Skip to content
Bitcoin Roots

v30.3-roots.1 · Commit 67: [PATCH 67/68] fix(release): defer expanded dependency notice coverage

ci/release/README.md

Before: ci/release/README.md · After: ci/release/README.md

File metadata
index 7a7080b4dc6ce783a53502826caa7c67aca1127b..16934005b2cb637e60a18d648445807691a17a21 100644

Download original patch · Release notes

Diff rows 1–79 of 79. Line numbers refer to the original before/after files.

+ Added− RemovedUnmarked lines are context.

Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.

ci/release/README.md CHANGED
@@ -1,4 +1,4 @@
1
- # Release notice assembly
1
+ # Release assembly and optional notice tooling
2
2
 
3
3
  `release.yml` runs the five-platform pipeline on a permanent Roots tag push;
4
4
  optional manual dispatch rehearses an absent future tag with read-only
@@ -7,11 +7,19 @@ draft and independently verifies it before separate publication approval.
7
7
  Manual rehearsal is not required, cannot run against an existing remote tag,
8
8
  and does not establish binary reproducibility. Source corrections require
9
9
  renewed review/CI and affected build evidence.
10
- Both paths capture notices from each new build runner before packaging. Only
11
- the tag path enters the `release` environment and requires a signed manifest
12
- before creating a new draft. Public publication remains a separate approval.
13
- Unassembled packages fail before upload or final preparation. No old local
14
- notice bundle or prior binary is substituted for a fresh build.
10
+ Both paths preserve existing project license files and stage canonical `COPYING`
11
+ before packaging. The user deferred expanded dependency copyright/REUSE
12
+ coverage to future releases; the default release does not require dependency
13
+ notice collection or its index schema. No complete coverage claim is made.
14
+ Only the tag path enters the `release` environment and requires a signed
15
+ manifest before creating a new draft. Public publication needs separate approval.
16
+ Unsafe or unassembled packages fail before upload or final preparation. No
17
+ prior binary is substituted for a fresh build.
18
+
19
+ ## Optional dependency notice tooling
20
+
21
+ The following interface remains available for future coverage work. It is not
22
+ a prerequisite for this release's CI pipeline or draft validation.
15
23
 
16
24
  The supported assembly interface uses explicitly reviewed inputs:
17
25
 
@@ -61,9 +69,9 @@ The supported assembly interface uses explicitly reviewed inputs:
61
69
  ```
62
70
 
63
71
  This final gate derives each expected platform from its exact asset filename,
64
- requires canonical `COPYING`, checks notice index/platform/content hashes,
65
- and validates every package before copying assets or creating `SHA512SUMS`.
66
- No flag bypasses notices. `notices.py validate ARCHIVE ROOT PLATFORM` and
72
+ requires canonical `COPYING` and archive safety, and validates every package
73
+ before copying assets or creating `SHA512SUMS`. Dependency indexes are not
74
+ required by this gate. `notices.py validate ARCHIVE ROOT PLATFORM` and
67
75
  `notices.py stage DIRECTORY INDEX PLATFORM` expose the same caller-pinned
68
76
  validation for explicit assembly.
69
77
 
@@ -73,9 +81,10 @@ it does not turn an old run into a build of the new commit. Signing, permanent
73
81
  tagging and publication remain separate reviewed actions. These checks verify
74
82
  notice contents and provenance, not general legal compliance.
75
83
 
76
- ## Runner collection and signed CI draft
84
+ ## Optional runner collection
77
85
 
78
- `runner-notices.py` feeds the existing descriptor/collection format above:
86
+ `runner-notices.py` can feed the descriptor/collection format above for future
87
+ coverage work. It is not invoked by the current release workflow:
79
88
 
80
89
  - Linux runs inside the build container after the new build, while installed
81
90
  `depends` toolchains/recipes and verified source archives remain available.
@@ -89,14 +98,16 @@ notice contents and provenance, not general legal compliance.
89
98
  copyrights. Boost split ports form one logical Boost notice with every exact
90
99
  installed version/copyright; the pinned manifest baseline remains evidence.
91
100
 
92
- The platform archive is staged and validated in the same job before upload.
101
+ ## Signed CI draft
102
+
103
+ The platform archive and canonical COPYING are validated before upload.
93
104
  The tag-only final job downloads only its own run's five archives and patch,
94
105
  runs `prepare-release.sh`, and requires signing through `sign-manifest.sh` with
95
106
  `REQUIRE_RELEASE_SIGNATURE=1`. The real secret is passed only to that step;
96
107
  never copy it to local tooling or build jobs. A missing/mismatched key fails.
97
108
 
98
109
  `create-ci-draft.py` requires exactly eight regular nonempty assets. It reuses
99
- the packet/source/notice/patch replay guards, independently imports only the
110
+ the packet/source/archive/COPYING/patch replay guards, independently imports only the
100
111
  checked-in public key and verifies `SHA512SUMS.asc` with the expected fingerprint.
101
112
  It snapshots the checked bytes and curated notes, refreshes remote tag/canonical
102
113
  identities and paginated release inventory, then calls only
@@ -111,7 +122,7 @@ shares its fail-closed guards with the signed CI path. It is not the normal
111
122
  release publication route. Never use it to bypass required CI signing.
112
123
 
113
124
  Download all eight draft assets independently and check the manifest signature,
114
- six asset checksums, package notices, immutable source/tag, patch replay and
125
+ six asset checksums, archive safety/COPYING, immutable source/tag, patch replay and
115
126
  notes before visibility-only publication under separate authority. Repeat the
116
127
  consumer checks unauthenticated after publication. Interrupted creation needs
117
128
  operator inspection of the partial draft; reruns cannot replace it.