feat(dist): conform to DECISIONS/0001 distribution channels

[mfacenet]

Summary

Adopts skaphos-resources DECISIONS/0001 — distribution channels by artifact shape. sting is both Shape 2 (end-user CLI) and Shape 3 (MCP server), so it inherits both channel sets.

Spec, plan, tasks and implementation are all on this branch. A release now publishes to six channels instead of two.

What landed

#	Obligation	Status
1	Version-stamped go install	✅ internal/buildinfo
2	sting update self-update	❌ dropped — recorded deviation, ADR 0011
3	Linux .deb / .rpm	✅ nfpms block
4	MCP registry entry	✅ server.json → io.skaphos/sting
5	Multi-arch container image	✅ Dockerfile + dockers_v2 → GHCR

Plus the cross-cutting release-coherence work, which is the part most directly aimed at the failure mode ADR-0001 documents.

This branch adds zero dependencies — go.mod and go.sum are byte-identical to main.

The defect, reproduced

go install github.com/skaphos/sting/cmd/sting@v1.0.0 — the currently published release — prints sting dev. internal/buildinfo resolves through three tiers (release ldflags → Go build metadata → explicit "unavailable"), so neither dev nor (devel) can reach a user again. Release output is unchanged.

Self-update was built, measured, and dropped

A conforming implementation existed and met all three of the ADR's rules — verify before replacing (pinned to sting's own release-workflow identity), defer to the package manager, no implicit network calls. It was removed on cost:

	Without	With self-update
Binary (-s -w)	11 MB	25 MB (+122%)
go.mod requirements	44	106
Unmaintained modules in graph	0	1 (x/crypto/openpgp, no fix available)

It was removed rather than weakened: there is no checksum-only mode and no "verify if cosign is present" fallback, because DECISIONS/0001 is right that a self-updater ignoring available signing material is worse than none. The choice was a correct updater at +122%, or no updater.

Self-update is a required channel, so this is a deviation, not an omission. DECISIONS/0001 requires a record in the repo that drops a required channel — that is ADR 0011, which states the cost, what users get instead, and what would reverse the decision. A follow-up PR against skaphos-resources is warranted, since repokeeper and oiax will hit the same tradeoff.

README.md now documents an upgrade path per channel.

Two changes to existing behavior

1. A missing Homebrew credential now fails the release. It previously appended --skip=homebrew and continued with a ::warning::, so a release could complete green with the cask unpublished — exactly how repokeeper's cask sat pinned at 0.6.0 across two releases.
2. A post-release verify job queries each channel for the version it serves. Reachability is not the test; a stale cask responds perfectly well.

Verification performed

• Packages: installed and removed both formats in debian:stable and fedora:latest. Binary on PATH, correct version, licenses under /usr/share/doc/sting/, clean removal. All 4 packages appear in checksums.txt, so they inherit the provenance attestation. SBOMs now cover all 10 artifacts.
• Image: both platform images run; completed an MCP initialize handshake over stdio advertising get_commits and get_repo_activity, both readOnly. Non-root (65532), distroless base pinned by digest.
• Gates: task ci green, coverage passes (buildinfo 100%), REUSE compliant, goreleaser check and server.json schema validation both pass. govulncheck reports no vulnerabilities.

Also pins syft, cosign, reuse and check-jsonschema in .tool-versions — without syft the SBOM step failed locally while passing in CI, which is the kind of divergence that hides real breakage.

Out of scope

winget/scoop and Windows Authenticode signing, per the sequencing note on the issue.

Closes #121

[Copilot]

Pull request overview

This PR implements skaphos-resources DECISIONS/0001 distribution-channel requirements for sting (Shape 2 CLI + Shape 3 MCP server), expanding release outputs and adding cross-channel coherence checks. It introduces a verified self-update path, makes go install builds report honest version metadata, and wires release/CI configuration to publish and validate the new channels.

Changes:

• Add in-binary build metadata resolution (internal/buildinfo) and update sting version to use it (fixing go install …@latest showing dev/(devel)).
• Add sting update with verify-before-replace (Sigstore identity pin + checksum-manifest verification), plus atomic self-replacement and install-channel deferral.
• Expand release/CI artifacts and validation: .deb/.rpm, multi-arch GHCR image, MCP server.json entry + schema validation, and associated docs/ADR updates.

