Redis Installer Package Spec

This spec defines the next executable Redis proof slice: turn the existing Redis variant revisions into a real cub installer package, then verify that the package remains deterministic and Helm-equivalent.

This is not the old archived top-20 pathway. The package source is generated from the current Redis proof revisions:

recipes/bitnami/redis/25.5.3/revisions/*/r001/rendered/release-objects.yaml

The durable package source lives at:

packages/bitnami/redis/25.5.3/

Product Claim

For bitnami/redis@25.5.3, the current installer package must prove:

correct variants
safe operations
immediate proof

The package contains two real installer bases:

default
reuse-existing-secret

The current executable selection UX is:

New to cub? Install the cub CLI first. You can pull and render public catalog packages without an account. Commands that save or change ConfigHub data require you to sign in.

What this command does. cub installer is a released, open-source plugin for the cub CLI. cub installer setup pulls a catalog package and writes its Kubernetes files locally. It does not apply those files to a cluster; use kubectl, Argo CD, or Flux for delivery. The generated scripts stop before doing any work when the plugin or kustomize is missing.

cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-redis:25.5.3 --base default --work-dir <work> --non-interactive --namespace redis
cub installer setup --pull oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-redis:25.5.3 --base reuse-existing-secret --work-dir <work> --non-interactive --namespace redis

Required Files

packages/bitnami/redis/25.5.3/
  installer.yaml
  README.md
  bases/default/kustomization.yaml
  bases/default/upstream.yaml
  bases/reuse-existing-secret/kustomization.yaml
  bases/reuse-existing-secret/upstream.yaml

recipes/bitnami/redis/25.5.3/publication/
  installer-package-receipt.yaml

Required Invariants

1. installer.yaml declares a real installer Package.
2. The package name is bitnami-redis and version is 25.5.3.
3. Exactly one base is default: default.
4. The default base points at the default Redis rendered object set.
5. The reuse-existing-secret base points at the existing-secret rendered object set.
6. cub installer package produces byte-identical .tgz files across two local runs from the same source tree.
7. The package receipt records every package source file and SHA256.
8. The package receipt records the deterministic .tgz SHA256.
9. cub installer setup --base default renders all 14 Helm Redis objects, plus only the installer namespace support object and one separated Secret.
10. cub installer setup --base reuse-existing-secret renders all 13 Helm Redis objects, plus only the installer namespace support object and no separated Secret.
11. Every cub installer difference from Helm is semantic-equivalent or explicitly classified as the namespace support object.
12. OCI publication is a real gated command, not a fake transcript. It runs only when a registry ref is supplied:

REDIS_INSTALLER_OCI_REF=oci://<registry>/<repo>:<tag> npm run redis:publish-package

Proof Commands

npm run redis:generate-package
npm run redis:verify-package
npm run redis:compare
npm run verify

The default npm run verify must include redis:verify-package.

Non-Scope For This Slice

This slice does not require a live ConfigHub OCI endpoint to be running. If a registry ref and credentials are available, npm run redis:publish-package must package, push, inspect, and write a publication receipt under runs/. Without a registry ref, publication remains unrun rather than simulated.