Supported artifact
Helm 0.1 ships as the native Arch Linux package helm-settings. The package installs the binary, desktop entry, AppStream metadata, scalable application icon, and MPL-2.0 license. Builds use the committed lockfile with Cargo's frozen mode and follow the Arch Linux Rust package guidelines.
Supply-chain controls
CI actions are pinned to immutable commit hashes. cargo-deny checks RustSec advisories, approved licenses, duplicate versions, sources, and wildcard dependencies. Release builds use one code-generation unit, thin LTO, abort-on-panic, and stripped symbols.
Adversarial inputs
Nightly CI fuzzes JSON-RPC framing, managed configuration documents, and profile JSON using cargo-fuzz/libFuzzer. Generated corpora and crash artifacts remain local; minimized regression inputs are promoted into deterministic tests before a fix is accepted.
Release gate
- Formatting, Clippy, unit, integration, and documentation-link checks pass.
- Dependency policy and all metadata validators pass.
- Optimized builds are reproduced from isolated source trees.
- The Arch package installs and passes a clean-session smoke test.
- The signed tag, source archive, checksums, release notes, and generated PKGBUILD agree on one version.
Evidence
The checked qualification matrix defines beta acceptance, while the release-candidate record defines reproducibility and live-session evidence. Stable artifacts use the published release signing identity.