v30.3-roots.1 · Commit 62: [PATCH 62/68] fix(release): create drafts from reviewed immutable assets
contrib/roots/README.md
Before: contrib/roots/README.md · After: contrib/roots/README.md
File metadata
index a56e8c5b289078d834fec8af38c172398c01d1c0..a4a46df1ab907b2cf2ed9a11eee43888ef30c1bf 100644
Download original patch · Release notes
Diff rows 1–47 of 47. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. Before is on the left; after is on the right. Unified view fits narrow screens more easily.
contrib/roots/README.md
CHANGED
|
@@ -254,6 +254,8 @@ Run the retained release metadata tests before pushing:
|
|
| 254 |
|
| 255 |
```sh
|
| 256 |
python3 ci/test/test_prepare_release.py
|
|
|
|
|
|
|
| 257 |
python3 ci/test/test_prepare_release_source.py
|
| 258 |
python3 ci/test/test_create_patch_series.py
|
| 259 |
python3 ci/test/test_sign_manifest.py
|
|
@@ -262,8 +264,8 @@ python3 ci/test/test_validate_release_source.py
|
|
| 262 |
python3 ci/test/test_release_version.py
|
| 263 |
```
|
| 264 |
|
| 265 |
-
GitHub Actions tag workflows check out the tagged commit; a release tag does not
|
| 266 |
-
need to be reachable from `main`. Release validation instead requires the tag
|
| 267 |
target to match its canonical `roots/<core-version>` branch. The release patch
|
| 268 |
is generated from the Core tag and canonical commits at release time and is not
|
| 269 |
checked into the repository. It deliberately excludes `.github/**`: Roots'
|
|
@@ -286,10 +288,22 @@ The series contains inherited CRLF files. Apply the released mbox with
|
|
| 286 |
those bytes. Replay verification uses the same command and checks tree equality
|
| 287 |
outside `.github/**`.
|
| 288 |
|
| 289 |
-
Pushing the annotated tag builds Linux x86_64, Linux aarch64, macOS x86_64,
|
| 290 |
-
macOS arm64, and Windows x86_64 archives. The draft release also contains the
|
| 291 |
-
Git-am-compatible patch series and `SHA512SUMS`; `SHA512SUMS.asc` is included
|
| 292 |
-
when the release environment has a matching signing key configured. The
|
| 293 |
-
tag-triggered workflow creates a draft, not an immediately public release.
|
| 294 |
-
Independently verify the draft's archives, patch, checksums, optional signature,
|
| 295 |
-
tag target, and source tree before changing only the draft's visibility.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 254 |
|
| 255 |
```sh
|
| 256 |
python3 ci/test/test_prepare_release.py
|
| 257 |
+
python3 ci/test/test_release_notices.py
|
| 258 |
+
python3 ci/test/test_create_release_draft.py
|
| 259 |
python3 ci/test/test_prepare_release_source.py
|
| 260 |
python3 ci/test/test_create_patch_series.py
|
| 261 |
python3 ci/test/test_sign_manifest.py
|
|
|
|
| 264 |
python3 ci/test/test_release_version.py
|
| 265 |
```
|
| 266 |
|
| 267 |
+
A release tag does not need to be reachable from `main`. Permanent tag pushes
|
| 268 |
+
do not dispatch builds or upload assets. Release validation requires the tag
|
| 269 |
target to match its canonical `roots/<core-version>` branch. The release patch
|
| 270 |
is generated from the Core tag and canonical commits at release time and is not
|
| 271 |
checked into the repository. It deliberately excludes `.github/**`: Roots'
|
|
|
|
| 288 |
those bytes. Replay verification uses the same command and checks tree equality
|
| 289 |
outside `.github/**`.
|
| 290 |
|
| 291 |
+
The read-only manual workflow builds Linux x86_64/aarch64, macOS x86_64/arm64
|
| 292 |
+
and Windows x86_64 intermediates plus the portable patch. Assemble the reviewed
|
| 293 |
+
notices and final assets through `ci/release/README.md` before tagging. Pin the
|
| 294 |
+
exact candidate commit, six asset checksums, manifest digest and curated notes
|
| 295 |
+
digest in the release review. A packaging-only correction must reconcile the
|
| 296 |
+
source/patch and disclose the original build source; it must not relabel older
|
| 297 |
+
executables as newly built.
|
| 298 |
+
|
| 299 |
+
After an explicitly authorized immutable annotated tag is pushed, use the
|
| 300 |
+
verified-assets draft helper documented in `ci/release/README.md`. It rechecks
|
| 301 |
+
the remote canonical/tag identities, notices, checksums and exact replayed
|
| 302 |
+
patch, and refuses any existing release. It does not build or publish. The
|
| 303 |
+
current helper accepts an unsigned seven-file packet; describe manifest, tag
|
| 304 |
+
and platform signing separately and accurately. The existing
|
| 305 |
+
`sign-manifest.sh` interface remains available for separately authorized signing,
|
| 306 |
+
but signed packets require a separate reviewed handoff. Independently download
|
| 307 |
+
and verify the draft's archives, patch, checksums, notes, tag target and source
|
| 308 |
+
before changing only its visibility under publication authority. Never replace
|
| 309 |
+
published tags/assets or use `--clobber`.
|