-
-
Notifications
You must be signed in to change notification settings - Fork 0
Publishing
hyperpolymath edited this page Aug 8, 2026
·
1 revision
The process for publishing new releases of Svalinn is highly automated but requires manual cryptographic signing by multiple maintainers.
- Freeze: A release branch is created. No new features are merged.
- Audit: A full audit of the verification proofs is executed.
- Build: Reproducible builds are generated via CI.
-
Sign: At least three core maintainers (listed in
MAINTAINERS) must sign the release artifacts using their offline hardware keys. - Distribute: Artifacts are pushed to the container registry, crates.io, and the GitHub Releases page.
We use an M-of-N threshold signature scheme for all releases. The public keys for verification are located in the security/keys directory. Users must verify these signatures before deployment.
In the event of a critical security vulnerability, the release process is accelerated, but the multi-signature requirement remains strictly enforced to prevent compromised infrastructure from distributing malicious binaries.