v30.3-roots.1 · Commit 61: [PATCH 61/68] fix(release): assemble platform-specific license notices
ci/release/README.md
Before: /dev/null · After: ci/release/README.md
File metadata
new file mode 100644 index 0000000000000000000000000000000000000000..bdb57d69bdd4d9baccc2583202c93b0e2e03e24f
Download original patch · Release notes
Diff rows 1–68 of 68. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.
ci/release/README.md
ADDED
|
@@ -0,0 +1,68 @@
|
|
|
1
|
+
# Release notice assembly
|
|
2
|
+
|
|
3
|
+
Platform build artifacts are intermediate packages. A green build proves the
|
|
4
|
+
built product, but its package must also pass notice assembly before becoming a
|
|
5
|
+
release asset. The workflow's draft job runs `prepare-release.sh` before signing
|
|
6
|
+
or uploading anything. It fails closed if the downloaded packages lack valid
|
|
7
|
+
platform-specific notices. Automatic discovery or acquisition of dependency
|
|
8
|
+
notice inputs is not part of release execution.
|
|
9
|
+
|
|
10
|
+
The supported assembly interface uses explicitly reviewed inputs:
|
|
11
|
+
|
|
12
|
+
1. Prepare a descriptor for each platform from retained build logs, binary
|
|
13
|
+
version metadata, dependency recipes or package metadata. Preserve source
|
|
14
|
+
notice bytes and identify the exact version, primary origin, source hash and
|
|
15
|
+
evidence. The descriptor is a JSON object keyed by component. Each entry has
|
|
16
|
+
`version`, `source`, `source_sha256`, `provenance_type`, `evidence`, `files`,
|
|
17
|
+
and optionally `role`. Paths in `evidence` and `files` are absolute or relative
|
|
18
|
+
to the descriptor. `build-receipt` entries can instead supply `receipt`;
|
|
19
|
+
their source hash defaults to the receipt hash. Independent provenance can
|
|
20
|
+
use `pinned-source-archive` or `versioned-primary-notice` without an old runner
|
|
21
|
+
receipt. `source-version-stability` keeps `version` as `unknown` and records
|
|
22
|
+
`notice_stable_versions` only when authoritative notice bytes are identical
|
|
23
|
+
across the reviewed range. A source hash means the source archive hash for
|
|
24
|
+
archive provenance, or the primary notice-source record digest for notice
|
|
25
|
+
provenance; retained evidence identifies which and includes notice hashes.
|
|
26
|
+
2. Collect the reviewed inputs into a new directory:
|
|
27
|
+
|
|
28
|
+
```sh
|
|
29
|
+
python3 ci/release/notices.py collect linux-x86_64 descriptor.json notice-inputs
|
|
30
|
+
```
|
|
31
|
+
|
|
32
|
+
The collector adds tracked component licenses and embedded font attribution,
|
|
33
|
+
retains provenance and builds a hashed index. Conservative source-availability
|
|
34
|
+
notices should be labeled with `role`; they do not establish actual linkage.
|
|
35
|
+
3. Add notices to a new package without modifying existing members:
|
|
36
|
+
|
|
37
|
+
```sh
|
|
38
|
+
python3 ci/release/repack.py intermediate.tar.gz assembled.tar.gz \
|
|
39
|
+
bitcoin-roots-30.3-roots.1 notice-inputs/index.json linux-x86_64
|
|
40
|
+
```
|
|
41
|
+
|
|
42
|
+
The repacker adds canonical `COPYING` and `notices/` at the archive root,
|
|
43
|
+
outside signed applications. It preserves every existing member's bytes,
|
|
44
|
+
modes, timestamps and symlink contents. Existing destinations, including
|
|
45
|
+
dangling symlinks, are refused. An existing regular COPYING must match
|
|
46
|
+
canonical bytes and is preserved as an original member; COPYING is added
|
|
47
|
+
only when missing. Altered/nonregular COPYING or an existing notices tree
|
|
48
|
+
is refused. Use the package's original release filename
|
|
49
|
+
when placing the result in the final download directory.
|
|
50
|
+
4. Validate all five assembled packages with their matching portable patch:
|
|
51
|
+
|
|
52
|
+
```sh
|
|
53
|
+
ci/release/prepare-release.sh assembled-downloads release-assets \
|
|
54
|
+
contrib/release/bitcoin-roots-release-key.asc v30.3-roots.1 5
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
This final gate derives each expected platform from its exact asset filename,
|
|
58
|
+
requires canonical `COPYING`, checks notice index/platform/content hashes,
|
|
59
|
+
and validates every package before copying assets or creating `SHA512SUMS`.
|
|
60
|
+
No flag bypasses notices. `notices.py validate ARCHIVE ROOT PLATFORM` and
|
|
61
|
+
`notices.py stage DIRECTORY INDEX PLATFORM` expose the same caller-pinned
|
|
62
|
+
validation for explicit assembly.
|
|
63
|
+
|
|
64
|
+
Retain the original build run/source identity when repacking. A packaging-only
|
|
65
|
+
source correction requires a reviewed source/portable-patch reconciliation;
|
|
66
|
+
it does not turn an old run into a build of the new commit. Signing, permanent
|
|
67
|
+
tagging and publication remain separate reviewed actions. These checks verify
|
|
68
|
+
notice contents and provenance, not general legal compliance.
|