Build on the host network, as codehull already does #58

Merged

PerishFire merged 1 commit from land/ship-face into main 2026-07-31 06:11:00 +00:00

Conversation 0 Commits 1 Files changed 1 +1 -1

PerishFire commented 2026-07-31 06:07:11 +00:00

Owner

Copy link

release: advance ensign to 0.2.0

0.1.3 is already on the registry and ship is idempotent by version, so it
would have reported every artifact pushed and left the old binary serving.

0.2.0 rather than a patch. One unit became three: Actor keeps what ensign
decides about a person, Profile what the world may see, Source one way
of signing in, and Pass roots at the Source rather than the person. The
subject in a token is an opaque value rather than a row id. An access token
carries the audience it was requested for instead of the issuer. The
configuration file is named for this product rather than for keel.

Nothing that ran against 0.1.3 runs against it unchanged, and no store from
it can be opened — the estate is rebuilt, which costs nothing because none
was ever deployed.

ship: build on the host network, as codehull already does

The image build could not reach crates.io: thirty seconds, zero bytes,
then a failure two thousand seconds into the run. Nothing was published,
so at least it failed cleanly.

codehull passes --network=host to the same build and ships fine. ensign
did not, so its build ran on the default bridge, which does not get out of
this host. The two delivery paths are meant to be the same shape and had
quietly drifted — ensign last published an image at 0.1.3, long enough ago
that nobody had walked this path since.

This makes them the same. It is not the better answer: --network=host
gives up the build's network isolation rather than giving it a route.
Pointing the build at a reachable crates.io mirror would be the right fix,
and this host already mirrors container images. That is a separate change
and a separate decision; this one only removes the difference between two
repositories that are supposed to deliver alike.

release: advance ensign to 0.2.0 0.1.3 is already on the registry and ship is idempotent by version, so it would have reported every artifact pushed and left the old binary serving. 0.2.0 rather than a patch. One unit became three: `Actor` keeps what ensign decides about a person, `Profile` what the world may see, `Source` one way of signing in, and `Pass` roots at the Source rather than the person. The subject in a token is an opaque value rather than a row id. An access token carries the audience it was requested for instead of the issuer. The configuration file is named for this product rather than for keel. Nothing that ran against 0.1.3 runs against it unchanged, and no store from it can be opened — the estate is rebuilt, which costs nothing because none was ever deployed. ship: build on the host network, as codehull already does The image build could not reach crates.io: thirty seconds, zero bytes, then a failure two thousand seconds into the run. Nothing was published, so at least it failed cleanly. codehull passes `--network=host` to the same build and ships fine. ensign did not, so its build ran on the default bridge, which does not get out of this host. The two delivery paths are meant to be the same shape and had quietly drifted — ensign last published an image at 0.1.3, long enough ago that nobody had walked this path since. This makes them the same. It is not the better answer: `--network=host` gives up the build's network isolation rather than giving it a route. Pointing the build at a reachable crates.io mirror would be the right fix, and this host already mirrors container images. That is a separate change and a separate decision; this one only removes the difference between two repositories that are supposed to deliver alike.

PerishFire added 1 commit 2026-07-31 06:07:11 +00:00

Build on the host network, as codehull already does ... 0341b9a8c0

release: advance ensign to 0.2.0

0.1.3 is already on the registry and ship is idempotent by version, so it
would have reported every artifact pushed and left the old binary serving.

0.2.0 rather than a patch. One unit became three: `Actor` keeps what ensign
decides about a person, `Profile` what the world may see, `Source` one way
of signing in, and `Pass` roots at the Source rather than the person. The
subject in a token is an opaque value rather than a row id. An access token
carries the audience it was requested for instead of the issuer. The
configuration file is named for this product rather than for keel.

Nothing that ran against 0.1.3 runs against it unchanged, and no store from
it can be opened — the estate is rebuilt, which costs nothing because none
was ever deployed.

ship: build on the host network, as codehull already does

The image build could not reach crates.io: thirty seconds, zero bytes,
then a failure two thousand seconds into the run. Nothing was published,
so at least it failed cleanly.

codehull passes `--network=host` to the same build and ships fine. ensign
did not, so its build ran on the default bridge, which does not get out of
this host. The two delivery paths are meant to be the same shape and had
quietly drifted — ensign last published an image at 0.1.3, long enough ago
that nobody had walked this path since.

This makes them the same. It is not the better answer: `--network=host`
gives up the build's network isolation rather than giving it a route.
Pointing the build at a reachable crates.io mirror would be the right fix,
and this host already mirrors container images. That is a separate change
and a separate decision; this one only removes the difference between two
repositories that are supposed to deliver alike.

Land-Source: ship-face@09bd65c117776d5b0d64505c26c8794dd1520ad0

PerishFire merged commit 0341b9a8c0 into main 2026-07-31 06:11:00 +00:00

PerishFire deleted branch land/ship-face 2026-07-31 06:11:00 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

PerishLab/ensign!58

No description provided.