feat(release): single nix-backed build per target (#18)

* feat(release): single nix-backed build per target

Follow-up to #17: every target now builds once. The build-twice
bit-identical gate is replaced by nix for the linux legs - hermetic builds
from the committed flake.lock, reproducible locally by anyone with
nix build, a stronger guarantee than re-running the build in CI ever was.
Mac and windows legs keep the pinned rustup toolchain, single build.

Linux archives bundle the dynamic loader + libraries behind an abgen entry
script, so they run on any distro (glibc, musl, nixos) with zero host
requirements - the old glibc>=2.35 floor is gone. Layout is unchanged for
consumers: ./abgen is still the entry point next to template/ and shader/.

Flake: version and ABGEN_GIT_COMMIT now come from crate/Cargo.toml and
self.rev instead of being hardcoded; flake.lock bumped (rustc 1.96.1).
PROVENANCE.md and the DEVELOPMENT.md runbook updated to match.

* feat(release): magic nix cache on the linux legs

DetSys nix-installer + magic-nix-cache (sha-pinned) replace the official
installer script: store paths land in the repo's Actions cache, so re-runs
and warm branches skip the toolchain closure and vendored-deps fetch.

* refactor(flake): drop flake-utils for plain genAttrs

Same outputs for the same four systems, one fewer external input.

* feat(release): warm cargo caches on the mac legs

actions/cache (first-party, sha-pinned) on registry+git+target for the two
darwin legs, keyed by target, toolchain, and Cargo.lock. The windows legs
stay uncached to keep the repo inside the 10GB Actions-cache LRU budget.

* feat(release): drop magic nix cache, keep the mac cargo caches

Measured across three dispatch runs: the nix legs were flat with and
without it (777s/771s vs 778s cold - the whole build is one derivation, so
a store cache replays nothing), while its ~9GB of nar entries filled the
repo's 10GB Actions-cache budget and would evict the two 450MB mac cargo
caches that actually cut those legs 2-4x (285s/150s warm vs 1030s/272s
cold). DetSys nix-installer stays.

* feat(flake): crane dep-split so releases recompile only the abgen crate

Dependency crates now build in their own derivation keyed on the
manifests/lockfile (verified drv-stable across source edits), which is
what makes the magic nix cache pay: warm linux legs replay the deps
derivation and compile just the abgen crate (132s local vs 13min full).
crane is pinned to the v0.23.4 release tag + narHash; audited 2026-07-22:
pure-nix lib (~3k lines, no binaries), network access only through
fixed-output fetches pinned by our own Cargo.lock checksums. Magic nix
cache returns to the linux legs alongside it.

* feat(release): extend the cargo cache to the windows legs

With linux and mac warm, the uncached windows cross-builds become the
critical path (~450s). Same target-scoped cache; fits the budget now that
the useless store-nar entries are gone.

* fix(release): carry the crane deps closure via actions/cache + nix copy

magic-nix-cache never substituted in practice (nix marked its local daemon
'disabled' after failed fetches; warm linux legs stayed at cold timings).
Replace it with the primitive already proven on the rustup legs: a
first-party actions/cache entry holding a nix file store of the deps
closure, keyed on the manifests and pins, imported/exported with nix copy.

* style: drop comments from the release workflow and flake

* chore(release): latest pins across the board

rust 1.97.1, actions/cache v6.1.0, llvm-mingw 20260721, ubuntu-24.04 +
macos-15 runners (runner glibc no longer reaches any artifact: linux ships
the nix closure, windows is mingw-static). nix-deps cache key gains
rust-toolchain.toml so toolchain bumps rotate it.

* fix(release): restore the nix-deps cache after checkout

hashFiles evaluates against the workspace when the step runs; before the
checkout it matched nothing and produced a degenerate constant key.

