Skip to content

retire v0 (1/2): delete the retained v0 binding code and prune its protected paths (#431) - #470

Merged
EricAndrechek merged 2 commits into
v1from
v1-retire-v0
Oct 6, 2026
Merged

EricAndrechek merged 2 commits into
v1from
v1-retire-v0

Conversation

@EricAndrechek

Copy link
Copy Markdown
Member

Retire the v0 binding code (part 1 of #431, approved by the maintainer). The second part, the v0 channel tooling, follows in its own pull request. Both land before v1 merges into main.

Deleted:

  • Go: the five retained v0 verification files (fetch_sign.go, fetch.go, registry_path.go, multiversion.go, resolve.go).
  • Python: fetch.py and _manifest.py, which nothing imported.
  • TypeScript: ts/src/fetch.ts, already excluded from the build.
  • Rust: src/fetch/ and digest.rs, which no module declared.
  • Parity: tests/parity/manifest.json, which nothing read.

The security checker (scripts/policy-merge-check.py):

  • Their PROTECTED_GLOBS entries are removed. The three registry adapters' entries stay, with reasons that describe the v1 code.
  • The carve-out's docstring and its selftest's fabricated tree now use the v1 layout. The "an entry that covers nothing" checks are rebuilt on _ed25519.py and rust/src/ocifetch/**.
  • Unchanged: every v1 verification file stays unconditionally protected. --check-carve-out covers 59 files, all in the four fetch layers, _ed25519.py and the three registry adapters.
  • CONTRIBUTING.md: the protected-glob block is regenerated from the checker, and the carve-out prose describes v1.

Also:

  • The build exclusions that only existed for the deleted files are gone (python/pyproject.toml, ts/tsconfig.json, ts/tsconfig.test.json, ts/biome.json).
  • Comments that cited the deleted Go files now point at the v1 code. Two are generator outputs, regenerated; the ABI fingerprint is unchanged.
  • v1-abi-gen now runs check-no-hand-decls.py --scope all: 0 findings over 221 files.

Checked locally, all exit 0:

  • policy-merge-check.py --selftest, --check-carve-out and --check-guide;
  • check-selftests-wired, lint-public, lint-spelling, lint-cited-paths, lint-actions;
  • gen-constants --check, abi-v1/gen.py --check;
  • markdownlint and dprint;
  • go vet and go test ./..., go mod tidy -diff (clean, no -e), uv run pytest -q, cargo check --locked --all-targets, and both tsc --noEmit configs.

Refs #431.

🤖 Generated with Claude Code

EricAndrechek and others added 2 commits October 6, 2026 07:40
…d paths (#431)

Approved by the maintainer (public issue #431).

- delete the five Go v0 verification files, Python's fetch.py and _manifest.py,
  TS's fetch.ts, Rust's dead src/fetch/ and digest.rs, and tests/parity/manifest.json
- policy-merge-check: drop their PROTECTED_GLOBS entries; the registry adapters'
  reasons describe v1; the docstring and the carve-out selftest use the v1 tree
- CONTRIBUTING.md: the generated protected-glob block, and the carve-out prose
- drop the build exclusions for the deleted files (pyproject, tsconfig x2, biome)
- comments that cited the deleted files point at the v1 code; regenerated
  (gen-constants --write, abi-v1 gen --write; the ABI fingerprint is unchanged)
- v1-abi-gen: check-no-hand-decls --scope all (0 findings over 221 files)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The comment fix in genfixtures/sign.go (it cited a deleted v0 file) changes the
generator's recorded identity; every fixture file is otherwise byte-identical.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant