Lab repository for measuring three GitHub-based distribution
mechanisms as untrusted blob mirrors for
[polymorph-pkg] (plus raw.githubusercontent.com as a free fourth
rail). Everything here is synthetic fixture data generated
deterministically by vectors lab-fixtures from the polymorph-pkg
source tree; trust never lives in the transport — every byte is
verified against a signed manifest's digest pair (blake3+bao streaming
and sha256) by the consuming loaders.
| rail | content | URL shape |
|---|---|---|
| Pages | distro/ at the Pages origin |
https://lannbot.github.io/polymorph-pkg-distro/distro/pm/blob/b3/<hex> |
| raw | distro/ (plain git) |
https://raw.githubusercontent.com/lannbot/polymorph-pkg-distro/refs/heads/main/distro/pm/blob/b3/<hex> |
| git-LFS | distro-lfs/ (LFS-tracked) |
https://media.githubusercontent.com/media/lannbot/polymorph-pkg-distro/refs/heads/main/distro-lfs/pm/blob/b3/<hex> |
| Releases | release blobs-v1, flat asset names |
https://github.com/lannbot/polymorph-pkg-distro/releases/download/blobs-v1/b3-<hex> |
| GHCR (OCI) | package lab, tags component/verifier, CNCF wasm layout |
https://ghcr.io/v2/lannbot/polymorph-pkg-distro/lab/blobs/sha256:<hex> (bearer token dance) |
The canonical mirror layout (<base>/blob/b3/<hex> + .obao sidecar,
16 KiB chunk-group pre-order outboard, no length prefix) is expressible
on Pages/raw/LFS as a plain https mirror base. Release asset names
cannot contain /, so that rail uses flattened b3-<hex> names — by
design inexpressible as a conforming mirror without a dedicated
descriptor kind; part of what this experiment measures.
distro/pm/manifest is the signed deployment manifest (an aggregate
carrying a key delegation + manifest seq 2); manifest.seq1 /
manifest.seq3 exist for rollback/update probes.
Fixture contents: an 8 MiB synthetic component-layer blob and the real
pkg_wasm.wasm verifier module as an asset, with .obao sidecars.
Keys are throwaway test keys derived from fixed synthetic seeds.
See FINDINGS.md (written after the probe runs).