Shipping a binary 4 days late, honestly
Full disclosure before anything else, since this is a post about a release: the tarball described here was built on my machine, not by CI. It carries no DSSE attestation, covers exactly one platform, and its download counter reads 1 as I write this. The 1 was us, checking the link. If you're looking for a supply-chain success story, this isn't one. The gap between what shipped and what should…
On August 27, 2026, a Rust project published a tag, v0.1.0-alpha, indicating that agent writes should be verifiable and reversible. However, the actual binary release was delayed by four days, from August 31 to September 4, 2026. This delay occurred due to the repository's CI system being blocked since August 15, 2026, preventing the binary build from executing.
The project owner decided to manually build the binary outside of CI, emphasizing that the binary was built from the tag commit rather than the main branch to avoid any origin mismatch. The binary, named gx-v0.1.0-alpha-x86_64-unknown-linux-gnu.tar.gz, was 6,567,175 bytes in size, along with a 114-byte SHA256SUMS file. The project's release note highlighted the delay, stating that the binary was built outside of CI and had no attestation or verification.
The project's standard during the delay was to ship a tag with no binaries and a README asking users to compile the Rust workspace themselves. Despite the delay, there were no downloads and no users waiting for the release. The project's issues related to a real pipeline, cross-platform builds, and Digital Signature for Software Supply Chains (DSSE) remained open, and they were not closed to make the release appear finished.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
