tebako-release 0.2.1 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 34b2e7ff86b5dcf3a3a56600ad664e32a7b2a7e114e234cc5b2a0f094ffe9010
-  data.tar.gz: 866f3b422839db8d8dcee027cb840acadef89430e874e538946565939a7a954c
+  metadata.gz: 6e91116fb240ffb5e0cb7cec20a1753fbd4177b7bd8f3c78adb8c3e260acf718
+  data.tar.gz: c5c886163f60c1ef021829015d95a1f3c50b6fc239a22a39cb890324041353d1
 SHA512:
-  metadata.gz: 7a138c918d4387006dcf59e2b4771d0f39b3a49baffcf0c01505daacf08a608af24c1413195c123db112f764c5a8e25cf341188d5910f23ca4f909fd4ed7f5e7
-  data.tar.gz: e9e9d4aae48992f997f6d2095ed7cedddfb1e37a27dd050117ae50b447d356b875df7aaa4ee36aa83e2de470e8939ed07860c57aa0211631802e27a39e285c22
+  metadata.gz: 78d61711350a83bc076b26472fab4b468e68368ca6f16f9f4c7bb613149d0a7c9be68821e6646e7469958e24424f59b3b88afd3d45c7b1f01db0b806550d9c69
+  data.tar.gz: 44d1ee55d6bf22f2aa8d6dfdacaa27f26a77170faa2d26a45669425879d6b5ece851d0d5e1072855c6f9fa6a7b2269578f1b112a0d62b34fecf2510bd82fa6a8

data/README.md

@@ -23,7 +23,20 @@ through a small adapter file and pin this gem — they never carry copies.
   in-bundle SHA256SUMS; fixed member order, mtime=0 — identical inputs
   yield identical bytes). A factory opts into the bundle-era publish shape
   through its adapter (`bundle_publish? → true`); the per-file shape stays
-  the default for pre-bundle lines.
+  the default for pre-bundle lines. Bundle-era lines whose consumers
+  include the lazy arm additionally opt into co-publish
+  (`per_file_alongside_bundle? → true`, spec 36 §3): the staged members
+  are served as standalone assets beside the bundle, the shard carries
+  the `per_file_assets` witness (runtime-manifest MINOR 2), the facet
+  signature declarations return, and the audit expects the union.
+- **`TebakoRelease::Blksum`** — the spec 39 §3 block-group digest sidecar
+  (`<image>.blksum.json`: one sha256 per 4 MiB group of env-image bytes,
+  the lazy mount's range-GET trust anchor). The uploader derives it
+  in-process from the staged image at entry-build time — a pure function
+  of the served bytes, the same class as the `.sha256` sidecars — pins it
+  in the shard (`image.blksum {filename, sha256}`), and uploads it as a
+  standalone asset in both publish eras. The render is byte-exact with
+  `tpkg::lazy::Blksum::render`, golden-pinned in `spec/blksum_spec.rb`.
 - **`TebakoRelease::Platform`** — the release-side platform vocabulary
   (the `(os, arch) → host_id` table; mirrors `tpkg::Platform`, drift fails
   loudly in factory CI).

data/lib/tebako_release/adapter.rb

@@ -55,5 +55,18 @@ module TebakoRelease
     def bundle_publish?
       false
     end
+
+    # Spec 36 §3's co-publish: when true (and bundle_publish? holds), each
+    # leg ALSO serves the per-file assets — the exe under its historical
+    # spelling, the env image, the windows DLL — as standalone release
+    # assets beside the bundle, each with its .sha256 sidecar. The lazy
+    # arm (spec 39 §7) range-fetches the image's groups over HTTP, which
+    # is impossible inside the gzip stream; the shard gains the additive
+    # per_file_assets witness (runtime-manifest MINOR 2) that gates the
+    # loaders' lazy arm on bundle-declaring shards. Default off: a
+    # factory opts in when its consumers include the lazy arm.
+    def per_file_alongside_bundle?
+      false
+    end
   end
 end

