Stop publishing dev enclave bundles

README.md

@@ -256,7 +256,7 @@ The first run builds an enclave image and takes a while. The harness prints the
 
 **The emulator exercises the protocol, not AWS's hardware trust boundary.** It uses a development master key, and it signs attestation documents with a chain it mints at each boot because QEMU's NSM cannot produce AWS-signed ones. It also runs on the host clock. Use it with test data only.
 
-To build on one machine and run on another, `--pack` produces a self-contained bundle and `--prebuilt` runs one; the *Publish a dev enclave* workflow attaches such bundles to GitHub releases. See the [development guide](docs/DEV_ENCLAVE.md).
+To build on one machine and run on another, `--pack` produces a self-contained bundle and `--prebuilt` runs one; a consumer packs the bundle it needs from a commit it pins. See the [development guide](docs/DEV_ENCLAVE.md).
 
 ### 3. Make an authenticated, stateful request
 

docs/DEV_ENCLAVE.md

@@ -207,13 +207,12 @@ the udev rule `scripts/lib.sh`'s `prepare_enclave_host` applies. Image options a
 short path: its sockets live under `DIR/target/qemu-nitro/<name>/`, and a Unix socket path is at
 most 107 bytes — past that `vhost-device-vsock` fails with "path must be shorter than SUN_LEN".
 
-`scripts/ci-pack.sh OUT PROFILE [image options...]` is the whole release step: it packs, tars the
-bundle as `dev-enclave-PROFILE-<rev>.tar.gz` with a `.sha256`, and then runs `run-e2e.sh` — all
-eight legs — from an extracted copy with nothing pointing at the checkout. The "Publish a dev
-enclave" workflow runs it on a hosted runner and attaches the result to a release named after the
-profile and the revision. One bundle is one configuration: image options are measured into PCR0,
-so a consumer publishes the options its harness expects, pins the bundle built from them, and
-checks `image.env` against them before booting.
+A consumer packs the bundle it needs from a commit it pins: `dev-enclave.sh --pack DIR`, or
+`scripts/ci-pack.sh OUT PROFILE [image options...]`, which also tars the bundle as
+`dev-enclave-PROFILE-<rev>.tar.gz` with a `.sha256` and then runs `run-e2e.sh` — all eight legs —
+from an extracted copy with nothing pointing at the checkout. One bundle is one configuration:
+image options are measured into PCR0, so a consumer packs with the options its harness expects
+and checks `image.env` against them before booting.
 
 The attestation chain the emulator mints is valid for 30 days, so a long-running host has to be
 restarted within that — with `--keep-store`, a restart costs nothing but new pins.

scripts/ci-pack.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# A dev enclave, built here and runnable anywhere: the bundle a release carries.
+# A dev enclave, built here and runnable anywhere: the bundle a consumer packs
+# from a commit it pins.
 #
 #   scripts/ci-pack.sh OUT PROFILE [image options...]
 #
@@ -15,9 +16,8 @@
 # The example guest is what the smoke boots; a bundle carries no guest, and
 # whoever runs it names their own.
 #
-# Image options fix PCR0, so one bundle is one configuration. A consumer
-# repository publishes the options its harness expects and pins the bundle
-# built from them — see docs/DEV_ENCLAVE.md.
+# Image options fix PCR0, so one bundle is one configuration. A consumer packs
+# with the options its harness expects — see docs/DEV_ENCLAVE.md.
 . "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 cd "$REPO"