Skip to content
Bitcoin Roots

v30.3-roots.1 · Commit 63: [PATCH 63/68] fix(release): restore signed five-platform CI releases

ci/release/README.md

Before: ci/release/README.md · After: ci/release/README.md

File metadata
index 6fac0115d61b93777f982345a85a7c269bb4842b..5764b45fc2a94fea35bf89e14b6ceb387840b20c 100644

Download original patch · Release notes

Diff rows 1–110 of 110. Line numbers refer to the original before/after files.

+ Added− RemovedUnmarked lines are context.

Scroll the code area horizontally to read long lines. Before is on the left; after is on the right. Unified view fits narrow screens more easily.

ci/release/README.md CHANGED
@@ -1,12 +1,12 @@
1
  # Release notice assembly
2
 
3
- Platform build artifacts are intermediate packages. A green build proves the
4
- built product, but its package must also pass notice assembly before becoming a
5
- release asset. `release.yml` is a read-only `workflow_dispatch` build/rehearsal;
6
- permanent tag pushes do not start builds or create a draft. Maintainers explicitly
7
- assemble reviewed platform notices, validate the final packet and use the draft
8
- helper below. Unassembled packages are rejected before upload. Automatic discovery
9
- or acquisition of dependency notice inputs is not part of release execution.
10
 
11
  The supported assembly interface uses explicitly reviewed inputs:
12
 
@@ -68,49 +68,45 @@ it does not turn an old run into a build of the new commit. Signing, permanent
68
  tagging and publication remain separate reviewed actions. These checks verify
69
  notice contents and provenance, not general legal compliance.
70
 
71
- ## Immutable reviewed-assets draft
72
-
73
- Complete source review, canonical/main integration and asset review first.
74
- Authorize the exact annotated tag target and push only that tag; no tag-triggered
75
- build or draft job runs. The canonical tip must remain unchanged. Release assets
76
- must be outside the clean tagged source checkout and contain exactly the five
77
- platform archives, `bitcoin-roots-<version>.patch` and `SHA512SUMS`. Record the
78
- manifest's SHA512 digest and curated notes' SHA256 digest in the review; passing
79
- newly calculated digests is not a substitute for acceptance of those bytes.
80
-
81
- From the clean checkout at the approved commit, validate the complete handoff:
82
-
83
- ```sh
84
- python3 ci/release/create-draft.py \
85
- --tag v30.3-roots.1 --commit <approved-40-hex-commit> \
86
- --repository LuganoPlanB/bitcoin-roots \
87
- --assets /absolute/path/to/reviewed-release-assets \
88
- --notes /absolute/path/to/reviewed-release-notes.md \
89
- --manifest-sha512 <reviewed-128-hex-digest> \
90
- --notes-sha256 <reviewed-64-hex-digest>
91
- ```
92
-
93
- The default validates without a remote write. After explicit draft authority,
94
- repeat the same command with `--create-draft`. The helper copies the exact packet
95
- and notes into a private temporary snapshot, verifies all six checksums, archive
96
- roots/COPYING/platform notice indexes, local annotated tag/source/linear ancestry,
97
- and the exact portable patch regenerated and replayed from that tag. It then
98
- refreshes remote canonical/tag object/peeled identities and checks every page of
99
- the release inventory. Network/API failure or any existing draft/public release
100
- blocks creation. The only write is `gh release create --draft --verify-tag` with
101
- those seven immutable assets and the reviewed notes; it never updates, clobbers
102
- or publishes an existing release. An interrupted upload requires independent
103
- inspection of its partial draft, not an automatic helper retry or replacement.
104
-
105
- This initial handoff accepts unsigned manifests only. `SHA512SUMS.asc` or any
106
- unexpected file is rejected. Do not infer signing from the inherited public-key
107
- comment in SHA512SUMS. Optional use of `sign-manifest.sh` remains a separate
108
- signing operation, with signed-packet upload requiring its own reviewed path;
109
- never access signing secrets for unsigned draft creation. State the actual Git
110
- tag, manifest and platform-code signature status in the notes.
111
-
112
- Independently download and verify the newly created draft, including notes and
113
- contributor credit, before separately authorized visibility-only publication.
114
- After publication verify all public assets unauthenticated. The helper requires
115
- canonical-tip equality before draft creation; later consumer verification uses
116
- the immutable release tag when the canonical branch has advanced.
 