Reviewed changes

Copilot reviewed 117 out of 118 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
.dockerignore	Minimizes Docker build context for GoReleaser-built binary-only image builds.
.github/workflows/ci.yml	Adds CI job to validate .goreleaser.yaml and schema-validate server.json.
.goreleaser.yaml	Adds nfpm packages, per-package SBOMs, and multi-arch dockers_v2 image publishing.
.specify/feature.json	Points spec-kit feature directory to specs/002-distribution-channels.
.tool-versions	Pins additional release/compliance tooling versions (syft/cosign/reuse/check-jsonschema).
AGENTS.md	Documents local tooling expectations for release/compliance checks.
Dockerfile	Adds distroless, non-root container image that runs sting mcp over stdio.
LICENSES/Apache-2.0.txt	Adds Apache-2.0 license text to support license compliance workflows.
README.md	Documents Linux packages, sting update, and container-based MCP server usage.
docs/adr/0011-self-update-trust-model.md	Adds ADR defining the self-update trust model and constraints.
docs/adr/README.md	Adds ADR 0011 to the ADR index.
go.mod	Adds sigstore-go and its dependency tree to support in-process verification.
internal/buildinfo/buildinfo.go	Implements build metadata resolution across ldflags → Go build info → unknown.
internal/buildinfo/buildinfo_test.go	Tests buildinfo precedence and placeholder suppression (dev/(devel)).
internal/cli/root.go	Adds update command and introduces exitError for stable exit codes.
internal/cli/update.go	Implements Cobra sting update command wiring, output, and exit-code mapping.
internal/cli/version.go	Updates sting version output to use resolved buildinfo with “unavailable” semantics.
internal/cli/version_test.go	Adds tests for version rendering, “modified” marker, and placeholder suppression.
internal/mcpserver/serverjson_test.go	Drift tests to ensure server.json matches tool surface and credential model.
internal/selfupdate/extract.go	Extracts the binary from verified tar.gz/zip release artifacts with size bounds.
internal/selfupdate/extract_test.go	Tests extraction behavior, corrupt archives, and entry matching.
internal/selfupdate/ownership.go	Detects install provenance (brew/rpm/dpkg/go/unmanaged) and upgrade guidance.
internal/selfupdate/plan.go	Resolves update plan (target release, ownership deferral, platform gate, asset).
internal/selfupdate/release.go	Fetches GitHub release metadata/assets unauthenticated with rate-limit handling.
internal/selfupdate/replace.go	Implements atomic replacement (and a gated Windows rename-aside mechanism).
internal/selfupdate/replace_test.go	Tests replacement atomicity, mode preservation, cleanup, and permission behavior.
internal/selfupdate/sigstore_test.go	Verifies identity-pinned sigstore policy via virtual CA-minted signatures.
internal/selfupdate/verify.go	Implements checksum-manifest signature verification + pinned signer identity + digest checks.
scripts/license-exceptions.tsv	Adds license classifier exceptions for short-form Apache headers.
server.json	Adds MCP registry entry for io.skaphos/sting with OCI package and STING_* env vars.
specs/002-distribution-channels/checklists/requirements.md	Spec quality checklist for the distribution-channel feature.
specs/002-distribution-channels/contracts/cli-update.md	Contract for sting update behavior, output, and exit codes.
specs/002-distribution-channels/contracts/release-artifacts.md	Contract for required release artifact set and post-release verification.
specs/002-distribution-channels/contracts/server-json.md	Contract for the MCP server.json registry entry semantics.
third_party_licenses/runtime/github.com/asaskevich/govalidator/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/blang/semver/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/cenkalti/backoff/v5/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/cespare/xxhash/v2/LICENSE.txt	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/cyberphone/json-canonicalization/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/digitorus/pkcs7/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/digitorus/timestamp/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/go-logr/logr/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/go-openapi/errors/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/go-openapi/jsonpointer/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/go-openapi/jsonpointer/NOTICE	Adds runtime notice text for dependency compliance.
third_party_licenses/runtime/github.com/go-openapi/jsonreference/NOTICE	Adds runtime notice text for dependency compliance.
third_party_licenses/runtime/github.com/go-openapi/runtime/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/go-openapi/runtime/NOTICE	Adds runtime notice text for dependency compliance.
third_party_licenses/runtime/github.com/go-openapi/runtime/middleware/denco/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/go-openapi/spec/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/google/uuid/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/grpc-ecosystem/grpc-gateway/v2/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/in-toto/attestation/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/in-toto/in-toto-golang/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/opencontainers/go-digest/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/pkg/errors/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/secure-systems-lab/go-securesystemslib/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/github.com/theupdateframework/go-tuf/v2/metadata/NOTICE	Adds runtime notice text for dependency compliance.
third_party_licenses/runtime/github.com/youmark/pkcs8/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/golang.org/x/crypto/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/golang.org/x/mod/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/golang.org/x/net/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/google.golang.org/grpc/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/google.golang.org/grpc/NOTICE.txt	Adds runtime notice text for dependency compliance.
third_party_licenses/runtime/google.golang.org/protobuf/LICENSE	Adds runtime license text for dependency compliance.
third_party_licenses/runtime/k8s.io/klog/v2/LICENSE	Adds runtime license text for dependency compliance.

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

README.md:36

• The RPM filename shown here doesn’t match the actual nfpm conventional filename (release verification expects a "-1" release suffix, and RPM uses aarch64 for arm64). Updating the examples avoids pointing users at non-existent asset names.

sudo dpkg -i sting_<version>_amd64.deb     # Debian, Ubuntu
sudo rpm -i sting-<version>.x86_64.rpm     # Fedora, RHEL, openSUSE

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

internal/mcpserver/serverjson_test.go:150

• This test also assumes s.Packages[0] exists; if server.json is malformed (e.g., missing packages), this will panic rather than producing a readable test failure. Each test should be independently robust.

func TestServerJSONVersionsAreConsistent(t *testing.T) {
	s := loadServerJSON(t)

	if s.Version != s.Packages[0].Version {
		t.Errorf("server version %q and package version %q disagree; the release stamps both",
			s.Version, s.Packages[0].Version)
	}

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated 1 comment.