Repository navigation
Release 0.6.1: smoother Windows install and verifiable release binaries - #190
Merged
Merged
Conversation
Each archive and the binary inside it get a Sigstore build provenance attestation, so `gh attestation verify` can tie any copy, npm-installed or downloaded, to this workflow and commit. A checksums job writes SHA256SUMS from the archives as they sit on the release.
`serve --detach` starts the server in its own process, logs to .zerograph/serve.log and returns once the socket listens. `stop` asks the server to leave through the exit that removes its socket file, which a kill does not run on Windows. The first model download on Windows also prints the Defender exclusion command for the cache.
Windows refuses to replace a running image, so `npm i -g` failed under a live serve. The launcher now runs a copy kept in %LOCALAPPDATA%\zerograph\bin\<version> and prunes older copies once nothing runs them. CI overwrites the package binary under a detached server and stops it through the launcher.
`stop` now fails when the socket outlives the wait instead of reporting success. The launcher keys its Windows copy on the install's size and creation time rather than size alone, and sweeps temp files a killed launcher left. The Defender hint doubles single quotes in the path.
devmaxxx
changed the title
…Windows CreateProcess hands the child every inheritable handle, and this process's own standard handles are inheritable when its parent made them so. A detached serve therefore held the caller's output pipe, and anything reading `serve --detach` output waited until the server exited. Clear the inherit flag on the originals before the spawn.
…r copy per install The build job runs every dependency's build script, so granting it id-token let any of them mint a token npm's trusted publishing would accept. Attestations and SHA256SUMS now come from a separate job that only downloads the release archives. The Windows launcher kept one copy per version and deleted every other version's on each new copy, so two installs on one machine evicted each other and could leave the package binary running again. Each install now gets its own slot, and slots unused for 30 days are swept. The release notes say an upgrade under a server started by 0.6.0 still needs that server stopped first.
This was referenced Oct 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part of #189 (everything except the SignPath application, which is the owner's).
SHA256SUMSon every release.zerograph serve --detach(own process,.zerograph/serve.log, returns once listening) andzerograph stop(leaves through the exit that removes the socket, so Windows no longer strands it).%LOCALAPPDATA%\zerograph\bin, sonpm i -gsucceeds under a live server.Test plan
cargo test --test serve: three new tests (stop, stop with no server, detach then ask then stop) pass with the existing 17.cargo clippy --all-targets -- -D warningsclean.SHA256SUMSare first exercised by the 0.6.1 tag run.