chore: adopt canonical Spitzli SDK and binaries

Cargo.toml

@@ -1,5 +1,5 @@
 ["package"]
-"name" = "webdock-github-repository"
+"name" = "spitzli-github-repository"
 "version" = "0.1.0"
 "edition" = "2024"
 "rust-version" = "1.94"
@@ -22,15 +22,15 @@
 "ed25519-dalek" = "2"
 "libc" = "0.2"
 
-["dependencies"."webdock-plugin-runtime"]
+["dependencies"."spitzli-plugin-runtime"]
 "git" = "https://github.com/spitzli/cloud-plugin-sdk"
-"rev" = "8ed57d89c3263b050f126e4c2ba7f6cdebb0daa6"
-"package" = "webdock-plugin-runtime"
+"rev" = "8019f3df67dba3fed3083f22635e4725028c1b5e"
+"package" = "spitzli-plugin-runtime"
 
-["dependencies"."webdock-repository-protocol"]
+["dependencies"."spitzli-repository-protocol"]
 "git" = "https://github.com/spitzli/cloud-plugin-sdk"
-"rev" = "8ed57d89c3263b050f126e4c2ba7f6cdebb0daa6"
-"package" = "webdock-repository-protocol"
+"rev" = "8019f3df67dba3fed3083f22635e4725028c1b5e"
+"package" = "spitzli-repository-protocol"
 
 ["dependencies"."serde"]
 "version" = "1"

Dockerfile

@@ -6,15 +6,15 @@ WORKDIR /src
 COPY . .
 # Shared only among reviewed Spitzli platform sources; never customer build code.
 FROM source AS check
-RUN --mount=type=cache,id=spitzli-native-sdk-8ed57d89c3263b050f126e4c2ba7f6cdebb0daa6-registry,target=/usr/local/cargo/registry,sharing=locked --mount=type=cache,id=spitzli-native-sdk-8ed57d89c3263b050f126e4c2ba7f6cdebb0daa6-git,target=/usr/local/cargo/git,sharing=locked --mount=type=cache,id=spitzli-native-sdk-8ed57d89c3263b050f126e4c2ba7f6cdebb0daa6-target,target=/src/target,sharing=locked cargo check --locked --all-targets --jobs 3 && cargo test --locked --all-targets --jobs 3 --features local-provider-test
+RUN --mount=type=cache,id=spitzli-native-sdk-8019f3df67dba3fed3083f22635e4725028c1b5e-registry,target=/usr/local/cargo/registry,sharing=locked --mount=type=cache,id=spitzli-native-sdk-8019f3df67dba3fed3083f22635e4725028c1b5e-git,target=/usr/local/cargo/git,sharing=locked --mount=type=cache,id=spitzli-native-sdk-8019f3df67dba3fed3083f22635e4725028c1b5e-target,target=/src/target,sharing=locked cargo check --locked --all-targets --jobs 3 && cargo test --locked --all-targets --jobs 3 --features local-provider-test
 
 FROM source AS build
-RUN --mount=type=cache,id=spitzli-native-sdk-8ed57d89c3263b050f126e4c2ba7f6cdebb0daa6-registry,target=/usr/local/cargo/registry,sharing=locked --mount=type=cache,id=spitzli-native-sdk-8ed57d89c3263b050f126e4c2ba7f6cdebb0daa6-git,target=/usr/local/cargo/git,sharing=locked --mount=type=cache,id=spitzli-native-sdk-8ed57d89c3263b050f126e4c2ba7f6cdebb0daa6-target,target=/src/target,sharing=locked cargo build --locked --release --bins --jobs 3 && mkdir /out && install -m 0555 /src/target/release/webdock-github-repository /out/webdock-github-repository
+RUN --mount=type=cache,id=spitzli-native-sdk-8019f3df67dba3fed3083f22635e4725028c1b5e-registry,target=/usr/local/cargo/registry,sharing=locked --mount=type=cache,id=spitzli-native-sdk-8019f3df67dba3fed3083f22635e4725028c1b5e-git,target=/usr/local/cargo/git,sharing=locked --mount=type=cache,id=spitzli-native-sdk-8019f3df67dba3fed3083f22635e4725028c1b5e-target,target=/src/target,sharing=locked cargo build --locked --release --bins --jobs 3 && mkdir /out && install -m 0555 /src/target/release/spitzli-github-repository /out/spitzli-github-repository
 
