R1 MeshDB v1.0.1

R1 MeshDB is an independently maintained Ratio1 distribution of a source-derived OSS runtime closure from CockroachDB v23.1.28. It packages the OSS database engine with the runtime entrypoint used by the Ratio1 Deeploy service.

This project is not affiliated with or endorsed by Cockroach Labs. CockroachDB is a trademark of Cockroach Labs, Inc. The original engine source and its copyright notices are retained under engine/.

Version

The current R1 MeshDB product version is 1.0.1. VERSION is the single source of truth: the build validates it, installs it in the image at /usr/share/r1-meshdb/VERSION, and records it in generated SPDX and CycloneDX SBOM application metadata. A merged VERSION change automatically starts the signed release workflow; the file must contain canonical MAJOR.MINOR.PATCH.

Image

The release image is published as:

ghcr.io/ratio1/r1-meshdb

Production deployments must use an immutable digest. Release workflows publish an immutable version tag and update latest only after release publication, but those tags are not a substitute for a digest pin.

The executable intentionally remains /cockroach/cockroach to preserve the upstream wire protocol, on-disk format, diagnostic tooling, and existing Deeploy runtime contract. A release binary must pass:

./cockroach version | grep -F 'Distribution:     OSS'

Source Boundary

The engine snapshot is derived from upstream tag v23.1.28, commit 76e598c9b1c100fd9280b979140b5e377c330a20. Its Business Source License change date was 2026-04-01, after which covered source is available under Apache-2.0. Files that carry the CockroachDB Community License are not included.

See UPSTREAM.md, RATIO1_PATCHES.md, and source/provenance.json for exact provenance and exclusions. scripts/verify-source-boundary.py audits both the checked-out tree and every reachable Git object before release.

Build

The container build uses the checked-in, affirmatively licensed runtime source closure, generated parsers, vendored Go modules, and native dependency source. The engine compilation runs with GOPROXY=off; it does not clone or download upstream engine source and does not consume an upstream CockroachDB image or builder. Cloudflared is independently compiled in vendor mode from an exact Cloudflare source commit whose archive checksum, source metadata, compiled package closure, binary hash, licenses, notices, and patent texts are enforced.

docker build -t r1-meshdb:local .
docker run --rm --entrypoint /cockroach/cockroach \
  r1-meshdb:local version

Run source and release-contract checks with:

python3 -m unittest tests.test_release_contract tests.test_sbom_contract
python3 scripts/verify-source-boundary.py --worktree-only
python3 scripts/generate-license-inventory.py --check
python3 scripts/verify-provenance.py
scripts/verify-upstream-provenance.sh  # authoritative; requires Docker and network access
python3 scripts/verify-public-test-fixtures.py
python3 scripts/verify-security-vex.py
python3 scripts/generate-source-manifest.py --check

The three-node runtime suite is documented in testbed/README.md.

Supply Chain

Releases include SPDX JSON and CycloneDX JSON SBOMs, GitHub build provenance, an OCI SBOM attestation, a keyless Cosign signature recorded in Rekor, exact vendored dependency notices, and a checksum-backed Debian corresponding-source bundle both inside the image and as a release asset. Verification is bound to the Ratio1 repository workflow identity; executable commands are in scripts/verify-image.sh. Repository and package promotion controls are documented in RELEASE.md.

scripts/verify-image.sh \
  ghcr.io/ratio1/r1-meshdb@sha256:<digest> \
  v1.0.1

Support

The upstream v23.1 line is no longer supported upstream. Ratio1 owns review and backport decisions for this distribution. See SECURITY.md for the disclosure and update policy. Operators should evaluate every Ratio1 patch release and plan an engine/store-format migration rather than treating this version as indefinitely supported.

Licensing

Ratio1-authored files and upstream engine files whose change license has taken effect are distributed under Apache License 2.0. Included third-party components retain their own licenses. See LICENSE-OVERVIEW.md, LICENSE, NOTICE, and THIRD_PARTY_NOTICES.md.

Citation

The R1 MeshDB entry below is the recommended citation for the current source snapshot. Publish it with an immutable v1.0.1 tag before treating it as a reproducible release citation.

@software{cockroachdb_23_1_28,
  author  = {{Cockroach Labs, Inc.} and {The Cockroach Authors}},
  title   = {{CockroachDB}},
  version = {23.1.28},
  date    = {2024-10-10},
  url     = {https://www.cockroachlabs.com/docs/releases/v23.1#v23-1-28},
  note    = {Tag v23.1.28; commit 76e598c9b1c100fd9280b979140b5e377c330a20}
}

@software{ratio1_meshdb_1_0_1,
  author  = {{Ratio1}},
  title   = {{R1 MeshDB}},
  version = {1.0.1},
  date    = {2026-08-24},
  url     = {https://github.com/Ratio1/r1-meshdb},
  note    = {Source-derived Ratio1 distribution based on CockroachDB v23.1.28}
}