data/lib/tebako_release/blksum.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+# Copyright (c) 2026 [Ribose Inc](https://www.ribose.com).
+# All rights reserved.
+# This file is a part of tamatebako
+
+require "digest"
+require "json"
+require "pathname"
+
+module TebakoRelease
+  # The spec 39 §3 block-group digest sidecar (`<image>.blksum.json`): one
+  # sha256 per 4 MiB group of image bytes plus the whole-image sha256,
+  # authored by the PUBLISHER in-process (a resolver never derives one).
+  # For the factories the publisher invocation is `tebako-release upload`,
+  # so the derivation lives here — a pure function of the staged image
+  # bytes, the same derivable-metadata class as the `.sha256` sidecars.
+  #
+  # The render is byte-exact with tpkg::lazy::Blksum::render (the product's
+  # single owner of the grammar): compact machine JSON, keys in schema
+  # order, lowercase hex, no trailing newline. spec/blksum_spec.rb pins
+  # tpkg-minted golden vectors against this render — a drift fails the
+  # suite, never ships.
+  class Blksum
+    # The locked fetch unit (spec 39 §11.3): 4 MiB of image bytes; the
+    # final group is short. Tunable only by a measured product follow-up.
+    GROUP_SIZE = 4 * 1024 * 1024
+
+    # `schema_version` of the v1 document.
+    SCHEMA_VERSION = 1
+
+    # The served asset name is the image's name plus this suffix.
+    SIDECAR_SUFFIX = ".blksum.json"
+
+    # The sidecar asset name for an image name (or an image path).
+    def self.sidecar_name(image)
+      "#{Pathname.new(image).basename}#{SIDECAR_SUFFIX}"
+    end
+
+    def self.blksum_file?(path)
+      path.basename.to_s.end_with?(SIDECAR_SUFFIX)
+    end
+
+    # Derive the sidecar of a staged image: streams the file in GROUP_SIZE
+    # chunks (the runtime env images are 50–200 MB — never held whole),
+    # one sha256 per group plus the whole-image sha256. An absent or empty
+    # image is a named refusal (spec 39 §3: size_bytes >= 1).
+    def self.for_image(image_path)
+      path = Pathname.new(image_path)
+      assert_derivable!(path)
+      whole, groups = hash_stream(path)
+      new(size_bytes: path.size, sha256: whole.hexdigest, groups: groups)
+    end
+
+    def self.assert_derivable!(path)
+      raise Error, "the blksum sidecar cannot be derived: #{path} does not exist" unless path.file?
+      raise Error, "the blksum sidecar cannot be derived: #{path} is empty (size_bytes >= 1)" if path.empty?
+    end
+
+    def self.hash_stream(path)
+      whole = Digest::SHA256.new
+      groups = []
+      path.open("rb") do |io|
+        while (chunk = io.read(GROUP_SIZE))
+          whole.update(chunk)
+          groups << Digest::SHA256.hexdigest(chunk)
+        end
+      end
+      [whole, groups]
+    end
+
+    attr_reader :size_bytes, :sha256, :groups
+
+    def initialize(size_bytes:, sha256:, groups:)
+      @size_bytes = size_bytes
+      @sha256 = sha256
+      @groups = groups
+    end
+
+    # The machine JSON form (keys in schema order) — byte-exact with
+    # tpkg::lazy::Blksum::render, golden-pinned in spec/blksum_spec.rb.
+    def render
+      JSON.generate(
+        schema_version: SCHEMA_VERSION,
+        group_size: GROUP_SIZE,
+        size_bytes: size_bytes,
+        sha256: sha256,
+        groups: groups
+      )
+    end
+
+    # The sidecar document's own sha256 (the manifest's
+    # `image.blksum.sha256` pin — spec 39 §3).
+    def digest
+      Digest::SHA256.hexdigest(render)
+    end
+  end
+end

