Skip to content
Bitcoin Roots

v30.3-roots.1 · Commit 67: [PATCH 67/68] fix(release): defer expanded dependency notice coverage

ci/release/README.md

Before: ci/release/README.md · After: ci/release/README.md

File metadata
index 7a7080b4dc6ce783a53502826caa7c67aca1127b..16934005b2cb637e60a18d648445807691a17a21 100644

Download original patch · Release notes

Diff rows 1–79 of 79. Line numbers refer to the original before/after files.

+ Added− RemovedUnmarked lines are context.

Scroll the code area horizontally to read long lines. Before is on the left; after is on the right. Unified view fits narrow screens more easily.

ci/release/README.md CHANGED
@@ -1,4 +1,4 @@
1
- # Release notice assembly
2
 
3
  `release.yml` runs the five-platform pipeline on a permanent Roots tag push;
4
  optional manual dispatch rehearses an absent future tag with read-only
@@ -7,11 +7,19 @@ draft and independently verifies it before separate publication approval.
7
  Manual rehearsal is not required, cannot run against an existing remote tag,
8
  and does not establish binary reproducibility. Source corrections require
9
  renewed review/CI and affected build evidence.
10
- Both paths capture notices from each new build runner before packaging. Only
11
- the tag path enters the `release` environment and requires a signed manifest
12
- before creating a new draft. Public publication remains a separate approval.
13
- Unassembled packages fail before upload or final preparation. No old local
14
- notice bundle or prior binary is substituted for a fresh build.
 
 
 
 
 
 
 
 
15
 
16
  The supported assembly interface uses explicitly reviewed inputs:
17
 
@@ -61,9 +69,9 @@ The supported assembly interface uses explicitly reviewed inputs:
61
  ```
62
 
63
  This final gate derives each expected platform from its exact asset filename,
64
- requires canonical `COPYING`, checks notice index/platform/content hashes,
65
- and validates every package before copying assets or creating `SHA512SUMS`.
66
- No flag bypasses notices. `notices.py validate ARCHIVE ROOT PLATFORM` and
67
  `notices.py stage DIRECTORY INDEX PLATFORM` expose the same caller-pinned
68
  validation for explicit assembly.
69
 
@@ -73,9 +81,10 @@ it does not turn an old run into a build of the new commit. Signing, permanent
73
  tagging and publication remain separate reviewed actions. These checks verify
74
  notice contents and provenance, not general legal compliance.
75
 
76
- ## Runner collection and signed CI draft
77
 
78
- `runner-notices.py` feeds the existing descriptor/collection format above:
 
79
 
80
  - Linux runs inside the build container after the new build, while installed
81
  `depends` toolchains/recipes and verified source archives remain available.
@@ -89,14 +98,16 @@ notice contents and provenance, not general legal compliance.
89
  copyrights. Boost split ports form one logical Boost notice with every exact
90
  installed version/copyright; the pinned manifest baseline remains evidence.
91
 
92
- The platform archive is staged and validated in the same job before upload.
 
 
93
  The tag-only final job downloads only its own run's five archives and patch,
94
  runs `prepare-release.sh`, and requires signing through `sign-manifest.sh` with
95
  `REQUIRE_RELEASE_SIGNATURE=1`. The real secret is passed only to that step;
96
  never copy it to local tooling or build jobs. A missing/mismatched key fails.
97
 
98
  `create-ci-draft.py` requires exactly eight regular nonempty assets. It reuses
99
- the packet/source/notice/patch replay guards, independently imports only the
100
  checked-in public key and verifies `SHA512SUMS.asc` with the expected fingerprint.
101
  It snapshots the checked bytes and curated notes, refreshes remote tag/canonical
102
  identities and paginated release inventory, then calls only
@@ -111,7 +122,7 @@ shares its fail-closed guards with the signed CI path. It is not the normal
111
  release publication route. Never use it to bypass required CI signing.
112
 
113
  Download all eight draft assets independently and check the manifest signature,
114
- six asset checksums, package notices, immutable source/tag, patch replay and
115
  notes before visibility-only publication under separate authority. Repeat the
116
  consumer checks unauthenticated after publication. Interrupted creation needs
117
  operator inspection of the partial draft; reruns cannot replace it.
 
1
+ # Release assembly and optional notice tooling
2
 
3
  `release.yml` runs the five-platform pipeline on a permanent Roots tag push;
4
  optional manual dispatch rehearses an absent future tag with read-only
 
7
  Manual rehearsal is not required, cannot run against an existing remote tag,
8
  and does not establish binary reproducibility. Source corrections require
9
  renewed review/CI and affected build evidence.
10
+ Both paths preserve existing project license files and stage canonical `COPYING`
11
+ before packaging. The user deferred expanded dependency copyright/REUSE
12
+ coverage to future releases; the default release does not require dependency
13
+ notice collection or its index schema. No complete coverage claim is made.
14
+ Only the tag path enters the `release` environment and requires a signed
15
+ manifest before creating a new draft. Public publication needs separate approval.
16
+ Unsafe or unassembled packages fail before upload or final preparation. No
17
+ prior binary is substituted for a fresh build.
18
+
19
+ ## Optional dependency notice tooling
20
+
21
+ The following interface remains available for future coverage work. It is not
22
+ a prerequisite for this release's CI pipeline or draft validation.
23
 
24
  The supported assembly interface uses explicitly reviewed inputs:
25
 
 
69
  ```
70
 
