v30.3-roots.1 · Commit 67: [PATCH 67/68] fix(release): defer expanded dependency notice coverage
ci/release/create-ci-draft.py
Before: ci/release/create-ci-draft.py · After: ci/release/create-ci-draft.py
File metadata
index 90d123f1a5b5422bd3af80a1fd24c4cfe38085f6..0ef745ac32d5e0cf4159b7388cdf17fff6420a3c 100755
Download original patch · Release notes
Diff rows 1–16 of 16. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.
ci/release/create-ci-draft.py
CHANGED
|
@@ -57,7 +57,7 @@ def create(args):
|
|
|
57
57
|
notes.write_text(template + '\n## CI build and signing provenance\n\n'
|
|
58
58
|
f'All five platform packages were built from `{args.commit}` in '
|
|
59
59
|
f'[GitHub Actions run {args.run_id}](https://github.com/{args.repository}/actions/runs/{args.run_id}). '
|
|
60
|
-
'Dependency notices were collected from each build runner.\n\n'
|
|
60
|
+
'Packages include the project COPYING file.\n\n'
|
|
61
61
|
f'`SHA512SUMS.asc` signs the SHA512 manifest with release key `{args.fingerprint}`. '
|
|
62
62
|
'This checksum signature is separate from Git-tag and platform-code signing. '
|
|
63
63
|
'The annotated Git tag is unsigned. macOS applications retain ad-hoc signatures, '
|
|
@@ -69,7 +69,7 @@ def create(args):
|
|
|
69
69
|
snapshot = temporary / 'snapshot'
|
|
70
70
|
snapshot.mkdir()
|
|
71
71
|
names, patch, snapshot_notes = draft.snapshot_packet(args, snapshot)
|
|
72
|
-
# snapshot_packet validates every checksum, COPYING and platform notice index.
|
|
72
|
+
# snapshot_packet validates every checksum, canonical COPYING and archive safety.
|
|
73
73
|
signature = snapshot / 'SHA512SUMS.asc'
|
|
74
74
|
shutil.copyfile(Path(args.original_assets) / signature.name, signature)
|
|
75
75
|
verify_signature(snapshot / 'SHA512SUMS', signature, args.public_key, args.fingerprint, temporary / 'verify-home')
|