data/lib/tebako_release/uploader.rb

@@ -437,12 +437,13 @@ module TebakoRelease
       nil
     end
 
-    def manifest_entry(package, image = nil, dll = nil, bundle: nil) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+    def manifest_entry(package, image = nil, dll = nil, bundle: nil) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength, Metrics/CyclomaticComplexity
       runtime_version, platform = parse_package_filename(package.basename.to_s)
       contract = contract_sidecar(package)
       filename = package.basename.to_s
       sha256 = Digest::SHA256.file(package).hexdigest
-      register_current_shas(package, image, dll, bundle)
+      blksum = derive_blksum(image) if image
+      register_current_shas(package, image, dll, bundle, blksum)
       {
         tebako_version: @version,
         contract_era: contract.fetch("contract_era"),
@@ -466,9 +467,14 @@ module TebakoRelease
         # selector axis. Sourced from the factory's adapter (the same truth
         # its boot smoke asserts), so manifest and smoke can never disagree.
         entry[:capabilities] = @config.adapter.capabilities(version: runtime_version, platform_id: platform)
-        entry[:image] = image_entry(image) if image
+        entry[:image] = image_entry(image, blksum) if image
         entry[:dll] = dll_entry(dll, runtime_version, platform) if dll
         entry[:bundle] = bundle_entry(bundle) if bundle
+        # Spec 36 §3's co-publish witness (runtime-manifest MINOR 2):
+        # true declares the per-file assets are served standalone beside
+        # the bundle — the lazy arm's gate on bundle-declaring shards
+        # (spec 39 §7). Never emitted on bundle-only lines.
+        entry[:per_file_assets] = true if bundle && copublish?
         declare_signatures(entry)
       end
     end
@@ -486,12 +492,36 @@ module TebakoRelease
     end
 
     # The idempotent upload skip reads these (same name + same sha = kept):
-    # the exe, its facets, and the bundle (spec 36's bundle-era asset).
-    def register_current_shas(package, image, dll, bundle) # rubocop:disable Metrics/AbcSize
+    # the exe, its facets, the derived blksum sidecar (spec 39 §3), and the
+    # bundle (spec 36's bundle-era asset).
+    def register_current_shas(package, image, dll, bundle, blksum = nil) # rubocop:disable Metrics/AbcSize
       current_shas[package.basename.to_s] = Digest::SHA256.file(package).hexdigest
       current_shas[image_name_for(package)] = Digest::SHA256.file(image).hexdigest if image
       current_shas[dll_name_for(package)] = Digest::SHA256.file(dll).hexdigest if dll
       current_shas[bundle.basename.to_s] = Digest::SHA256.file(bundle).hexdigest if bundle
+      current_shas[Blksum.sidecar_name(image)] = blksum.digest if blksum
+    end
+
+    # The spec 39 §3 derivation: the publisher authors the block-group
+    # digest sidecar in-process from the staged image bytes (a pure
+    # function of them — the same derivable-metadata class as the .sha256
+    # sidecars), stages it BESIDE the image so the leg's attestation glob
+    # (runtime-packages/*) covers it, and the entry's `image.blksum` block
+    # pins the document's own sha256. support_file? keeps a staged sidecar
+    # from classifying as a package on a re-run validation.
+    def derive_blksum(image)
+      blksum = Blksum.for_image(image)
+      path = Pathname.new("#{image}#{Blksum::SIDECAR_SUFFIX}")
+      path.write(blksum.render)
+      staged_blksums[path.basename.to_s] = path
+      blksum
+    end
+
+    # The derived sidecar paths this invocation staged, keyed by asset
+    # name — the upload leg's source (entries are built before uploads in
+    # every publish shape, so a declared sidecar is always staged).
+    def staged_blksums
+      @staged_blksums ||= {}
     end
 
     # Spec 13 §2a / spec 09 §5: on signing-enabled lines every artifact the
@@ -505,7 +535,13 @@ module TebakoRelease
       return unless signing_enabled?
 
       keyid = signing_keyid
-      return declare_bundle_signature(entry, keyid) if entry[:bundle]
+      declare_bundle_signature(entry, keyid) if entry[:bundle]
+      # Bundle-only lines serve no other payload asset — declaring the
+      # members' .ascs there would be an invalid signing state (spec 09
+      # §4). A co-published line (spec 36 §3, the shard's per_file_assets
+      # witness) serves the members standalone, so the every-served-name
+      # rule covers the exe/image/dll set again.
+      return if entry[:bundle] && !entry[:per_file_assets]
 
       entry[:signature] = { keyid: keyid, asc: "#{entry[:filename]}.asc" }
       %i[image dll].each do |facet|
@@ -514,10 +550,10 @@ module TebakoRelease
       end
     end
 
