mkcert: add v1.4.4 (archetype C) + nixpkgs-vintage staleness rule #16

Merged

chad merged 3 commits from mkcert-v1.4.4 into main

2026-09-24 14:24:12 -04:00

glen commented

2026-09-24 14:09:37 -04:00

Collaborator

Standalone follow-up to the batches: mkcert v1.4.4 (archetype C, terraform shape) + the staleness rule that settles it.

The call: upstream's latest release is v1.4.4 (2022-04-26) and there is no newer one — the tool is finished, not abandoned (a local-CA issuer against stable root-store APIs in Go), and nixpkgs 26.05 packages exactly 1.4.4 from the same tag. Per the new nixpkgs-vintage staleness rule (second commit, AGENTS.md §6): age alone doesn't disqualify a candidate when latest stable nixpkgs ships the same version; a staleness skip needs a reason nixpkgs doesn't have. The rule is written into the campaign protocol so it's a heuristic, not a one-off.

Checksum honesty: v1.4.4 publishes NO checksum asset, so the pinned sha256 is trust-on-first-use — computed from a fresh download of the release asset at packaging time (this session, asset size matches). nixpkgs' package.nix pins the source-tree hash (fetchFromGitHub SRI) as the version-level cross-check that our v1.4.4 is the same tree nixpkgs builds. Bump recipe in the Containerfile.

Sandbox posture: mkcert -install targets the system trust store — the HOST's by design, outside any sandbox; documented in the Containerfile + entrypoint (host-native mkcert for -install; in-sandbox mkcert is for issuing, with CAROOT at ~/.local/share/mkcert via writable_home). Smoke: mkcert -version → "v1.4.4", exit 0 (link-time version, verified in main.go); the output carries no tool name so the version anchor is deliberate and bumps with MKCERT_VERSION. Gate run is the first real build+smoke.

Standalone follow-up to the batches: **mkcert v1.4.4** (archetype C, terraform shape) + the staleness rule that settles it. **The call**: upstream's latest release is v1.4.4 (2022-04-26) and there is no newer one — the tool is *finished*, not abandoned (a local-CA issuer against stable root-store APIs in Go), and nixpkgs 26.05 packages exactly 1.4.4 from the same tag. Per the new **nixpkgs-vintage staleness rule** (second commit, AGENTS.md §6): age alone doesn't disqualify a candidate when latest stable nixpkgs ships the same version; a staleness skip needs a reason nixpkgs doesn't have. The rule is written into the campaign protocol so it's a heuristic, not a one-off. **Checksum honesty**: v1.4.4 publishes NO checksum asset, so the pinned sha256 is trust-on-first-use — computed from a fresh download of the release asset at packaging time (this session, asset size matches). nixpkgs' package.nix pins the source-tree hash (fetchFromGitHub SRI) as the version-level cross-check that our v1.4.4 is the same tree nixpkgs builds. Bump recipe in the Containerfile. **Sandbox posture**: `mkcert -install` targets the system trust store — the HOST's by design, outside any sandbox; documented in the Containerfile + entrypoint (host-native mkcert for -install; in-sandbox mkcert is for issuing, with CAROOT at ~/.local/share/mkcert via writable_home). Smoke: `mkcert -version` → "v1.4.4", exit 0 (link-time version, verified in main.go); the output carries no tool name so the version anchor is deliberate and bumps with MKCERT_VERSION. Gate run is the first real build+smoke.

glen added 2 commits

2026-09-24 14:09:37 -04:00

mkcert: add v1.4.4 (archetype C) 9be33a5329

Upstream latest release (2022-04-26); nixpkgs 26.05 ships the same
version, so the nixpkgs-vintage staleness rule clears it. sha256 is
TOFU (computed from a fresh download of the release asset at packaging
time, 2026-09-24) — v1.4.4 publishes no checksum asset; nixpkgs
package.nix pins the source-tree hash as the version-level cross-check.
License BSD-3-Clause (upstream LICENSE). Smoke: mkcert -version (link-
time version, exit 0).

agents: staleness bar = nixpkgs vintage, not release age (§6)

verify / verify (pull_request) Failing after 11s

Details

dadad79130

An old latest-release alone doesn't disqualify a candidate — finished
tools are common (mkcert 1.4.4, wezterm). Package when latest stable or
unstable nixpkgs ships the same version; a staleness skip needs a reason
nixpkgs doesn't have. package.nix doubles as the provenance cross-check
when upstream publishes no checksums.

glen referenced this pull request from a commit

2026-09-24 14:16:24 -04:00

mkcert: explicit footprint gate 300 — fedora base floor ~183 MB shared + 4.8 MB binary (PR #16 gate run); terraform/yt-dlp precedent

glen added 1 commit

2026-09-24 14:16:24 -04:00

mkcert: explicit footprint gate 300 — fedora base floor ~183 MB shared + 4.8 MB binary (PR #16 gate run); terraform/yt-dlp precedent

verify / verify (pull_request) Successful in 3s

Details

f1ae69422b