Layr-Labs / Layr-Labs/d-inference
Low: No releases published on active darkbloomdev/darkbloom repo — binary provenance unclear
- Dominant language
- Go
- Stars
- 527
- Forks
- 114
- Avg merge
- 17h 26m
- Merged PRs (30d)
- 111
Description
## Summary
The active development repository (`darkbloomdev/darkbloom`) has zero published GitHub Releases. All historical releases (v0.8.1–v0.8.10) exist only on the `Layr-Labs/d-inference` fork. Binaries distributed to users are served from the coordinator CDN (`api.darkbloom.dev/dl/`), not from either GitHub repository's releases page.
## Evidence
- `darkbloomdev/darkbloom`: 0 releases
- `Layr-Labs/d-inference`: 10 releases (v0.8.1–v0.8.10, July–August 2024)
- Install script downloads binaries from `$COORD_URL/dl/` with hashes from `$COORD_URL/v1/releases/latest`
## Impact
- Users cannot independently verify which commit corresponds to the binary they are running
- There is no GitHub-anchored artifact for any version of the current codebase
- The split between the active repo (`darkbloomdev`) and the release repo (`Layr-Labs`) creates confusion about which is canonical
- Exacerbates the circular trust issue in #709 — with no GitHub Releases to cross-reference, the CDN is the sole source of truth for both binaries and their hashes
## Suggested Fix
1. **Publish GitHub Releases on `darkbloomdev/darkbloom`** for each provider binary version, including:
- The compiled binary (or a link to the CDN artifact)
- SHA-256 checksums
- The git commit SHA the binary was built from
2. **Clarify the relationship** between `Layr-Labs/d-inference` and `darkbloomdev/darkbloom` in the README — which is canonical, which is active, and where releases will be published going forward
3. **Tag releases in git** so the commit history is anchored to distributed binaries
Contributor guide
Research direction
Start by reviewing the install script, the README, and the coordinator release endpoints referenced in the issue. Trace how binaries and hashes are distributed, then define how GitHub Releases, tags, commit SHAs, and the active and forked repositories should relate. Done means releases are anchored to the canonical repository and the README explains the release location.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git, github, go
- Domain
- documentation, release
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100