From a1d2a1eb89b96ad952c239d56a7c17cae137d18c Mon Sep 17 00:00:00 2001 From: ksanrse Date: Sat, 5 Sep 2026 19:54:08 +0300 Subject: [PATCH 1/3] release: prepare catalog 14 app updates --- release/bom.v1.json | 52 +++++++++++++++++------------------ scripts/validate-bom.test.mjs | 8 +++--- 2 files changed, 30 insertions(+), 30 deletions(-) diff --git a/release/bom.v1.json b/release/bom.v1.json index 1bcfd20..8eaead8 100644 --- a/release/bom.v1.json +++ b/release/bom.v1.json @@ -1,7 +1,7 @@ { "schema_version": 1, "state": "candidate", - "id": "kosmos-package-catalog-13", + "id": "kosmos-package-catalog-14", "release": { "version": "0.9.15", "channel": "production", @@ -41,7 +41,7 @@ }, "store": { "repository": "makekosmos/store", - "commit": "7d185a52ad1eb444f197f2d664af2cdb96738add" + "commit": "2426064ff656b0cf8c636c472aa4817ae1530603" }, "toolchain": { "node": "24.15.0", @@ -56,9 +56,9 @@ "package_schema": 2 }, "catalog": { - "sequence": 13, - "previous_sequence": 12, - "store_sequence": 13, + "sequence": 14, + "previous_sequence": 13, + "store_sequence": 14, "channel": "production", "signing_key_id": "kosmos-release-2026", "public_key": "Mr7fRkGegxRpquVQPEeMxFRMPB3tT9pDJ49ydDmomDQ=" @@ -88,17 +88,17 @@ "manifest_id": "com.kosmos.dictation", "kind": "app", "engine_api": ">=1.0.0", - "version": "0.2.3", + "version": "0.2.4", "repository": "makekosmos/dictation", - "ref": "3b28142c48026d5cb485facce2dca65473365cac", - "release_tag": "v0.2.3", + "ref": "3225cea87aafcf51ce2cef4b9c6a75c83d647607", + "release_tag": "v0.2.4", "entrypoint": "dist/index.html", "icon": "icon.png", "artifact": { - "name": "dictation-0.2.3.kspkg", - "url": "https://github.com/makekosmos/dictation/releases/download/v0.2.3/dictation-0.2.3.kspkg", - "sha256": "2571d1aff891a32f5ae3175e2ae19745bbf11999dabe203edfce89397ce94273", - "size": 1403994 + "name": "dictation-0.2.4.kspkg", + "url": "https://github.com/makekosmos/dictation/releases/download/v0.2.4/dictation-0.2.4.kspkg", + "sha256": "a7eaf9c84ee63fc01799df531ba0469390a20c4a4df6e37f1c9901af8a4c5fd5", + "size": 1403990 } }, { @@ -106,17 +106,17 @@ "manifest_id": "com.kosmos.agenda", "kind": "app", "engine_api": ">=1.0.0", - "version": "0.2.4", + "version": "0.2.5", "repository": "makekosmos/agenda", - "ref": "ca65ad05676e998021aaf5ef5b5b6be47e1838fc", - "release_tag": "v0.2.4", + "ref": "06691c9920c6dc52f3305775209b9f16badd3c04", + "release_tag": "v0.2.5", "entrypoint": "dist/index.html", "icon": "icon.png", "artifact": { - "name": "agenda-0.2.4.kspkg", - "url": "https://github.com/makekosmos/agenda/releases/download/v0.2.4/agenda-0.2.4.kspkg", - "sha256": "2a143cb0f97db3a9326ac91e01e55c09516bf4613bb81d592bd87b13d12867d0", - "size": 710654 + "name": "agenda-0.2.5.kspkg", + "url": "https://github.com/makekosmos/agenda/releases/download/v0.2.5/agenda-0.2.5.kspkg", + "sha256": "cdca5e3654fb9f4c8e8300be8b59d8c8fa88b80c83b42921f3fd123d08318ef3", + "size": 718944 } }, { @@ -124,17 +124,17 @@ "manifest_id": "com.kosmos.memoria", "kind": "app", "engine_api": ">=1.0.0", - "version": "0.6.3", + "version": "0.6.5", "repository": "makekosmos/memoria", - "ref": "496dc0e40cb5dd615cb62a90ffa5388ce33268ac", - "release_tag": "v0.6.3", + "ref": "3b2838ff3e2abe338d2c1b990874ac244f36a72e", + "release_tag": "v0.6.5", "entrypoint": "dist/index.html", "icon": "icon.png", "artifact": { - "name": "memoria-0.6.3.kspkg", - "url": "https://github.com/makekosmos/memoria/releases/download/v0.6.3/memoria-0.6.3.kspkg", - "sha256": "af03fe9c6987159e83a00938e3b98f605afc3a4cf80d93b5b9ac34d87accb86f", - "size": 