* chore: release 0.11.3

Author: eordano

.github/release-notes.md

@@ -1 +1 @@
-Reproducible builds: the linux and macOS binaries were each built from a clean tree in two independent CI jobs (separate runners) and required bit-identical before publishing; the windows binary is built once (mingw's linker has a residual link-order non-determinism). Toolchain: rust 1.97.0 (pinned), `--locked` against the committed Cargo.lock, `SOURCE_DATE_EPOCH` from the tagged commit. Each archive is self-contained: the `abgen` server binary plus the `template/` and `shader/` assets it needs, resolved from the binary's own directory (`ABGEN_ROOT`/`ABGEN_SHADER_BUNDLE` override). Runtime requirements - Linux (x64 and arm64): glibc >= 2.35 and libstdc++6/libgcc_s (present on any mainstream distro). Windows x64: none, the mingw runtime DLLs ship in the archive next to the exe. Windows arm64: none, a single static exe (llvm-mingw/libc++). macOS (Apple Silicon and Intel): system libraries only. Optional everywhere: libturbojpeg (bit-parity JPEG decode with the upstream ab-cdn pipeline; without it JPEG textures decode through a pure-Rust fallback - valid output, not guaranteed byte-identical to upstream bundles). The same binaries publish to npm as `@dcl/abgen` (per-platform packages as optionalDependencies; `npx @dcl/abgen` runs the server).
+Single-build releases with pinned provenance. Linux (x64 and arm64): built by Nix from the committed flake.lock — hermetic, locally reproducible with `nix build`; the archive bundles the dynamic loader and libraries behind the `abgen` entry script, so it runs on any Linux (glibc, musl, NixOS) with no host requirements. Windows and macOS: rust 1.97.0 (pinned), `--locked` against the committed Cargo.lock, `SOURCE_DATE_EPOCH` from the tagged commit; windows-x64 ships the mingw runtime DLLs next to the exe, windows-arm64 is a single static exe (llvm-mingw/libc++), macOS needs system libraries only. Each archive is self-contained: the `abgen` server entry point plus the `template/` and `shader/` assets it needs, resolved from its own directory (`ABGEN_ROOT`/`ABGEN_SHADER_BUNDLE` override). Optional everywhere: libturbojpeg (bit-parity JPEG decode with the upstream ab-cdn pipeline; without it JPEG textures decode through a pure-Rust fallback - valid output, not guaranteed byte-identical to upstream bundles). The same binaries publish to npm as `@dcl/abgen` (per-platform packages as optionalDependencies; `npx @dcl/abgen` runs the server).

.github/workflows/release.yml

@@ -14,53 +14,51 @@ env:
 
 jobs:
   build:
-    name: ${{ matrix.target }} (build ${{ matrix.attempt }})
+    name: ${{ matrix.target }}
     runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
       matrix:
-        attempt: [1, 2]
-        target:
-          - x86_64-unknown-linux-gnu
-          - aarch64-unknown-linux-gnu
-          - x86_64-pc-windows-gnu
-          - aarch64-pc-windows-gnullvm
-          - aarch64-apple-darwin
-          - x86_64-apple-darwin
         include:
           - target: x86_64-unknown-linux-gnu
-            runner: ubuntu-22.04
-            bin: abgen
+            runner: ubuntu-24.04
+            builder: nix
           - target: aarch64-unknown-linux-gnu
-            runner: ubuntu-22.04-arm
-            bin: abgen
+            runner: ubuntu-24.04-arm
+            builder: nix
           - target: x86_64-pc-windows-gnu
-            runner: ubuntu-22.04
+            runner: ubuntu-24.04
+            builder: rustup
             bin: abgen.exe
-          # rquickjs-sys has no pregenerated bindings for this triple: bindgen
-          # runs against the llvm-mingw sysroot (BINDGEN_EXTRA_CLANG_ARGS below)
           - target: aarch64-pc-windows-gnullvm
-            runner: ubuntu-22.04
+            runner: ubuntu-24.04
+            builder: rustup
             bin: abgen.exe
             cargo_flags: --features rquickjs/bindgen
           - target: aarch64-apple-darwin
-            runner: macos-14
+            runner: macos-15
+            builder: rustup
             bin: abgen
           - target: x86_64-apple-darwin
             runner: macos-15-intel
+            builder: rustup
             bin: abgen
-        exclude:
-          # mingw ld link-order non-determinism: no bit-identical gate, built once
-          - target: x86_64-pc-windows-gnu
-            attempt: 2
 
     steps:
+      - if: matrix.builder == 'nix'
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+
       - name: setup (checkout + toolchains)
         run: |
           git init -q .
           git remote add origin "https://github.com/$GITHUB_REPOSITORY"
           git fetch -q --depth 1 origin "$GITHUB_SHA"
           git checkout -q FETCH_HEAD
+          echo "SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)" >> "$GITHUB_ENV"
+
+          if [ "${{ matrix.builder }}" = "nix" ]; then
+            exit 0
+          fi
 
