONENT_POLICIES = Object.freeze({ }), ]), requiredPullRequests: Object.freeze([ - 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, + 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, ]), }), kodi: Object.freeze({