v30.3-roots.1 · Commit 62: [PATCH 62/68] fix(release): create drafts from reviewed immutable assets
contrib/roots/README.md
Before: contrib/roots/README.md · After: contrib/roots/README.md
File metadata
index a56e8c5b289078d834fec8af38c172398c01d1c0..a4a46df1ab907b2cf2ed9a11eee43888ef30c1bf 100644
Download original patch · Release notes
Diff rows 1–47 of 47. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.
contrib/roots/README.md
CHANGED
|
@@ -254,6 +254,8 @@ Run the retained release metadata tests before pushing:
|
|
|
254
254
|
|
|
255
255
|
```sh
|
|
256
256
|
python3 ci/test/test_prepare_release.py
|
|
257
|
+
python3 ci/test/test_release_notices.py
|
|
258
|
+
python3 ci/test/test_create_release_draft.py
|
|
257
259
|
python3 ci/test/test_prepare_release_source.py
|
|
258
260
|
python3 ci/test/test_create_patch_series.py
|
|
259
261
|
python3 ci/test/test_sign_manifest.py
|
|
@@ -262,8 +264,8 @@ python3 ci/test/test_validate_release_source.py
|
|
|
262
264
|
python3 ci/test/test_release_version.py
|
|
263
265
|
```
|
|
264
266
|
|
|
265
|
-
GitHub Actions tag workflows check out the tagged commit; a release tag does not
|
|
266
|
-
need to be reachable from `main`. Release validation instead requires the tag
|
|
267
|
+
A release tag does not need to be reachable from `main`. Permanent tag pushes
|
|
268
|
+
do not dispatch builds or upload assets. Release validation requires the tag
|
|
267
269
|
target to match its canonical `roots/<core-version>` branch. The release patch
|
|
268
270
|
is generated from the Core tag and canonical commits at release time and is not
|
|
269
271
|
checked into the repository. It deliberately excludes `.github/**`: Roots'
|
|
@@ -286,10 +288,22 @@ The series contains inherited CRLF files. Apply the released mbox with
|
|
|
286
288
|
those bytes. Replay verification uses the same command and checks tree equality
|
|
287
289
|
outside `.github/**`.
|
|
288
290
|
|
|
289
|
-
Pushing the annotated tag builds Linux x86_64, Linux aarch64, macOS x86_64,
|
|
290
|
-
macOS arm64, and Windows x86_64 archives. The draft release also contains the
|
|
291
|
-
Git-am-compatible patch series and `SHA512SUMS`; `SHA512SUMS.asc` is included
|
|
292
|
-
when the release environment has a matching signing key configured. The
|
|
293
|
-
tag-triggered workflow creates a draft, not an immediately public release.
|
|
294
|
-
Independently verify the draft's archives, patch, checksums, optional signature,
|
|
295
|
-
tag target, and source tree before changing only the draft's visibility.
|
|
291
|
+
The read-only manual workflow builds Linux x86_64/aarch64, macOS x86_64/arm64
|
|
292
|
+
and Windows x86_64 intermediates plus the portable patch. Assemble the reviewed
|
|
293
|
+
notices and final assets through `ci/release/README.md` before tagging. Pin the
|
|
294
|
+
exact candidate commit, six asset checksums, manifest digest and curated notes
|
|
295
|
+
digest in the release review. A packaging-only correction must reconcile the
|
|
296
|
+
source/patch and disclose the original build source; it must not relabel older
|
|
297
|
+
executables as newly built.
|
|
298
|
+
|
|
299
|
+
After an explicitly authorized immutable annotated tag is pushed, use the
|
|
300
|
+
verified-assets draft helper documented in `ci/release/README.md`. It rechecks
|
|
301
|
+
the remote canonical/tag identities, notices, checksums and exact replayed
|
|
302
|
+
patch, and refuses any existing release. It does not build or publish. The
|
|
303
|
+
current helper accepts an unsigned seven-file packet; describe manifest, tag
|
|
304
|
+
and platform signing separately and accurately. The existing
|
|
305
|
+
`sign-manifest.sh` interface remains available for separately authorized signing,
|
|
306
|
+
but signed packets require a separate reviewed handoff. Independently download
|
|
307
|
+
and verify the draft's archives, patch, checksums, notes, tag target and source
|
|
308
|
+
before changing only its visibility under publication authority. Never replace
|
|
309
|
+
published tags/assets or use `--clobber`.
|