|
| 1 | +# Distribution & Integrity |
| 2 | + |
| 3 | +VibeAuracle uses a highly portable distribution strategy centered around a single, statically-linked Go binary. |
| 4 | + |
| 5 | +## CI/CD Pipeline |
| 6 | + |
| 7 | +We use GitHub Actions (`release.yml`) to manage a complex matrix of builds. On every tag (`v*`) or push to the `release` branch, the following occurs: |
| 8 | + |
| 9 | +1. **Cross-Compilation:** We build for 7+ targets: |
| 10 | + * `linux/amd64`, `linux/arm64` |
| 11 | + * `darwin/amd64`, `darwin/arm64` (macOS) |
| 12 | + * `windows/amd64`, `windows/arm64` |
| 13 | + * `android/arm64` (Native Termux support) |
| 14 | +2. **Metadata Injection:** Version strings, Git commits, and build timestamps are baked into the binary using `-ldflags`. |
| 15 | +3. **Checksum Generation:** A `checksums.txt` file is generated containing SHA-256 hashes of every artifact. |
| 16 | +4. **Rolling Releases:** The `release` branch always maintains a `latest` rolling tag, allowing users to track the "Stable-Edge" without waiting for semantic version increments. |
| 17 | + |
| 18 | +## Strict Integrity Policy |
| 19 | + |
| 20 | +Security is a primary concern for a tool with system-level access. VibeAuracle enforces a **Strict Integrity Policy**: |
| 21 | + |
| 22 | +* **Mandatory Verification:** During any binary update, the tool *must* successfully download and parse the remote `checksums.txt`. |
| 23 | +* **Fail-Hard:** If the checksum file is missing, or if the downloaded binary's hash does not match, the update process is aborted immediately. |
| 24 | +* **Audit Trail:** Every integrity check (success or failure) is logged to the lifecycle audit database. |
| 25 | + |
| 26 | +## Discovery Mechanism |
| 27 | + |
| 28 | +The tool uses a multi-layered discovery process to check for updates: |
| 29 | +1. **Git Discovery:** Uses `git ls-remote` to bypass GitHub API rate limits and get the latest commit hashes directly from the repository. |
| 30 | +2. **API Fallback:** If Git is unavailable, it falls back to the GitHub Releases API. |
| 31 | +3. **Metadata Comparison:** It compares the embedded `Commit` hash of the running binary against the remote target to determine if an update is truly necessary, even if versions appear the same. |
0 commit comments