-    # Bundle-era (spec 36 §3): the only served payload is the bundle —
-    # three signatures per leg (bundle, its sidecar, the shard). The
-    # exe/image/dll member pins are NOT served assets; declaring their
-    # .asc would be an invalid signing state (spec 09 §4).
+    # Bundle-era (spec 36 §3): the bundle's own signature declaration.
+    # On bundle-only lines it is the ONLY payload signature — three
+    # signatures per leg (bundle, its sidecar, the shard); co-published
+    # lines add the per-file declarations on top (declare_signatures).
     def declare_bundle_signature(entry, keyid)
       entry[:bundle][:signature] = { keyid: keyid, asc: "#{entry[:bundle][:filename]}.asc" }
     end
@@ -573,12 +609,19 @@ module TebakoRelease
     end
 
     # The additive image metadata: name, sha256, size (consumers ignoring the
-    # `image` key keep working; item 30's compat rule).
-    def image_entry(image)
+    # `image` key keep working; item 30's compat rule) — plus the additive
+    # `blksum` pin (spec 39 §3: {filename, sha256} of the derived block-group
+    # digest sidecar; consumers that predate the key ignore it, and the
+    # loader's lazy arm falls back to eager loudly when it is absent).
+    def image_entry(image, blksum)
       {
         filename: image.basename.to_s,
         sha256: Digest::SHA256.file(image).hexdigest,
-        size_bytes: image.size
+        size_bytes: image.size,
+        blksum: {
+          filename: Blksum.sidecar_name(image),
+          sha256: blksum.digest
+        }
       }
     end
 
@@ -800,11 +843,17 @@ module TebakoRelease
     # feeds the entry's bundle block and the idempotent skip), upload the
     # bundles as the legs' only payload assets, then the metadata (shard
     # with the bundle block + the bundle's sidecar). The member files
-    # themselves never become release assets — the bundle is the unit.
+    # themselves never become release assets — the bundle is the unit —
+    # UNLESS the factory co-publishes (spec 36 §3): then the members are
+    # standalone served names beside the bundle (the lazy arm
+    # range-fetches the image), still ahead of the shard that witnesses
+    # them (a witnessed shard without its assets is the invalid publish).
     def process_bundle_release(release, packages)
       bundles = build_bundles(packages)
       entries = build_manifest_entries(packages, bundles: bundles)
       bundles.each_value { |bundle| upload_package(release, bundle) }
+      packages.each { |package| upload_package(release, package) } if copublish?
+      upload_blksum_sidecars(release, entries)
       entries.each { |entry| ensure_package_metadata(release, entry) }
       print_settled_summary
     end
@@ -844,6 +893,14 @@ module TebakoRelease
       @config.adapter.bundle_publish?
     end
 
+    # Spec 36 §3's co-publish mode: a bundle-era line that ALSO serves
+    # the per-file assets as standalone release assets (the lazy arm's
+    # serving requirement — spec 39 §7). Factory-declared through the
+    # adapter, like the era.
+    def copublish?
+      bundle_publish? && @config.adapter.per_file_alongside_bundle?
+    end
+
     # AUDIT_ONLY (the coordinator's release job / a publish dry run):
     # strictly read-only — finds the release (never creates one), needs no
     # local packages, uploads nothing, touches no notes; the release's
@@ -867,10 +924,32 @@ module TebakoRelease
     # the release notes are written once at creation.
     def publish_release(release, packages, entries)
       packages.each { |package| upload_package(release, package) }
+      upload_blksum_sidecars(release, entries)
       entries.each { |entry| ensure_package_metadata(release, entry) }
       print_settled_summary
     end
 