 FROM docker.io/library/debian:trixie-slim@sha256:f6b08b09a05725f9431502d3b5714f5c4576e82c1a84fa1debe0c24a7e0c3ec4
 COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY LICENSE COMMERCIAL-LICENSING.md NOTICE /usr/share/licenses/spitzli-cloud/
-COPY --from=build --chown=65532:65532 --chmod=0555 /out/webdock-github-repository /usr/local/bin/webdock-github-repository
+COPY --from=build --chown=65532:65532 --chmod=0555 /out/spitzli-github-repository /usr/local/bin/spitzli-github-repository
 ENV HOME=/tmp
 USER 65532:65532
-ENTRYPOINT ["/usr/local/bin/webdock-github-repository"]
+ENTRYPOINT ["/usr/local/bin/spitzli-github-repository"]

NAMESPACE-MIGRATION.json

@@ -0,0 +1,49 @@
+{
+  "baseSource": "03b23a1f2646493aadbdc50bed3f3a893544ed77",
+  "date": "2026-11-12",
+  "formatVersion": 1,
+  "licenseUnchanged": true,
+  "originalSourceSnapshotRetained": true,
+  "package": "spitzli-github-repository",
+  "preservedBindingFilesSHA256": {
+    "COMMERCIAL-LICENSING.md": "5b8832f5014f16e2cf4f7ee295de32760eed20981495d184bd9f1517be256a09",
+    "EXPORT-PROVENANCE.json": "50a2b503ababfcb7ceba79751144a4de83edec31c196fa224e3c3bbbba3e18a5",
+    "LICENSE": "0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0"
+  },
+  "qualifiedChangedSourceSHA256": {
+    "Cargo.lock": "1aa99ee5496efb641a60b94830c219d2f2661d61b17c0f6bb9d98d86e4752c53",
+    "Cargo.toml": "fdc2aabccedb5f0a2fc130341c78a346904a1506c615c44cb004350e888d6b55",
+    "Dockerfile": "b386678edf4f4cf770ff5ca7e352189c296f139e3e0d4a6f650a104fdc1b8a67",
+    "NOTICE": "4949ccd63735c148d2fd1f1423772d11938087ba0bdbcf4aad81c576bcfa09b8",
+    "README.md": "2d4a9f6095deca8162e1a58fbcbe4b7fb3f853b23bdba324256d9b36397e797b",
+    "scripts/native-release.py": "44ed0e8cf69563be9dd1a12f33bc226188136f60188006a99d0da2cca50fbcd4",
+    "src/lib.rs": "d5064d645c14b0588a5b7b7893976ae4128cb7e26d313dc8e9d232b89efd1cbc",
+    "src/main.rs": "c352cc5f6dfa962619960a42a7c27f4db662878a0c57e40269f2a99d0f8904a2",
+    "standalone.json": "270a130dde24fef18add379290aaeca3d68a96ff06fb15a05444a0f56be7de11",
+    "tests/provider.rs": "0e982f37d6d53758d0fba8b92ad11260be732e5bc49c20293e8a48eee496a4b0",
+    "tools/manifest-validator/Cargo.toml": "81aa8724804a7f701f7b312c8851937369409d029071d2034dbd6f535b86df6a",
+    "tools/manifest-validator/src/main.rs": "bb5f5ab38c63e2c28aa64a329696e923aa747e62de2d058e2de734ada06e72b4"
+  },
+  "runtimeArtifactsReplaced": false,
+  "scope": "Rust package/import and binary namespace, host UI import namespace, paired test environment variables and exact SDK pin",
+  "sdkGit": "https://github.com/spitzli/cloud-plugin-sdk",
+  "sdkRevision": "8019f3df67dba3fed3083f22635e4725028c1b5e",
+  "sourceChecks": {
+    "allRegistryLockfilesPreserved": [
+      "Cargo.lock"
+    ],
+    "format": true,
+    "releaseContract": true,
+    "rustLiteralFilesChecked": 5,
+    "strictClippy": true,
+    "testsIgnored": 0,
+    "testsPassed": 3,
+    "ui": {
+      "backendOnly": true,
+      "component": "github-repository",
+      "uiTypecheck": "not-applicable-no-ui-source"
+    }
+  },
+  "version": "0.1.0",
+  "wireStoredCryptographicAndExternalResourceBindings": "retained for coordinated migration"
+}

NOTICE

@@ -1,7 +1,7 @@
-Webdock
+Spitzli Cloud
 Copyright (c) 2026 Spitzli Development and contributors.
 
-Original Webdock code is licensed under AGPL-3.0-only unless separately noted.
+Original Spitzli Cloud code is licensed under AGPL-3.0-only unless separately noted.
 Alternative written licenses may be available from the relevant rights holder.
 See LICENSE and COMMERCIAL-LICENSING.md.
 