2888653 + "name": "memoria-0.6.5.kspkg", + "url": "https://github.com/makekosmos/memoria/releases/download/v0.6.5/memoria-0.6.5.kspkg", + "sha256": "2fe248dcf5d627d80bcc25f022cdb1cef01704a6194c735d789035f72112dd3b", + "size": 2861199 } }, { diff --git a/scripts/validate-bom.test.mjs b/scripts/validate-bom.test.mjs index b655421..630a63d 100644 --- a/scripts/validate-bom.test.mjs +++ b/scripts/validate-bom.test.mjs @@ -11,7 +11,7 @@ const bomPath = path.join(root, "release", "bom.v1.json"); const builder = await readFile(path.join(root, "scripts", "build-source-packages.mjs"), "utf8"); test("checked-in BOM is v1 and contains all catalog package inputs", async () => { - const bom = await loadBom(bomPath, { expectedSequence: 13, allowPendingBuilds: true }); + const bom = await loadBom(bomPath, { expectedSequence: 14, allowPendingBuilds: true }); assert.equal(bom.packages.length, 11); assert.equal(bom.packages.filter((entry) => entry.kind === "app").length, 5); assert.equal(bom.packages.filter((entry) => entry.kind === "source").length, 6); @@ -20,9 +20,9 @@ test("checked-in BOM is v1 and contains all catalog package inputs", async () => }); test("reviewed BOM pins the authorized Store commit and envelope sequence", async () => { - const bom = await loadBom(bomPath, { expectedSequence: 13, allowPendingBuilds: true }); - assert.equal(bom.source.store.commit, "7d185a52ad1eb444f197f2d664af2cdb96738add"); - assert.equal(bom.catalog.store_sequence, 13); + const bom = await loadBom(bomPath, { expectedSequence: 14, allowPendingBuilds: true }); + assert.equal(bom.source.store.commit, "2426064ff656b0cf8c636c472aa4817ae1530603"); + assert.equal(bom.catalog.store_sequence, 14); }); test("source package builds use committed Cargo locks", () => { From 1d104bd357c17ece2f66ea633abd1e10ed473a22 Mon Sep 17 00:00:00 2001 From: ksanrse Date: Sat, 5 Sep 2026 22:52:03 +0300 Subject: [PATCH 2/3] chore: pin catalog-14 source artifacts --- release/bom.v1.json | 24 ++++++++++++++++++------ scripts/validate-bom.test.mjs | 2 ++ 2 files changed, 20 insertions(+), 6 deletions(-) diff --git a/release/bom.v1.json b/release/bom.v1.json index 8eaead8..1f0302d 100644 --- a/release/bom.v1.json +++ b/release/bom.v1.json @@ -171,7 +171,9 @@ }, "artifact": { "name": "com.kosmos.bigfrontend-0.1.0.kspkg", - "url_template": "https://github.com/makekosmos/package-index/releases/download/catalog-{sequence}/com.kosmos.bigfrontend-0.1.0.kspkg" + "url_template": "https://github.com/makekosmos/package-index/releases/download/catalog-{sequence}/com.kosmos.bigfrontend-0.1.0.kspkg", + "sha256": "1a158b8cdbdabb12d190cffb11671c9e0482b3558209d05824ef37a3b30fb9c3", + "size": 434107 } }, { @@ -190,7 +192,9 @@ }, "artifact": { "name": "com.kosmos.greatfrontend-0.1.0.kspkg", - "url_template": "https://github.com/makekosmos/package-index/releases/download/catalog-{sequence}/com.kosmos.greatfrontend-0.1.0.kspkg" + "url_template": "https://github.com/makekosmos/package-index/releases/download/catalog-{sequence}/com.kosmos.greatfrontend-0.1.0.kspkg", + "sha256": "7ee0011d2c72312ac3eebb4e3b7b263b3c8a37b9b898ab362b0fe101a46c7951", + "size": 422107 } }, { @@ -209,7 +213,9 @@ }, "artifact": { "name": "com.kosmos.leetcode-0.1.0.kspkg", - "url_template": "https://github.com/makekosmos/package-index/releases/download/catalog-{sequence}/com.kosmos.leetcode-0.1.0.kspkg" + "url_template": "https://github.com/makekosmos/package-index/releases/download/catalog-{sequence}/com.kosmos.leetcode-0.1.0.kspkg", + "sha256": "dfccaaf16f8e98b2eec96a6add4e54e220fde04bb3d74e89d9c4e78faf3f2059", + "size": 493716 } }, { @@ -228,7 +234,9 @@ }, "artifact": { "name": "com.kosmos.codewars-0.1.0.kspkg", - "url_template": "https://github.com/makekosmos/package-index/releases/download/catalog-{sequence}/com.kosmos.codewars-0.1.0.kspkg" + "url_template": "https://github.com/makekosmos/package-index/releases/download/catalog-{sequence}/com.kosmos.codewars-0.1.0.kspkg", + "sha256": "c7c169da6474f7d16b81fdfc8dfca13d0e9e4bf11e419bd6fb198a93c4129d8a", + "size": 473420 } }, { @@ -247,7 +255,9 @@ }, "artifact": { "name": "com.kosmos.hevy-0.1.0.kspkg", - "url_template": "https://github.com/makekosmos/package-index/releases/download/catalog-{sequence}/com.kosmos.hevy-0.1.0.kspkg" + "url_template": "https://github.com/makekosmos/package-index/releases/download/catalog-{sequence}/com.kosmos.hevy-0.1.0.kspkg", + "sha256": "9147b1f701c55b1f48b72761f7759888cd381d8174da506b5c2f6c5e7399b0f9", + "size": 439769 } }, { @@ -266,7 +276,9 @@ }, "artifact": { "name": "com.kosmos.toggl-0.1.0.kspkg", - "url_template": "https://github.com/makekosmos/package-index/releases/download/catalog-{sequence}/com.kosmos.toggl-0.1.0.kspkg" + "url_template": "https://github.com/makekosmos/package-index/releases/download/catalog-{sequence}/com.kosmos.toggl-0.1.0.kspkg", + "sha256": "869e33626cd4a7e0ff4e41dacf968e3ccf317a133bffea208bbcdd5597ead1a6", + "size": 441750 } } ], diff --git a/scripts/validate-bom.test.mjs b/scripts/validate-bom.test.mjs index 630a63d..06db6b2 100644 --- a/scripts/validate-bom.test.mjs +++ b/scripts/validate-bom.test.mjs @@ -31,6 +31,8 @@ test("source package builds use committed Cargo locks", () => { test("pending source artifacts are rejected unless explicitly allowed", async () => { const bom = JSON.parse(await readFile(bomPath, "utf8")); + delete bom.packages.find((entry) => entry.kind === "source").artifact.sha256; + delete bom.packages.find((entry) => entry.kind === "source").artifact.size; assert.throws(() => validateBom(bom), /artifact\.sha256 is required/); assert.doesNotThrow(() => validateBom(bom, { allowPendingBuilds: true })); }); From efa2b5c70157ac88e2739dbda3148aecafcfe457 Mon Sep 17 00:00:00 2001 From: ksanrse Date: Sun, 6 Sep 2026 14:43:58 +0300 Subject: [PATCH 3/3] fix: pin published SDK source SHAs --- release/bom.v1.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/release/bom.v1.json b/release/bom.v1.json index 1f0302d..72373e4 100644 --- a/release/bom.v1.json +++ b/release/bom.v1.json @@ -23,20 +23,20 @@ }, "arca_sdk": { "repository": "makekosmos/arca-sdk", - "commit": "e2c60732f21168febbaec4aac4cd85d7cdb540af", + "commit": "bdf29038fa88784857b4f26fdf53111be85806c2", "package": { "name": "@makekosmos/ark", "version": "0.1.1", - "integrity": "git:e2c60732f21168febbaec4aac4cd85d7cdb540af" + "integrity": "git:bdf29038fa88784857b4f26fdf53111be85806c2" } }, "imago": { "repository": "makekosmos/imago", - "commit": "9d39cdccde235b9367cb677f8107da7afd9e31fd", + "commit": "5ee6bd11273acf7f24bebcd8ceb869cffbb397a9", "package": { "name": "@makekosmos/visuals", "version": "0.1.3", - "integrity": "git:9d39cdccde235b9367cb677f8107da7afd9e31fd" + "integrity": "git:5ee6bd11273acf7f24bebcd8ceb869cffbb397a9" } }, "store": {