Shipping a binary 4 days late, honestly

说明与用途

一个以可验证发布为目标的 Rust 项目因 CI 失效导致四天未能自动生成二进制文件。最终手动构建的二进制文件被发布，但缺少 DSSE 证明，违背了项目的可验证性目标。

问题

The CI pipeline that should build, checksum, and attest release artifacts was dead, preventing automated binary release.

结果

The project shipped a single‑platform binary outside CI, with no machine‑verified provenance, after a four‑day delay caused by a dead CI pipeline.

工作流

• 1. Identify CI failure and confirm pipeline never ran.
• 2. Checkout the v0.1.0‑alpha tag commit locally.
• 3. Build the Rust workspace targeting x86_64‑unknown‑linux‑gnu.
• 4. Package the binary into a tar.gz with a SHA256SUMS file.
• 5. Publish the tarball and checksum to the release page.
• 6. Document the limitations (no attestation, single platform) in the release notes.

证据

The repo's CI has been billing‑blocked since 2026-08-15T17:25:29Z. Not failing: refused.

来源

The binary landed on the tag on 2026-08-31 at 20:13 UTC. Four days, six hours, forty minutes.

来源