SHA256SUMS.txt sat beside the artifacts it vouches for, so whoever could
rewrite a release rewrote the list with it. The packs were already
reproducible, which answers corruption and lets a third party rebuild an
archive byte for byte; nothing answered a rewritten release.
The list is now signed with an ed25519 key kept for this alone, and the
public half is allowed_signers at the repository root, so verification
does not go through the release page: ssh-keygen -Y verify against the
committed file, then sha256sum --check. Rehearsed on all three outcomes:
a good signature, a tampered pack caught by the sums, a rewritten list
caught by the signature.
The release steps sign and upload the signature, the README points a
downloader at the procedure, and the reproducibility section says what
each half proves. Rotation keeps retired lines so past releases stay
verifiable. Three tests hold the trust root, the signing step and the
documented principal in agreement.
dedup.py removes a copy only when another file has the same SHA-1 and
the same name, keeping the higher-priority path, so resolution by hash
still finds the content. Verified rather than assumed: all 17268
manifest entries ship the same bytes as before, no destination gained
or lost, only the source paths consolidate. Every deleted path's content
is still held elsewhere.
12.1 MB and 48 empty directories go with them. The index and the
published artefacts are regenerated on top.
The contributors block is the only part of the README that comes from
the network, and a refused request returned an empty list, which deleted
the section. That happened during a pipeline run and the result was
committed; the freshness check then regenerated the section and failed
on the difference.
An unavailable list now republishes the one already there and says so.
Losing it is a worse answer than a stale one, and it makes an offline
regeneration additive rather than destructive. Reverting the change and
simulating the same outage empties the section again.
Rebuilt from the complete state: 8923 files indexed, 436 emulators, and
coverage up on every platform that gained a profile. The gap count falls
from 9 to 7, the three that closed being the C128 kernal, the Cave Story
build and Supermodel's Games.xml.
Whole pipeline green on this revision: database, provenance, recipes,
data directories, hash scrapers, truth, verify, packs, manifests,
consistency and pack integrity across the twelve platforms.
The manifests moved and the table did not. Most packs grow by about
1.4 GB: a filename-agnostic core takes any file of the declared shape in
its directory, and melonDS now finds all six regional DSi NAND images
where the anchor previously settled on one. The Android app assets that
left in the same pass were small by comparison.
The counts were generated from a working tree holding profiles that are
still being written and are not committed, so the freshness check
regenerated different numbers from the same revision. They are read from
the committed set now, which is what the check compares against.
Regenerated with the large-file cache populated, the state CI builds
from: without it ten preserved entries resolve differently and the
counts drift by one file.
The README said 14 files were 'not in the collection yet', which
implies somebody could still put them there. Nine of them cannot be:
WHDLoad.key is a per-user signed registration, Custom.dat and key.txt
are slots the emulator expects the user to fill, gpib.rom and
dragonfly-2.3.rom have never been dumped, CARTS.CRC belongs to a dead
code path. The profiles already record why, so the two are now counted
apart: five still to be found, nine that cannot be.
The database drops the duplicate PS3UPDAT.PUP entry and regains
adler32 on every file. RetroPie gains an install manifest, so the
download table reports its size instead of a dash.
Abdessamad Derraz