v30.3-roots.1 · Commit 61: [PATCH 61/68] fix(release): assemble platform-specific license notices
ci/release/README.md
Before: /dev/null · After: ci/release/README.md
File metadata
new file mode 100644 index 0000000000000000000000000000000000000000..bdb57d69bdd4d9baccc2583202c93b0e2e03e24f
Download original patch · Release notes
Diff rows 1–68 of 68. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. Before is on the left; after is on the right. Unified view fits narrow screens more easily.
ci/release/README.md
ADDED
|
@@ -0,0 +1,68 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
# Release notice assembly
|
| 2 |
+
|
| 3 |
+
Platform build artifacts are intermediate packages. A green build proves the
|
| 4 |
+
built product, but its package must also pass notice assembly before becoming a
|
| 5 |
+
release asset. The workflow's draft job runs `prepare-release.sh` before signing
|
| 6 |
+
or uploading anything. It fails closed if the downloaded packages lack valid
|
| 7 |
+
platform-specific notices. Automatic discovery or acquisition of dependency
|
| 8 |
+
notice inputs is not part of release execution.
|
| 9 |
+
|
| 10 |
+
The supported assembly interface uses explicitly reviewed inputs:
|
| 11 |
+
|
| 12 |
+
1. Prepare a descriptor for each platform from retained build logs, binary
|
| 13 |
+
version metadata, dependency recipes or package metadata. Preserve source
|
| 14 |
+
notice bytes and identify the exact version, primary origin, source hash and
|
| 15 |
+
evidence. The descriptor is a JSON object keyed by component. Each entry has
|
| 16 |
+
`version`, `source`, `source_sha256`, `provenance_type`, `evidence`, `files`,
|
| 17 |
+
and optionally `role`. Paths in `evidence` and `files` are absolute or relative
|
| 18 |
+
to the descriptor. `build-receipt` entries can instead supply `receipt`;
|
| 19 |
+
their source hash defaults to the receipt hash. Independent provenance can
|
| 20 |
+
use `pinned-source-archive` or `versioned-primary-notice` without an old runner
|
| 21 |
+
receipt. `source-version-stability` keeps `version` as `unknown` and records
|
| 22 |
+
`notice_stable_versions` only when authoritative notice bytes are identical
|
| 23 |
+
across the reviewed range. A source hash means the source archive hash for
|
| 24 |
+
archive provenance, or the primary notice-source record digest for notice
|
| 25 |
+
provenance; retained evidence identifies which and includes notice hashes.
|
| 26 |
+
2. Collect the reviewed inputs into a new directory:
|
| 27 |
+
|
| 28 |
+
```sh
|
| 29 |
+
python3 ci/release/notices.py collect linux-x86_64 descriptor.json notice-inputs
|
| 30 |
+
```
|
| 31 |
+
|
| 32 |
+
The collector adds tracked component licenses and embedded font attribution,
|
| 33 |
+
retains provenance and builds a hashed index. Conservative source-availability
|
| 34 |
+
notices should be labeled with `role`; they do not establish actual linkage.
|
| 35 |
+
3. Add notices to a new package without modifying existing members:
|
| 36 |
+
|
| 37 |
+
```sh
|
| 38 |
+
python3 ci/release/repack.py intermediate.tar.gz assembled.tar.gz \
|
| 39 |
+
bitcoin-roots-30.3-roots.1 notice-inputs/index.json linux-x86_64
|
| 40 |
+
```
|
| 41 |
+
|
| 42 |
+
The repacker adds canonical `COPYING` and `notices/` at the archive root,
|
| 43 |
+
outside signed applications. It preserves every existing member's bytes,
|
| 44 |
+
modes, timestamps and symlink contents. Existing destinations, including
|
| 45 |
+
dangling symlinks, are refused. An existing regular COPYING must match
|
| 46 |
+
canonical bytes and is preserved as an original member; COPYING is added
|
| 47 |
+
only when missing. Altered/nonregular COPYING or an existing notices tree
|
| 48 |
+
is refused. Use the package's original release filename
|
| 49 |
+
when placing the result in the final download directory.
|
| 50 |
+
4. Validate all five assembled packages with their matching portable patch:
|
| 51 |
+
|
| 52 |
+
```sh
|
| 53 |
+
ci/release/prepare-release.sh assembled-downloads release-assets \
|
| 54 |
+
contrib/release/bitcoin-roots-release-key.asc v30.3-roots.1 5
|
| 55 |
+
```
|
| 56 |
+
|
| 57 |
+
This final gate derives each expected platform from its exact asset filename,
|
| 58 |
+
requires canonical `COPYING`, checks notice index/platform/content hashes,
|
| 59 |
+
and validates every package before copying assets or creating `SHA512SUMS`.
|
| 60 |
+
No flag bypasses notices. `notices.py validate ARCHIVE ROOT PLATFORM` and
|
| 61 |
+
`notices.py stage DIRECTORY INDEX PLATFORM` expose the same caller-pinned
|
| 62 |
+
validation for explicit assembly.
|
| 63 |
+
|
| 64 |
+
Retain the original build run/source identity when repacking. A packaging-only
|
| 65 |
+
source correction requires a reviewed source/portable-patch reconciliation;
|
| 66 |
+
it does not turn an old run into a build of the new commit. Signing, permanent
|
| 67 |
+
tagging and publication remain separate reviewed actions. These checks verify
|
| 68 |
+
notice contents and provenance, not general legal compliance.
|