+    # The spec 39 §3 sidecars ride along in BOTH publish eras as STANDALONE
+    # assets — never bundle members: the lazy resolver fetches the sidecar
+    # with a plain GET against its own release-asset URL
+    # (`{dir_url}/{image.blksum.filename}`), in the bundle era too. Derived
+    # at entry-build time and staged beside the images; uploaded before the
+    # metadata so the shard that pins them never precedes them.
+    def upload_blksum_sidecars(release, entries)
+      entries.each do |entry|
+        name = entry.dig(:image, :blksum, :filename)
+        next unless name
+
+        path = staged_blksums[name]
+        unless path
+          raise Error, "the blksum sidecar #{name} was declared but never staged — " \
+                       "the derivation runs at entry-build time; this is a machinery bug"
+        end
+
+        upload_package(release, path)
+      end
+    end
+
     # The package's metadata assets, byte-truthful for the SERVED bytes: a
     # settled package (the byte-immutable keep, or a wedged recovery
     # replace) publishes the PREVIOUS entry's shard and sidecars — the
@@ -888,10 +967,22 @@ module TebakoRelease
     # era: the exe, its .tfs image and its .dll facet. Bundle era (spec 36
     # §3): the bundle is the ONE served payload asset — the entry's
     # exe/image/dll fields are member pins, not served names, so they earn
-    # no sidecar.
+    # no sidecar — UNLESS the entry carries the co-publish witness, when
+    # the members ARE served standalone beside the bundle and earn theirs.
+    # Both eras: the derived blksum sidecar (spec 39 §3) IS a served
+    # standalone asset, so it earns its own .sha256 sidecar like
+    # every served name.
     def metadata_assets(entry)
-      return { entry[:bundle][:filename] => entry[:bundle][:sha256] } if entry[:bundle]
+      served = bundle_metadata(entry)
+      served.merge!(per_file_metadata(entry)) unless entry[:bundle] && !entry[:per_file_assets]
+      served.merge(blksum_metadata(entry))
+    end
+
+    def bundle_metadata(entry)
+      entry[:bundle] ? { entry[:bundle][:filename] => entry[:bundle][:sha256] } : {}
+    end
 
+    def per_file_metadata(entry)
       { entry[:filename] => entry[:sha256] }
         .merge(facet_metadata(entry, :image))
         .merge(facet_metadata(entry, :dll))
@@ -902,6 +993,14 @@ module TebakoRelease
       block ? { block[:filename] => block[:sha256] } : {}
     end
 
+    # The blksum sidecar's name -> sha256 pair when the entry declares it
+    # (spec 39 §3's `image.blksum` pin); a pre-blksum previous entry
+    # declares nothing and earns nothing (byte-truthful metadata).
+    def blksum_metadata(entry)
+      block = entry.dig(:image, :blksum)
+      block ? { block[:filename] => block[:sha256] } : {}
+    end
+
     def shard_name_for(entry)
       "#{package_stem(entry[:filename])}#{SHARD_SUFFIX}"
     end
@@ -910,7 +1009,8 @@ module TebakoRelease
     # with the previous entry's voice; a never-published settle has nothing
     # truthful to keep and never reaches here (upload_package re-raised).
     def effective_entry(entry)
-      names = [entry[:filename], entry.dig(:image, :filename), entry.dig(:dll, :filename)].compact
+      names = [entry[:filename], entry.dig(:image, :filename), entry.dig(:dll, :filename),
+               entry.dig(:image, :blksum, :filename)].compact
       return entry unless names.any? { |name| settled?(name) }
 
       previous_entry_for(entry[:filename]) || entry
@@ -1095,7 +1195,9 @@ module TebakoRelease
 
     def missing_assets(release, packages, require_signatures: false)
       present = all_assets(release).map(&:name)
-      packages.flat_map { |name| missing_package_assets(present, name, require_signatures: require_signatures) }
+      packages.flat_map do |name|
+        missing_package_assets(release, present, name, require_signatures: require_signatures)
+      end
     end
 
     # One expected package's gaps. Windows executables may or may not carry
@@ -1103,11 +1205,16 @@ module TebakoRelease
     # expectation matches both. Metadata expectations ride on what actually
     # landed — a package whose exe never landed reports its own name only,
     # never a cascade of secondary sidecar/shard gaps (one error per gap).
-    def missing_package_assets(present, name, require_signatures: false)
-      return missing_bundle_assets(present, name, require_signatures: require_signatures) if bundle_publish?
+    # The blksum sidecar (spec 39 §3) is expected ONLY when the package's
+    # shard declares the `image.blksum` pin — a pre-blksum release's audit
+    # stays green (the additive-key compat rule), and a missing shard
+    # reports its own gap only.
+    def missing_package_assets(release, present, name, require_signatures: false)
+      return missing_bundle_assets(release, present, name, require_signatures: require_signatures) if bundle_publish?
 
       exe = [name, "#{name}.exe"].find { |candidate| present.include?(candidate) }
       landed, missing = expected_facets(name).partition { |facet| present.include?(facet) }
+      landed, missing = split_blksum_expectation(served_shard(release, present, name), present, landed, missing)
       missing.unshift(name) unless exe
       return missing if exe.nil?
 