           (
             if ! command -v rustup >/dev/null 2>&1; then
@@ -69,8 +67,8 @@ jobs:
               echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
               export PATH="$HOME/.cargo/bin:$PATH"
             fi
-            rustup toolchain install 1.97.0 --profile minimal --no-self-update
-            rustup default 1.97.0
+            rustup toolchain install 1.97.1 --profile minimal --no-self-update
+            rustup default 1.97.1
             rustup target add ${{ matrix.target }}
           ) > /tmp/rustup.log 2>&1 &
           rustup_pid=$!
@@ -95,8 +93,8 @@ jobs:
           fi
 
           if [ "${{ matrix.target }}" = "aarch64-pc-windows-gnullvm" ]; then
-            curl -fsSL -o llvm-mingw.tar.xz https://github.com/mstorsjo/llvm-mingw/releases/download/20260616/llvm-mingw-20260616-ucrt-ubuntu-22.04-x86_64.tar.xz
-            echo "534b92e067b22a6b4441f48ae9240a3341b17825d04d577eab0cf85c44b4deda  llvm-mingw.tar.xz" | sha256sum -c
+            curl -fsSL -o llvm-mingw.tar.xz https://github.com/mstorsjo/llvm-mingw/releases/download/20260721/llvm-mingw-20260721-ucrt-ubuntu-22.04-x86_64.tar.xz
+            echo "4a9fd7ac5bda8a0a514f33c4ad7864a76e58c56ed958be18221c5ca0ac0a2b10  llvm-mingw.tar.xz" | sha256sum -c
             sudo tar -xJf llvm-mingw.tar.xz -C /opt && rm llvm-mingw.tar.xz
             cat > /tmp/aarch64-mingw-toolchain.cmake <<'EOF'
           set(CMAKE_SYSTEM_NAME Windows)
@@ -105,17 +103,16 @@ jobs:
           set(CMAKE_CXX_COMPILER aarch64-w64-mingw32-clang++)
           set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER)
           EOF
-            # without the import libs, lld resolves libc++/libunwind statically
-            sudo rm /opt/llvm-mingw-20260616-ucrt-ubuntu-22.04-x86_64/aarch64-w64-mingw32/lib/libc++.dll.a \
-                    /opt/llvm-mingw-20260616-ucrt-ubuntu-22.04-x86_64/aarch64-w64-mingw32/lib/libunwind.dll.a
-            echo "/opt/llvm-mingw-20260616-ucrt-ubuntu-22.04-x86_64/bin" >> "$GITHUB_PATH"
+            sudo rm /opt/llvm-mingw-20260721-ucrt-ubuntu-22.04-x86_64/aarch64-w64-mingw32/lib/libc++.dll.a \
+                    /opt/llvm-mingw-20260721-ucrt-ubuntu-22.04-x86_64/aarch64-w64-mingw32/lib/libunwind.dll.a
+            echo "/opt/llvm-mingw-20260721-ucrt-ubuntu-22.04-x86_64/bin" >> "$GITHUB_PATH"
             {
               echo "CMAKE_TOOLCHAIN_FILE=/tmp/aarch64-mingw-toolchain.cmake"
               echo "CARGO_TARGET_AARCH64_PC_WINDOWS_GNULLVM_LINKER=aarch64-w64-mingw32-clang"
               echo "CC_aarch64_pc_windows_gnullvm=aarch64-w64-mingw32-clang"
               echo "CXX_aarch64_pc_windows_gnullvm=aarch64-w64-mingw32-clang++"
               echo "AR_aarch64_pc_windows_gnullvm=aarch64-w64-mingw32-ar"
-              echo "BINDGEN_EXTRA_CLANG_ARGS=--target=aarch64-w64-mingw32 --sysroot=/opt/llvm-mingw-20260616-ucrt-ubuntu-22.04-x86_64/aarch64-w64-mingw32"
+              echo "BINDGEN_EXTRA_CLANG_ARGS=--target=aarch64-w64-mingw32 --sysroot=/opt/llvm-mingw-20260721-ucrt-ubuntu-22.04-x86_64/aarch64-w64-mingw32"
             } >> "$GITHUB_ENV"
           fi
 
