Homebrew: Publish deterministic lazy shell layers#1023
Draft
brandonpayton wants to merge 1 commit into
Draft
Conversation
Build a browser-fetchable ZIP closure from the exact verified Homebrew plan, bottle bytes, and link manifests used by required VFS acceptance. Publish the archive and its provenance-bound descriptor as immutable release assets with strict ZIP validation and anonymous readback.\n\nThis intentionally does not register the layer in the runtime or add per-language gallery images.
This was referenced Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Homebrew bottles are GHCR gzip tar artifacts, which are not a practical browser layer transport: direct browser fetching is constrained by registry authentication and CORS, while publishing one complete VFS image per language would duplicate the Kandelo base image.
This PR publishes one browser-fetchable ZIP containing the exact dependency closure selected by required Homebrew VFS acceptance. The ZIP is derived from the same dependency-first plan, verified bottle bytes, and reviewed link manifests as the eager VFS image.
What changes
kandelo-homebrew-shell-layer.zipfrom a fresh empty filesystem, so the layer cannot accidentally include files from the platform base image.kandelo-homebrew-shell-layer.jsondescriptor that binds package provenance, the source VFS digest, every ZIP entry, and the immutable release URLs.Deliberate scope boundary
This is the publisher half only. It does not register the ZIP with the browser runtime, does not add language-specific gallery images, and does not claim these packages are available in the default shell yet. Runtime integrity checking and lazy mounting belong in the consumer follow-up.
Validation
bash scripts/dev-shell.sh bash scripts/test-homebrew-publish-workflow.shbash scripts/dev-shell.sh bash scripts/test-homebrew-tap-native-sidecars.shbash scripts/test-homebrew-vfs-release.shbash scripts/dev-shell.sh ruby scripts/check-homebrew-publish-workflow-trust.rbbash scripts/dev-shell.sh bash -c "cd host && npm run typecheck"host/test/homebrew-vfs-builder.test.ts(16 tests)No kernel, syscall, or ABI contract changes are included.