Between 2026-10-01 and 2026-10-06 quarry gained fossil's unversioned files, a Releases page built on them, and a release cut by its own CI. Version 0.2.0 is the first release the forge published itself.
Unversioned files, the fossil way
RFC 0020 chose fossil's own unversioned tier over forge-only attachments, so a stock fossil client works both ways. It landed in six rungs:
- The catalog (!782): files live in the bucket a repository's admin binds; quarry keeps a catalog of name, mtime, hash, size and who, and rebuilds it from the bucket when needed.
- Sync (!785): the sync front answers fossil's unversioned cards itself, so
fossil clone -u,fossil uv addwithfossil sync -u, andfossil uv rmall work against a quarry repository. Publishing needs theyletter. - The pages (!784): a UV tab with who added or removed what, downloads that redirect to the bucket, an upload form for
yholders, and a Releases page read fromrelease-manifest.json,SHA256SUMSand the changelog. - Mirrors (!789): a mirror can import its upstream's unversioned files after each pull, so a mirrored project's download links resolve on the forge.
Releases cut by tagging
A version-* tag now builds, checks and publishes a release with the CI run's own token (!813), not a person's credential. scripts/release.sh refuses unless the version, the changelog heading and the tag agree and the checkout is clean; it publishes SHA256SUMS first and the manifest last, so a half-published release shows no manifest. 0.2.0 (!827) was the first.
Archive downloads moved off the server's CPU too: a tarball or zip is built once into the repository's bucket and every request redirects to a short-lived link (!820).
Edges found by an outside test
An external test round (thanks, jva) found two things, both fixed:
- A manifest could claim a sha256 its
SHA256SUMScontradicted, and the page showed it as written. The Releases page now marks such a row "does not match SHA256SUMS" (!850). - Cloudflare refuses a request over about 100 MB before quarry sees it, so a
fossil uv syncof a larger file failed with a bare 413. The forge is now told the cap (--proxy-request-limit-mb), and the UV page names the largest file a sync can publish (!851).