Two --from-md5 runs with different hash lists wrote the same file, the
second replacing the first, and a pack limited to thirty systems built
a name longer than a file name may be. The custom pack now carries a
digest of its hash list, and a long system list keeps its first system,
a count and a digest, as the emulator pack does.
hypseus-singe asks for gamecontrollerdb.txt by name alone and, first
in profile order, took the BIOS root of Batocera, RetroBat and
RetroPie with C-Dogs' small table while Solarus pins its own by sha1.
A destination two cores claim now goes to the one naming its content.
lrps2 names no hash for its GameIndex.yaml, and the only full-tail
copy was ARMSX2's: it counted as path proof and replaced the file
RetroArch pins on desktop targets, which have no ARMSX2. Upstream
PCSX2 took ARMSX2's patches.zip by name the same way. A copy in
another emulator's tree now proves nothing at any tail length, and
LRPS2's own GameIndex comes from the tree the buildbot publishes.
Step 2 refreshed the data directories, then the pack build and the
manifest build refreshed them again, so a tree tracking a moving
branch could differ between the pack and the manifest. generate_pack
gains --no-refresh-data, which packs the cached trees and still
fetches release assets; the online pipeline passes it to both builds.
The RetroArch and Lakka pack was built under RetroArch's own name and
renamed afterwards, which overwrote then carried away a --platform
retroarch pack in the same directory, and failed on Windows where
os.rename refuses an existing target.
--system snes joined 23 emulator names into the ZIP name and died
with ENAMETOOLONG before writing anything. The system pack now passes
its own name in, and an --emulator selection too long to join keeps
its first name, a count and a digest of the selection.
kenji-nx cited tmp/es-de/ANDROID.md:470-474, a path from the machine of
whoever profiled it. No revision of any declared repository holds it, so
profile_sync could only report it missing, every pass, forever, and no
amount of reading would ever settle it.
validate_schemas now refuses a scratch directory, an absolute path, a
Windows drive path and one climbing out of the tree, and names the
offending citation rather than the scalar that carries it. Offline, so it
runs on every push and every pull request rather than waiting for a
network pass.
The ES-DE citation reads as external now, which is what it always was.
kenji-nx is at 37 refs, all anchored: the three changed blocks were var
giving way to explicit types.
SHA256SUMS.txt sat beside the artifacts it vouches for, so whoever could
rewrite a release rewrote the list with it. The packs were already
reproducible, which answers corruption and lets a third party rebuild an
archive byte for byte; nothing answered a rewritten release.
The list is now signed with an ed25519 key kept for this alone, and the
public half is allowed_signers at the repository root, so verification
does not go through the release page: ssh-keygen -Y verify against the
committed file, then sha256sum --check. Rehearsed on all three outcomes:
a good signature, a tampered pack caught by the sums, a rewritten list
caught by the signature.
The release steps sign and upload the signature, the README points a
downloader at the procedure, and the reproducibility section says what
each half proves. Rotation keeps retired lines so past releases stay
verifiable. Three tests hold the trust root, the signing step and the
documented principal in agreement.
Abdessamad Derraz