@@ -1116,12 +1223,72 @@ module TebakoRelease
 
     # Spec 36's completeness shape: the bundle is the leg's ONE payload
     # asset; a landed bundle owes its sidecar and the package's shard
-    # (plus an .asc of each on signing-enabled audits).
-    def missing_bundle_assets(present, name, require_signatures: false)
+    # (plus an .asc of each on signing-enabled audits). The declared
+    # blksum sidecar (spec 39 §3) is a standalone served asset in this
+    # era too — expected, with its own metadata, when the shard pins it —
+    # and a shard carrying the co-publish witness (spec 36 §3's
+    # per_file_assets) owes the standalone per-file assets beside the
+    # bundle.
+    def missing_bundle_assets(release, present, name, require_signatures: false)
       bundle = "#{name}#{Bundler::BUNDLE_SUFFIX}"
       return [bundle] unless present.include?(bundle)
 
-      missing_metadata(present, name, [bundle], require_signatures: require_signatures)
+      shard = served_shard(release, present, name)
+      landed, missing = split_blksum_expectation(shard, present, [bundle], [])
+      landed, missing = split_copublish_expectation(shard, present, name, landed, missing)
+      missing + missing_metadata(present, name, landed, require_signatures: require_signatures)
+    end
+
+    # The shard-declared blksum expectation (spec 39 §3): the shard is the
+    # declaration's only authority (the additive `image.blksum` key), so
+    # the audit reads it. A shard that declares no pin expects nothing (a
+    # pre-blksum release audits green); a shard that never landed already
+    # reports its own gap, so it adds no secondary blksum gaps; an
+    # unreadable shard warns and expects nothing (never a silent failure —
+    # the shard's own gap is the gate's business). A DECLARED sidecar that
+    # never landed reports its own name only — its sidecar/.asc cascade
+    # rides the landed set, one error per gap.
+    def split_blksum_expectation(shard, present, landed, missing)
+      declared = shard&.dig("image", "blksum", "filename")
+      return [landed, missing] unless declared
+
+      if present.include?(declared)
+        [landed + [declared], missing]
+      else
+        [landed, missing + [declared]]
+      end
+    end
+
+    # The shard-witnessed co-publish expectation (spec 36 §3): a shard
+    # carrying per_file_assets: true owes the standalone per-file assets —
+    # the exe (either spelling), the image, the windows DLL — beside the
+    # bundle; each landed member earns its metadata through the landed
+    # set. An unwitnessed shard expects nothing (bundle-only lines audit
+    # green), and a missing exe reports its own gap only, never a
+    # cascade (the one-error-per-gap rule).
+    def split_copublish_expectation(shard, present, name, landed, missing)
+      return [landed, missing] unless shard && shard["per_file_assets"] == true
+
+      exe = [name, "#{name}.exe"].find { |candidate| present.include?(candidate) }
+      facets_landed, facets_missing = expected_facets(name).partition { |facet| present.include?(facet) }
+      gaps = facets_missing
+      gaps = [name] + gaps unless exe
+      [landed + [exe, *facets_landed].compact, missing + gaps]
+    end
+
+    # The package's served shard as parsed JSON — the declarations' only
+    # authority (the additive keys gate the audit's expectations). nil
+    # when the shard never landed (its own gap is the gate's business) or
+    # cannot be read (loudly — the audit never guesses an expectation).
+    def served_shard(release, present, name)
+      shard = "#{name}#{SHARD_SUFFIX}"
+      return nil unless present.include?(shard)
+
+      download_asset_json(find_asset(release, shard))
+    rescue StandardError => e
+      puts "::warning::could not read #{shard} for the additive expectations (#{e.class}: #{e.message}) — " \
+           "no additive assets are expected of this package"
+      nil
     end
 
