Shipping a binary 4 days late, honestly

Description and use

A Rust project aimed at verifiable releases faced a dead CI pipeline, delaying automated binary publication for four days. A manually built binary was released without DSSE attestation, undermining the project's verifiability goals.

Problem

The CI pipeline that should build, checksum, and attest release artifacts was dead, preventing automated binary release.

Outcome

The project shipped a single‑platform binary outside CI, with no machine‑verified provenance, after a four‑day delay caused by a dead CI pipeline.

Workflow

• 1. Identify CI failure and confirm pipeline never ran.
• 2. Checkout the v0.1.0‑alpha tag commit locally.
• 3. Build the Rust workspace targeting x86_64‑unknown‑linux‑gnu.
• 4. Package the binary into a tar.gz with a SHA256SUMS file.
• 5. Publish the tarball and checksum to the release page.
• 6. Document the limitations (no attestation, single platform) in the release notes.

Evidence

The repo's CI has been billing‑blocked since 2026-08-15T17:25:29Z. Not failing: refused.

Source

The binary landed on the tag on 2026-08-31 at 20:13 UTC. Four days, six hours, forty minutes.

Source