hackclub/burrow
1
0
Fork 0
Code Pull requests Releases Packages Activity Actions

Route public release storage domains
Some checks failed
Cache: Publish Nix / Publish Nix Cache (push) Successful in 3m19s
Details
Build Rust / Cargo Test (push) Successful in 4m1s
Details
Build Site / Next.js Build (push) Failing after 5s
Details
Lint Governance / BEP Metadata (push) Successful in 1s
Details

Browse source
This commit is contained in:
Conrad Kramer 2026-06-07 18:37:47 -07:00
parent b06244e88c
commit dd7dc89341
2 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md
View file

@ -191,6 +191,10 @@ The same change also makes the forge itself the release authority: release tags
- Publish `sparkle/<channel>/`, `sparkle/appcast.xml`, and `sparkle/default/` pointers from `publish-store-uploads`.
- The macOS app embeds Sparkle and consumes the `https://releases.burrow.net/sparkle/appcast.xml` feed.
- Add `infra/releases` as the OpenTofu boundary for the GCS release and package repository backup buckets. Garage is the required S3-compatible primary distribution target after host bootstrap. `infra/identity` remains the boundary for Google KMS signing keys, the Authentik WIF pool/provider, and the runner service account.
- Serve `releases.burrow.net` and `packages.burrow.net` from the forge Caddy
edge as stable Burrow domains backed by the GCS release and package buckets.
Appcast enclosure URLs and package repository metadata must use those Burrow
domains instead of provider-specific object-storage URLs.
## Security and Operational Considerations