     # The non-executable artifacts a package is expected to carry: the
@@ -1448,12 +1615,13 @@ module TebakoRelease
     end
 
     # The package stem an asset name belongs to: the exe (with or without
-    # .exe), its .tfs image, its .dll facet and its .tar.gz bundle (spec 36)
-    # share one stem — settling is package-scoped so a wedged exe also
-    # stands down its facets (a fresh facet over previous package bytes
-    # would be a mixed-version package).
+    # .exe), its .tfs image, its .dll facet, the derived blksum sidecar
+    # (spec 39 §3) and its .tar.gz bundle (spec 36) share one stem —
+    # settling is package-scoped so a wedged exe also stands down its
+    # facets (a fresh facet over previous package bytes would be a
+    # mixed-version package). Longest suffix first.
     def package_stem(filename)
-      filename.sub(/\.tar\.gz\z/, "").sub(/\.(exe|tfs|dll)\z/, "")
+      filename.sub(/\.tar\.gz\z/, "").sub(/\.tfs\.blksum\.json\z/, "").sub(/\.(exe|tfs|dll)\z/, "")
     end
 
     def settled?(filename)
@@ -1586,18 +1754,13 @@ module TebakoRelease
 
     # The sha256 the previous manifest records for this asset: the entry's
     # own sha for the executable, the image/dll facet block's sha for a
-    # facet (facets key under their package's entry), the bundle block's
-    # sha for the bundle (spec 36 — the bundle-era served asset).
+    # facet (facets key under their package's entry), the image's blksum
+    # pin for the derived sidecar (spec 39 §3), the bundle block's sha for
+    # the bundle (spec 36 — the bundle-era served asset).
     def previous_sha_for(entry, filename)
-      if entry.dig(:image, :filename) == filename
-        entry.dig(:image, :sha256)
-      elsif entry.dig(:dll, :filename) == filename
-        entry.dig(:dll, :sha256)
-      elsif entry.dig(:bundle, :filename) == filename
-        entry.dig(:bundle, :sha256)
-      else
-        entry[:sha256]
-      end
+      blocks = [entry.dig(:image, :blksum), entry[:image], entry[:dll], entry[:bundle]]
+      block = blocks.find { |candidate| candidate && candidate[:filename] == filename }
+      block ? block[:sha256] : entry[:sha256]
     end
 
     def validate_environment
@@ -1624,13 +1787,16 @@ module TebakoRelease
     end
 
     # `.abi` sidecars (the runtime's platform string), `.contract.yaml`
-    # sidecars (the era-2 release card provenance) and `.sha256` markers
+    # sidecars (the era-2 release card provenance), `.sha256` markers
     # (the image's store-layout trust anchor, spec 22 §6 — the boot
-    # smoke's image-key input) are manifest inputs / build outputs read
-    # in place — never packages of their own.
+    # smoke's image-key input) and `.blksum.json` sidecars (the spec 39 §3
+    # derivation staged beside its image at entry-build time — still in
+    # the directory when a re-run validates) are manifest inputs / build
+    # outputs read in place — never packages of their own.
     def support_file?(path)
       path.extname == ".abi" || path.extname == ".sha256" ||
-        path.basename.to_s.end_with?(CONTRACT_SIDECAR_SUFFIX)
+        path.basename.to_s.end_with?(CONTRACT_SIDECAR_SUFFIX) ||
+        Blksum.blksum_file?(path)
     end
   end
 end

data/lib/tebako_release/version.rb

@@ -5,5 +5,5 @@
 # This file is a part of tamatebako
 
 module TebakoRelease
-  VERSION = "0.2.1"
+  VERSION = "0.4.0"
 end

data/lib/tebako_release.rb

@@ -10,6 +10,7 @@ require_relative "tebako_release/adapter"
 require_relative "tebako_release/config"
 require_relative "tebako_release/platform"
 require_relative "tebako_release/bundler"
+require_relative "tebako_release/blksum"
 require_relative "tebako_release/uploader"
 require_relative "tebako_release/signer"
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tebako-release
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.4.0
 platform: ruby
 authors:
 - Ribose Inc
@@ -39,6 +39,7 @@ files:
 - exe/tebako-release
 - lib/tebako_release.rb
 - lib/tebako_release/adapter.rb
+- lib/tebako_release/blksum.rb
 - lib/tebako_release/bundler.rb
 - lib/tebako_release/config.rb
 - lib/tebako_release/error.rb