docs: fat-jar release-asset policy + cross-repo checksum drift check - #24
Merged
bernardladenthin merged 6 commits intoJul 24, 2026
Merged
Conversation
Document the shared invariant that a jar-with-dependencies is a GitHub-Release download asset only (never Maven Central), attached with a detached GPG .asc signature, plus the deliberately different per-repo shapes (BAF single jar; jllama multi-backend all-<os> jars; srcmorph per-llama-classifier CLI jars; sb none) and the workflow_dispatch/publish_to_central gating caveat. - New canonical policies/fat-jar-release-assets.md. - List it in the CLAUDE.md layout. - Rewrite the outdated crossrepostatus "per-run CI artifact only — BAF + jllama" entry: the fat jars are now signed GitHub-Release assets across BAF, jllama and srcmorph, and point it at the new policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TJzCezSnQ8FxpFdeVxYxQY
jllama and srcmorph now sign their loose fat jars with a byte-identical .github/sign-fatjars.sh (dual MIT OR Apache-2.0); record the sync discipline and that BAF instead signs its attached fat jar via maven-gpg. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TJzCezSnQ8FxpFdeVxYxQY
Add the canonical checksum of the byte-identical shared script plus a one-liner to verify both repo copies from the workspace repo, and require updating the hash on any intentional edit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TJzCezSnQ8FxpFdeVxYxQY
Record the signing-selftest .kts SHA-256s (now literally byte-identical in all 4 after the MIT OR Apache-2.0 unification) plus sign-fatjars.sh in one drift-check table in crossrepostatus.md, with a single verify command runnable from the workspace repo. Correct the verify-signing-key-gradle row's "byte-identical" claim (the SPDX header had drifted until now). Point the fat-jar policy at this one table instead of duplicating the sign-fatjars hash. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TJzCezSnQ8FxpFdeVxYxQY
lombok.config is now byte-identical across the 3 Lombok repos (jllama/BAF/srcmorph) after syncing them to the canonical policy block verbatim. Add its SHA-256 as the 4th row of the drift-check table and update lombok-config.md's Sync check to point at it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TJzCezSnQ8FxpFdeVxYxQY
Add bug_report.md / feature_request.md / PULL_REQUEST_TEMPLATE.md (already
byte-identical across all 4 repos) as rows 5-7 of the cross-repo checksum
drift-check table, and extend the verify command. Fix the verify snippet to list
repo names explicitly inside each brace group (bash brace expansion runs before
variable expansion, so a $var inside {…} would not expand). Verified: all 25 files
across the 7 tracked paths collapse to one hash per file.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TJzCezSnQ8FxpFdeVxYxQY
bernardladenthin
deleted the
claude/bitcoinaddressfinder-jar-upload-k0tkj7
branch
July 24, 2026 06:28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Canonical cross-repo docs for the work that lands in the four sibling PRs (same branch name):
policies/fat-jar-release-assets.md— the convention that ajar-with-dependenciesis a GitHub-Release download asset only (never Maven Central), attached with a detached GPG.asc, plus the deliberately different per-repo shapes (jllama multi-backendall-<os>jars; srcmorph per-llama-classifier CLI jars; BAF single jar; streambuffer none) and theworkflow_dispatch/publish_to_centralgating caveat. Listed inCLAUDE.md.crossrepostatus.md(single source of truth, verifiable from the workspace repo) tracking 7 files:signing-selftest/{build,settings}.gradle.kts,sign-fatjars.sh,lombok.config, and the 3 shared GitHub templates. Corrects the earlier imprecise "byte-identical" claim forverify-signing-key-gradle(its SPDX header had drifted, now unified).lombok-config.mdSync-check now points at the checksum table (the 3 Lombok copies are byte-identical to the canonical block; the rationale lives here, not in the files).Docs only.
Notes
.editorconfig,.gitattributes,FUNDING.yml, the security/claude*workflows, etc.) showed their remaining differences are legitimate — per-repo SPDX headers (java-llama.cpp is MIT and credits itsKonstantin Herudfork heritage; BAF/srcmorph are Apache-2.0; copyright years differ) plus a few repo-specific lines. Those cannot and should not be byte-identical.Sibling PRs: java-llama.cpp / BitcoinAddressFinder / srcmorph / streambuffer.
🤖 Generated with Claude Code
https://claude.ai/code/session_01TJzCezSnQ8FxpFdeVxYxQY
Generated by Claude Code