README.md

@@ -44,7 +44,7 @@ The retained implementation notes below include platform integration procedures.
 Commands referring to Core, `tools/` or `apps/console` require the [platform source
 checkout](https://github.com/spitzli/webdock); they are not standalone setup steps.
 
-This standalone Rust workspace implements scoped GitHub commit resolution and source archives. It is not a Core dependency. Build it with `cargo build --manifest-path Cargo.toml --release --locked`; run the resulting `webdock-github-repository` binary with one absolute private configuration file path. Shared protocol/runtime crates are build dependencies, while provider credentials and vendor behavior stay here.
+This standalone Rust workspace implements scoped GitHub commit resolution and source archives. It is not a Core dependency. Build it with `cargo build --manifest-path Cargo.toml --release --locked`; run the resulting `spitzli-github-repository` binary with one absolute private configuration file path. Shared protocol/runtime crates are build dependencies, while provider credentials and vendor behavior stay here.
 
 The process requires a publisher-signed repository descriptor, its pinned public key, the Core lease issuer public key, current runtime generation, GitHub App ID and a private RSA key file. The descriptor must match the separately installed plugin manifest, version and image digest. Configuration uses these fields:
 

scripts/native-release.py

@@ -31,7 +31,7 @@ def dependencies(document):
             yield from dependencies(platform)
     for name, options in dependencies(manifest):
         package = options.get("package", name) if isinstance(options, dict) else name
-        if package.startswith("webdock-"):
+        if package.startswith(("spitzli-", "webdock-")):
             require(isinstance(options, dict) and options.get("git") == metadata["sdkGit"] and options.get("rev") == metadata["sdkRevision"] and "path" not in options and not options.get("workspace"), "Every SDK dependency must match the reviewed repository and revision")
     toolchain = tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"]
     require(re.fullmatch(r"\d+\.\d+\.\d+", toolchain), "Pinned Rust toolchain required")

src/lib.rs

@@ -2,10 +2,10 @@
 use reqwest::{Client, Method, StatusCode};
 use serde::Deserialize;
 use serde_json::{Value, json};
-use std::{collections::HashMap, time::Duration};
-use webdock_repository_protocol::{
+use spitzli_repository_protocol::{
     self as protocol, ErrorCode, LeaseClaims, PluginError, Result, runtime::Handler,
 };
+use std::{collections::HashMap, time::Duration};
 fn denied() -> PluginError {
     PluginError::denied()
 }

src/main.rs

@@ -1,12 +1,12 @@
 //! Standalone provider process; private configuration and authenticated Core callback are required.
 use serde::Deserialize;
+use spitzli_repository_protocol::{runtime, verify_descriptor};
 use std::{
     io::Read,
     os::unix::fs::{MetadataExt, OpenOptionsExt},
     path::{Path, PathBuf},
     sync::Arc,
 };
-use webdock_repository_protocol::{runtime, verify_descriptor};
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 struct Configuration {
@@ -132,10 +132,10 @@ async fn run() -> Result<(), Error> {
             authority,
             server_certificate_sha256,
         } => {
-            webdock_plugin_runtime::pinned_mtls_channel(
+            spitzli_plugin_runtime::pinned_mtls_channel(
                 origin.clone(),
                 domain.clone(),
-                webdock_plugin_runtime::PinnedMutualTls {
+                spitzli_plugin_runtime::PinnedMutualTls {
                     certificate: file(certificate, false)?,
                     private_key: file(private_key, true)?,
                     authority: file(authority, false)?,
@@ -149,14 +149,14 @@ async fn run() -> Result<(), Error> {
         channel,
         descriptor.plugin_id,
         config.generation,
-        webdock_repository_protocol::sha256(config.descriptor.as_bytes()),
+        spitzli_repository_protocol::sha256(config.descriptor.as_bytes()),
         config.core_peers,
     )?;
     let pem = file(&config.app_private_key, true)?;
-    let provider = webdock_github_repository::GithubProvider::new(config.app_id, &pem)?;
+    let provider = spitzli_github_repository::GithubProvider::new(config.app_id, &pem)?;
     #[cfg(feature = "local-provider-test")]
     let provider = if let Some(origin) = config.test_origin {
-        webdock_github_repository::GithubProvider::loopback_test(config.app_id, &pem, &origin)?
+        spitzli_github_repository::GithubProvider::loopback_test(config.app_id, &pem, &origin)?
     } else {
         provider
     };