@@ -130,36 +127,82 @@ jobs:
             rustflags="$rustflags -C target-feature=+crt-static -C link-arg=-Wl,--no-insert-timestamp"
           fi
           {
-            echo "SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)"
             echo "RUSTFLAGS=$rustflags"
             echo "CFLAGS=-ffile-prefix-map=$PWD=/build"
             echo "CXXFLAGS=-ffile-prefix-map=$PWD=/build"
           } >> "$GITHUB_ENV"
 
+      - if: matrix.builder == 'nix'
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: /tmp/nix-deps-cache
+          key: nix-deps-${{ matrix.target }}-${{ hashFiles('Cargo.lock', 'Cargo.toml', 'crate/Cargo.toml', 'flake.lock', 'flake.nix', 'rust-toolchain.toml') }}
+
+      - if: matrix.builder == 'rustup'
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: cargo-${{ matrix.target }}-1.97.1-${{ hashFiles('Cargo.lock') }}
+          restore-keys: cargo-${{ matrix.target }}-1.97.1-
+
       - name: build
-        run: cargo build --release --locked --target ${{ matrix.target }} ${{ matrix.cargo_flags }} --bin abgen
+        run: |
+          if [ "${{ matrix.builder }}" = "nix" ]; then
+            flags="--extra-experimental-features nix-command --extra-experimental-features flakes"
+            if [ -d /tmp/nix-deps-cache ]; then
+              nix copy $flags --from file:///tmp/nix-deps-cache --all --no-check-sigs || true
+            fi
+            nix build .#default --print-build-logs $flags
+            deps=$(nix build .#default.cargoArtifacts --print-out-paths --no-link $flags)
+            nix copy $flags --to file:///tmp/nix-deps-cache "$deps"
+          else
+            cargo build --release --locked --target ${{ matrix.target }} ${{ matrix.cargo_flags }} --bin abgen
+          fi
 
       - name: package, smoke test, publish
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           dist="abgen-${GITHUB_REF_NAME:-dev}-${{ matrix.target }}"
           mkdir -p "$dist/shader"
-          cp "target/${{ matrix.target }}/release/${{ matrix.bin }}" "$dist/"
           cp -R template "$dist/template"
           cp crate/shader/scene_ignore_windows "$dist/shader/"
           cp LICENSE README.md "$dist/"
-          if [ "${{ matrix.target }}" = "x86_64-pc-windows-gnu" ]; then
-            for dll in libstdc++-6.dll libgcc_s_seh-1.dll libwinpthread-1.dll; do
-              cp "$(x86_64-w64-mingw32-g++-posix -print-file-name=$dll)" "$dist/"
+
+          if [ "${{ matrix.builder }}" = "nix" ]; then
+            mkdir -p "$dist/bin" "$dist/lib"
+            install -m755 result/bin/abgen "$dist/bin/abgen.bin"
+            for lib in $(ldd result/bin/abgen | awk '$3 ~ /^\// {print $3}'); do
+              install -m644 "$lib" "$dist/lib/"
             done
+            interp=$(readelf -l result/bin/abgen | sed -n 's/.*interpreter: \(.*\)]/\1/p')
+            install -m755 "$interp" "$dist/lib/ld.so"
+            cat > "$dist/abgen" <<'EOF'
+          #!/bin/sh
+          here="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)"
+          export ABGEN_ROOT="${ABGEN_ROOT:-$here}"
+          export ABGEN_SHADER_BUNDLE="${ABGEN_SHADER_BUNDLE:-$here/shader/scene_ignore_windows}"
+          exec "$here/lib/ld.so" --library-path "$here/lib" "$here/bin/abgen.bin" "$@"
+          EOF
+            chmod 755 "$dist/abgen"
+          else
+            cp "target/${{ matrix.target }}/release/${{ matrix.bin }}" "$dist/"
+            if [ "${{ matrix.target }}" = "x86_64-pc-windows-gnu" ]; then
+              for dll in libstdc++-6.dll libgcc_s_seh-1.dll libwinpthread-1.dll; do
+                cp "$(x86_64-w64-mingw32-g++-posix -print-file-name=$dll)" "$dist/"
+              done
+            fi
           fi
+
           TAR=tar; command -v gtar >/dev/null && TAR=gtar
           "$TAR" --sort=name --owner=0 --group=0 --numeric-owner \
               --mtime="@${SOURCE_DATE_EPOCH}" -czf "$dist.tar.gz" "$dist"
           shasum -a 256 "$dist.tar.gz" > "$dist.tar.gz.sha256"
 