71
  This final gate derives each expected platform from its exact asset filename,
72
+ requires canonical `COPYING` and archive safety, and validates every package
73
+ before copying assets or creating `SHA512SUMS`. Dependency indexes are not
74
+ required by this gate. `notices.py validate ARCHIVE ROOT PLATFORM` and
75
  `notices.py stage DIRECTORY INDEX PLATFORM` expose the same caller-pinned
76
  validation for explicit assembly.
77
 
 
81
  tagging and publication remain separate reviewed actions. These checks verify
82
  notice contents and provenance, not general legal compliance.
83
 
84
+ ## Optional runner collection
85
 
86
+ `runner-notices.py` can feed the descriptor/collection format above for future
87
+ coverage work. It is not invoked by the current release workflow:
88
 
89
  - Linux runs inside the build container after the new build, while installed
90
  `depends` toolchains/recipes and verified source archives remain available.
 
98
  copyrights. Boost split ports form one logical Boost notice with every exact
99
  installed version/copyright; the pinned manifest baseline remains evidence.
100
 
101
+ ## Signed CI draft
102
+
103
+ The platform archive and canonical COPYING are validated before upload.
104
  The tag-only final job downloads only its own run's five archives and patch,
105
  runs `prepare-release.sh`, and requires signing through `sign-manifest.sh` with
106
  `REQUIRE_RELEASE_SIGNATURE=1`. The real secret is passed only to that step;
107
  never copy it to local tooling or build jobs. A missing/mismatched key fails.
108
 
109
  `create-ci-draft.py` requires exactly eight regular nonempty assets. It reuses
110
+ the packet/source/archive/COPYING/patch replay guards, independently imports only the
111
  checked-in public key and verifies `SHA512SUMS.asc` with the expected fingerprint.
112
  It snapshots the checked bytes and curated notes, refreshes remote tag/canonical
113
  identities and paginated release inventory, then calls only
 
122
  release publication route. Never use it to bypass required CI signing.
123
 
124
  Download all eight draft assets independently and check the manifest signature,
125
+ six asset checksums, archive safety/COPYING, immutable source/tag, patch replay and
126
  notes before visibility-only publication under separate authority. Repeat the
127
  consumer checks unauthenticated after publication. Interrupted creation needs
128
  operator inspection of the partial draft; reruns cannot replace it.