Layr-Labs / Layr-Labs/d-inference

Low: No releases published on active darkbloomdev/darkbloom repo — binary provenance unclear

Open
#717 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
527
Forks
114
Avg merge
17h 26m
Merged PRs (30d)
111

Description

## Summary

The active development repository (`darkbloomdev/darkbloom`) has zero published GitHub Releases. All historical releases (v0.8.1–v0.8.10) exist only on the `Layr-Labs/d-inference` fork. Binaries distributed to users are served from the coordinator CDN (`api.darkbloom.dev/dl/`), not from either GitHub repository's releases page.

## Evidence

- `darkbloomdev/darkbloom`: 0 releases
- `Layr-Labs/d-inference`: 10 releases (v0.8.1–v0.8.10, July–August 2024)
- Install script downloads binaries from `$COORD_URL/dl/` with hashes from `$COORD_URL/v1/releases/latest`

## Impact

- Users cannot independently verify which commit corresponds to the binary they are running
- There is no GitHub-anchored artifact for any version of the current codebase
- The split between the active repo (`darkbloomdev`) and the release repo (`Layr-Labs`) creates confusion about which is canonical
- Exacerbates the circular trust issue in #709 — with no GitHub Releases to cross-reference, the CDN is the sole source of truth for both binaries and their hashes

## Suggested Fix

1. **Publish GitHub Releases on `darkbloomdev/darkbloom`** for each provider binary version, including:
- The compiled binary (or a link to the CDN artifact)
- SHA-256 checksums
- The git commit SHA the binary was built from
2. **Clarify the relationship** between `Layr-Labs/d-inference` and `darkbloomdev/darkbloom` in the README — which is canonical, which is active, and where releases will be published going forward
3. **Tag releases in git** so the commit history is anchored to distributed binaries

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the install script, the README, and the coordinator release endpoints referenced in the issue. Trace how binaries and hashes are distributed, then define how GitHub Releases, tags, commit SHAs, and the active and forked repositories should relate. Done means releases are anchored to the canonical repository and the README explains the release location.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, github, go
Domain
documentation, release
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.