v30.3-roots.1 · Commit 67: [PATCH 67/68] fix(release): defer expanded dependency notice coverage
AGENTS.md
Before: AGENTS.md · After: AGENTS.md
File metadata
index 2189bccaa98d638c15684d529af8bce812033a66..facd4db6464d4fa53313bde80cb37c48ecfc5b16 100644
Download original patch · Release notes
Diff rows 1–32 of 32. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.
AGENTS.md
CHANGED
|
@@ -462,20 +462,20 @@ For canonical CI, main promotion and release tagging:
|
|
|
462
462
|
Missing or mismatched promotion proof fails. Explicit ci:* labels request
|
|
463
463
|
fresh coverage. Merge the reviewed promotion with its main exceptions.
|
|
464
464
|
2. Optional manual `Release artifacts` dispatch may rehearse an absent future
|
|
465
|
-
tag at its full canonical commit. It builds all five platforms and their exact
|
|
466
|
-
runner dependency notices with read-only permissions; it cannot sign or
|
|
465
|
+
tag at its full canonical commit. It builds all five platforms with read-only
|
|
466
|
+
permissions; it cannot sign or
|
|
467
467
|
create a release. It is not a prerequisite for the normal tag release.
|
|
468
468
|
3. Review the source, required CI and any optional rehearsal evidence. Keep the
|
|
469
469
|
canonical tip stable. Re-fetch refs, create one annotated tag at the reviewed
|
|
470
470
|
canonical commit, run the release-source validator and push only that tag.
|
|
471
|
-
4. The tag push builds all five platforms anew, captures installed dependency
|
|
472
|
-
notices in each runner and generates/replays the portable patch. Only the
|
|
471
|
+
4. The tag push builds all five platforms anew, stages canonical COPYING and
|
|
472
|
+
generates/replays the portable patch. Only the
|
|
473
473
|
tag-only `release` environment job receives the organization signing secret.
|
|
474
474
|
It requires a manifest signature with the checked-in release-key fingerprint,
|
|
475
475
|
verifies exactly eight assets and creates only a new draft. Missing signing
|
|
476
476
|
capability or an existing draft/public release fails; no clobber or deletion.
|
|
477
477
|
5. Independently download all eight draft assets. Verify tag/source, checksums,
|
|
478
|
-
signature trust, archives, notices, patch replay, contributor credit and
|
|
478
|
+
signature trust, archive safety/COPYING, patch replay, contributor credit and
|
|
479
479
|
separate Git-tag/platform-code signing disclosures. Public visibility needs
|
|
480
480
|
separate authority after this concrete verification.
|
|
481
481
|
6. Repeat verification through an unauthenticated client after publication.
|
|
@@ -486,3 +486,7 @@ The detailed commands and branch maintenance rules are in
|
|
|
486
486
|
`contrib/roots/README.md`. Authenticate the official Core tag and its signer
|
|
487
487
|
key through independent trusted sources, run `git verify-tag v30.3`, and record
|
|
488
488
|
both the signature result and its trust basis before claiming verification.
|
|
489
|
+
|
|
490
|
+
For this release, the user deferred expanded dependency copyright/REUSE coverage
|
|
491
|
+
to future releases. The normal pipeline retains project license files and
|
|
492
|
+
canonical COPYING; optional notice tools do not establish complete coverage.
|