Long-lived production channel
- Monthly baseline images with weekly metadata refresh.
- Conservative dependency updates with 180-day retention.
- Preferred source for production deployments and partner mirrors.
Global artifact delivery network
Release artifacts without blind trust.
ZYZF Release Hub provides signed packages, differential update bundles, mirror health telemetry, and traceable publication windows for engineering, QA, and partner operations teams.
Current release manifest
2026.04 baseline published
The April baseline ships hardened package metadata, compact delta bundles, and refreshed signer rotation notices for edge partners.
manifest: zyzf-2026.04-core.json
sha256: 7b8e8a9d0db0f7f65a392d7b...
sigstore: verified
channels: stable, candidate, toolchain
Primary
Moscow edge
Origin signing and package assembly with immutable publication logs.
Healthy
Latency 21 ms
Replica
Frankfurt edge
Cold-standby promotion path enabled for emergency origin failover.
Healthy
Latency 43 ms
Distribution channels
Each channel has its own validation policy, retention window, and change cadence.
Signed manifests
Delta bundles
Retention policies
Pre-release validation stream
- Short-lived candidate bundles promoted after soak verification.
- SBOM snapshots attached to every publication window.
- Useful for integration labs and compatibility checks.
Build tooling and bootstrap images
- Compiler caches, bootstrap archives, and test fixtures.
- Retention tuned for CI consumers with mirror-friendly deltas.
- Signing keys rotated on a separate operational schedule.
Latest published artifacts
Representative entries from the current public manifest.
| Package | Channel | Version | Published | Checksum |
|---|---|---|---|---|
| zyzf-core-bundle.tar.zst | Stable | 2026.04.1 | 01 Apr 2026 | 7b8e8a9d0db0... |
| zyzf-agent-delta.patchset | Stable | 2026.04.1-r2 | 01 Apr 2026 | 31f4dc581a8e... |
| zyzf-candidate-images.tar | Candidate | 2026.04-rc3 | 31 Mar 2026 | 9fd2470f5fae... |
| zyzf-toolchain-cache.tar.zst | Toolchain | 2026.13 | 30 Mar 2026 | 6d9e27112cff... |
Origin signing
Artifacts are published only after manifest signing, digest verification, and channel sealing.
Mirror fan-out
Packages propagate through fixed windows with deduplicated deltas and integrity checks at every edge.
Retention and rollback
Release windows remain auditable for incident response, forensic comparison, and deterministic rollback.
Operational note
Download endpoints prioritize integrity metadata over directory browsing. For scripted retrieval, use manifest-driven paths and keep local verification enabled. Human-readable release notes and status feeds are available in the documentation areas linked below.