v30.3-roots.1 · Commit 67: [PATCH 67/68] fix(release): defer expanded dependency notice coverage
AGENTS.md
Before: AGENTS.md · After: AGENTS.md
File metadata
index 2189bccaa98d638c15684d529af8bce812033a66..facd4db6464d4fa53313bde80cb37c48ecfc5b16 100644
Download original patch · Release notes
Diff rows 1–32 of 32. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. Before is on the left; after is on the right. Unified view fits narrow screens more easily.
AGENTS.md
CHANGED
|
@@ -462,20 +462,20 @@ For canonical CI, main promotion and release tagging:
|
|
| 462 |
Missing or mismatched promotion proof fails. Explicit ci:* labels request
|
| 463 |
fresh coverage. Merge the reviewed promotion with its main exceptions.
|
| 464 |
2. Optional manual `Release artifacts` dispatch may rehearse an absent future
|
| 465 |
-
tag at its full canonical commit. It builds all five platforms and their exact
|
| 466 |
-
runner dependency notices with read-only permissions; it cannot sign or
|
| 467 |
create a release. It is not a prerequisite for the normal tag release.
|
| 468 |
3. Review the source, required CI and any optional rehearsal evidence. Keep the
|
| 469 |
canonical tip stable. Re-fetch refs, create one annotated tag at the reviewed
|
| 470 |
canonical commit, run the release-source validator and push only that tag.
|
| 471 |
-
4. The tag push builds all five platforms anew, captures installed dependency
|
| 472 |
-
notices in each runner and generates/replays the portable patch. Only the
|
| 473 |
tag-only `release` environment job receives the organization signing secret.
|
| 474 |
It requires a manifest signature with the checked-in release-key fingerprint,
|
| 475 |
verifies exactly eight assets and creates only a new draft. Missing signing
|
| 476 |
capability or an existing draft/public release fails; no clobber or deletion.
|
| 477 |
5. Independently download all eight draft assets. Verify tag/source, checksums,
|
| 478 |
-
signature trust, archives, notices, patch replay, contributor credit and
|
| 479 |
separate Git-tag/platform-code signing disclosures. Public visibility needs
|
| 480 |
separate authority after this concrete verification.
|
| 481 |
6. Repeat verification through an unauthenticated client after publication.
|
|
@@ -486,3 +486,7 @@ The detailed commands and branch maintenance rules are in
|
|
| 486 |
`contrib/roots/README.md`. Authenticate the official Core tag and its signer
|
| 487 |
key through independent trusted sources, run `git verify-tag v30.3`, and record
|
| 488 |
both the signature result and its trust basis before claiming verification.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 462 |
Missing or mismatched promotion proof fails. Explicit ci:* labels request
|
| 463 |
fresh coverage. Merge the reviewed promotion with its main exceptions.
|
| 464 |
2. Optional manual `Release artifacts` dispatch may rehearse an absent future
|
| 465 |
+
tag at its full canonical commit. It builds all five platforms with read-only
|
| 466 |
+
permissions; it cannot sign or
|
| 467 |
create a release. It is not a prerequisite for the normal tag release.
|
| 468 |
3. Review the source, required CI and any optional rehearsal evidence. Keep the
|
| 469 |
canonical tip stable. Re-fetch refs, create one annotated tag at the reviewed
|
| 470 |
canonical commit, run the release-source validator and push only that tag.
|
| 471 |
+
4. The tag push builds all five platforms anew, stages canonical COPYING and
|
| 472 |
+
generates/replays the portable patch. Only the
|
| 473 |
tag-only `release` environment job receives the organization signing secret.
|
| 474 |
It requires a manifest signature with the checked-in release-key fingerprint,
|
| 475 |
verifies exactly eight assets and creates only a new draft. Missing signing
|
| 476 |
capability or an existing draft/public release fails; no clobber or deletion.
|
| 477 |
5. Independently download all eight draft assets. Verify tag/source, checksums,
|
| 478 |
+
signature trust, archive safety/COPYING, patch replay, contributor credit and
|
| 479 |
separate Git-tag/platform-code signing disclosures. Public visibility needs
|
| 480 |
separate authority after this concrete verification.
|
| 481 |
6. Repeat verification through an unauthenticated client after publication.
|
|
|
|
| 486 |
`contrib/roots/README.md`. Authenticate the official Core tag and its signer
|
| 487 |
key through independent trusted sources, run `git verify-tag v30.3`, and record
|
| 488 |
both the signature result and its trust basis before claiming verification.
|
| 489 |
+
|
| 490 |
+
For this release, the user deferred expanded dependency copyright/REUSE coverage
|
| 491 |
+
to future releases. The normal pipeline retains project license files and
|
| 492 |
+
canonical COPYING; optional notice tools do not establish complete coverage.
|