-          if [ "${{ matrix.attempt }}" = "1" ] && ! echo "${{ matrix.target }}" | grep -q windows; then
+          if ! echo "${{ matrix.target }}" | grep -q windows; then
             rm -rf /tmp/smoke && mkdir /tmp/smoke
             tar -xzf "$dist.tar.gz" -C /tmp/smoke
             (
@@ -181,18 +224,12 @@ jobs:
             || gh release create "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" \
                  --title "abgen $GITHUB_REF_NAME" --notes-file .github/release-notes.md \
             || gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null
-          if [ "${{ matrix.attempt }}" = "1" ]; then
-            gh release upload "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --clobber \
-              "$dist.tar.gz" "$dist.tar.gz.sha256"
-          else
-            cp "$dist.tar.gz.sha256" "$dist.tar.gz.sha256-2"
-            gh release upload "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --clobber \
-              "$dist.tar.gz.sha256-2"
-          fi
+          gh release upload "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --clobber \
+            "$dist.tar.gz" "$dist.tar.gz.sha256"
 
   publish:
     needs: build
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     if: startsWith(github.ref, 'refs/tags/v')
     permissions:
       contents: write
@@ -209,18 +246,14 @@ jobs:
           git checkout -q FETCH_HEAD
 
           gh release download "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" \
-            --pattern 'abgen-*.tar.gz' --pattern 'abgen-*.tar.gz.sha256*' -D dist
+            --pattern 'abgen-*.tar.gz' --pattern 'abgen-*.tar.gz.sha256' -D dist
           cd dist
           test "$(ls ./*.tar.gz | wc -l)" -eq 6
-          test "$(ls ./*.sha256-2 | wc -l)" -eq 5
-          for f2 in ./*.sha256-2; do
-            diff "$f2" "${f2%-2}" || { echo "reproducibility mismatch: $f2"; exit 1; }
-          done
           sha256sum -c ./*.sha256
           cat ./*.sha256 > SHA256SUMS.txt
           cat SHA256SUMS.txt
           gh release upload "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --clobber SHA256SUMS.txt
-          for f in ./*.sha256 ./*.sha256-2; do
+          for f in ./*.sha256; do
             gh release delete-asset "$GITHUB_REF_NAME" "$(basename "$f")" --repo "$GITHUB_REPOSITORY" --yes
           done
           cd ..

Cargo.lock

@@ -184,22 +184,30 @@ the lib sets `#[global_allocator] mimalloc`; any downstream embedding the lib in
 ## Releasing
 
 The release pipeline (`.github/workflows/release.yml`) is plain shell on GitHub-hosted
-runners - no third-party or marketplace actions. Beyond the repo it trusts only rustup.rs
-(version-pinned toolchain) and the sha256-pinned llvm-mingw tarball. Every release
-operation is idempotent, so job re-runs converge on the full asset set.
+runners; the only non-shell steps are Determinate Systems' sha-pinned nix installer on
+the linux legs and first-party actions/cache everywhere (rustup legs: cargo registry +
+target dirs; nix legs: a nix file store carrying the crane deps-derivation closure,
+moved with nix copy). Measured rationale: warm cargo caches cut the rustup legs 2-4x,
+and the nix cache only pays because the flake splits dependency compilation into its
+own crane derivation (keyed on manifests/lockfile, stable across source edits) -
+without the split, a store cache replayed nothing. Every target builds **once**: Linux via
+`nix build` from the committed flake.lock (hermetic; reproduce locally with `nix build` -
+the archives bundle the loader + libs behind the `abgen` entry script and run on any
+Linux, including NixOS); Windows and macOS via the pinned rustup toolchain with
+`SOURCE_DATE_EPOCH` from the tagged commit. Every release operation is idempotent, so job
+re-runs converge on the full asset set.
 
