30 lines
1.4 KiB
Markdown
30 lines
1.4 KiB
Markdown
# ADR 0005: Full and delta release identities
|
|
|
|
Status: Accepted, 2026-09-13.
|
|
|
|
Each source object has its own digest. The selected coverage graph, including
|
|
every active full, partition, base, and delta object and its precedence, has a
|
|
separate digest bound into the generation receipt. A future distributed dataset
|
|
delta must name exact base and target generation identities and preserve
|
|
revocation continuity.
|
|
|
|
An unauthenticated `latest` locator can be a convenience pointer, but never the
|
|
trust root. Consumers authenticate a full receipt pin or publisher signature.
|
|
|
|
Version 0.4 implements source-level full/partition/delta identity and cumulative
|
|
publisher-signed emergency revocation overlays. General downloadable registry
|
|
deltas remain a v0.6 distribution task because they also need mirror-independent
|
|
base/target authentication and consumer transaction semantics.
|
|
|
|
## Rejected alternatives
|
|
|
|
Mutable releases and unpinned `latest` URLs permit substitution and rollback.
|
|
Signing only a compressed archive makes alternate packaging unverifiable. Calling
|
|
a source delta a registry delta would hide changes introduced by review policy,
|
|
normalization, observations, or another provider.
|
|
|
|
## Compatibility
|
|
|
|
V2 receipts bind the selected coverage digest. Current pointers retain every
|
|
legacy and vote revocation across activation. Emergency feeds apply only when
|
|
their rules, policy, and reviewer-trust digests match the cached generation.
|