1
  # Release notice assembly
2
 
3
+ `release.yml` runs the five-platform pipeline on a permanent Roots tag push;
4
+ manual dispatch rehearses an absent future tag with read-only permissions.
5
+ Both paths capture notices from each new build runner before packaging. Only
6
+ the tag path enters the `release` environment and requires a signed manifest
7
+ before creating a new draft. Public publication remains a separate approval.
8
+ Unassembled packages fail before upload or final preparation. No old local
9
+ notice bundle or prior binary is substituted for a fresh build.
10
 
11
  The supported assembly interface uses explicitly reviewed inputs:
12
 
 
68
  tagging and publication remain separate reviewed actions. These checks verify
69
  notice contents and provenance, not general legal compliance.
70
 
71
+ ## Runner collection and signed CI draft
72
+
73
+ `runner-notices.py` feeds the existing descriptor/collection format above:
74
+
75
+ - Linux runs inside the build container after the new build, while installed
76
+ `depends` toolchains/recipes and verified source archives remain available.
77
+ The notice tree persists into the mounted build directory. Both architectures
78
+ independently capture selected packages and Qt's additional source archives.
79
+ - macOS captures matching installed Homebrew formula receipts and verified
80
+ source hashes for required dependencies and any extra Qt modules proven in
81
+ the built bundle. Qt's non-archive umbrella and unrelated CA/tool formulas
82
+ are excluded. Bundle hashes/`otool` records prove system SQLite linkage.
83
+ - Windows captures the actual `build/vcpkg_installed` status and static-triplet
84
+ copyrights. Boost split ports form one logical Boost notice with every exact
85
+ installed version/copyright; the pinned manifest baseline remains evidence.
86
+
87
+ The platform archive is staged and validated in the same job before upload.
88
+ The tag-only final job downloads only its own run's five archives and patch,
89
+ runs `prepare-release.sh`, and requires signing through `sign-manifest.sh` with
90
+ `REQUIRE_RELEASE_SIGNATURE=1`. The real secret is passed only to that step;
91
+ never copy it to local tooling or build jobs. A missing/mismatched key fails.
92
+
93
+ `create-ci-draft.py` requires exactly eight regular nonempty assets. It reuses
94
+ the packet/source/notice/patch replay guards, independently imports only the
95
+ checked-in public key and verifies `SHA512SUMS.asc` with the expected fingerprint.
96
+ It snapshots the checked bytes and curated notes, refreshes remote tag/canonical
97
+ identities and paginated release inventory, then calls only
98
+ `gh release create --draft --verify-tag`. Any existing draft/public release or
99
+ network ambiguity fails closed; no clobber/update/deletion/replacement exists.
100
+ The notes add the actual fresh build run/source and distinguish manifest, Git
101
+ and platform signatures. `contrib/release/release-notes.md` is the reviewed
102
+ curated template, including #24/#25 contributor credit.
103
+
104
+ The older `create-draft.py` remains a validation/unsigned-packet utility and
105
+ shares its fail-closed guards with the signed CI path. It is not the normal
106
+ release publication route. Never use it to bypass required CI signing.
107
+
108
+ Download all eight draft assets independently and check the manifest signature,
109
+ six asset checksums, package notices, immutable source/tag, patch replay and
110
+ notes before visibility-only publication under separate authority. Repeat the
111
+ consumer checks unauthenticated after publication. Interrupted creation needs
112
+ operator inspection of the partial draft; reruns cannot replace it.