 1. Land a `chore: release X.Y.Z` PR bumping the crate version (Cargo.toml + Cargo.lock).
 2. Tag the merge commit and push the tag:
    `git tag vX.Y.Z <merge-sha> && git push origin vX.Y.Z`
    Don't pre-create the release in the web UI: the pipeline adopts an existing release
    (that is how v0.11.0 first shipped assetless), but only a CI-created one carries the
    notes from `.github/release-notes.md`.
-3. What runs: every target builds twice in parallel jobs on separate runners
-   (windows-x64 once - mingw ld is non-deterministic); each leg packages, smoke-tests
-   (`--version` + `/readyz`), and uploads its archive with `--clobber`. The `publish` job
-   re-downloads the published assets, requires bit-identical hashes from both build
-   attempts, verifies contents, uploads the aggregated `SHA256SUMS.txt`, and publishes
-   npm (skipped explicitly when `NPM_TOKEN` is unset - why `@dcl/abgen` is not on npm).
+3. What runs: each leg builds, packages, smoke-tests (`--version` + `/readyz`; windows
+   legs are cross-built and not smoke-run), and uploads its archive with `--clobber`.
+   The `publish` job re-downloads the published assets, verifies them against the
+   build-time hashes, uploads the aggregated `SHA256SUMS.txt`, and publishes npm
+   (skipped explicitly when `NPM_TOKEN` is unset - why `@dcl/abgen` is not on npm).
 4. Verify: exactly 7 assets on the release page (6 archives + `SHA256SUMS.txt`).
 5. Failed leg: re-run failed jobs from the Actions UI; everything converges.
 

DEVELOPMENT.md

@@ -12,11 +12,13 @@ from its code.
 ## Reproducible releases
 
 Each release is **versioned and tagged**; the release pipeline
-([`.github/workflows/release.yml`](.github/workflows/release.yml)) builds every Linux and macOS binary
-**twice from a clean tree and requires the two bit-identical** before publishing (Windows x64 builds
-once — mingw's linker has a residual link-order non-determinism). Builds are `--locked` against the
-committed `Cargo.lock`, pinned to a single Rust toolchain, with `SOURCE_DATE_EPOCH` taken from the
-tagged commit, so a given tag reproduces the same artifacts.
+([`.github/workflows/release.yml`](.github/workflows/release.yml)) builds every target **once**.
+The Linux binaries are built by **Nix from the committed `flake.lock`** — a hermetic, pinned
+derivation anyone can reproduce locally with `nix build`, which is a stronger guarantee than
+re-running the same build in CI; the archives bundle the loader and libraries behind the `abgen`
+entry script, so they run on any Linux with no host requirements. The Windows and macOS binaries
+are built with a pinned Rust toolchain, `--locked` against the committed `Cargo.lock`, and
+`SOURCE_DATE_EPOCH` from the tagged commit.
 
 ## Vendored shader bundles
 

PROVENANCE.md

@@ -1,6 +1,6 @@
 [package]
 name = "abgen"
-version = "0.11.2"
+version = "0.11.3"
 edition = "2021"
 description = "Decentraland asset-bundle converter + ab-cdn-compatible JIT server — clean-room reimplementation of asset-bundle-converter."
 license = "AGPL-3.0-or-later"

crate/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dcl-contents"
-version = "0.11.2"
+version = "0.11.3"
 edition = "2021"
 description = "Content-DB active-entity component, asset-bundle status DTOs, manifest-status reader, and the unsigned registry HTTP surface (profiles, entity status, world manifests)."
 

crate/dcl-contents/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "abgen-gpu-kernel-ptx"
-version = "0.11.2"
+version = "0.11.3"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 description = "rustc-native nvptx64 PTX kernels for abgen-gpu-core (nightly + -Z build-std=core; artifact consumed by host via ABGEN_GPU_PTX)"

crate/kernel-ptx/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "abgen-wasm-poc"
-version = "0.11.2"
+version = "0.11.3"
 edition = "2021"
 publish = false