v30.3-roots.1 · Commit 67: [PATCH 67/68] fix(release): defer expanded dependency notice coverage
ci/release/create-ci-draft.py
Before: ci/release/create-ci-draft.py · After: ci/release/create-ci-draft.py
File metadata
index 90d123f1a5b5422bd3af80a1fd24c4cfe38085f6..0ef745ac32d5e0cf4159b7388cdf17fff6420a3c 100755
Download original patch · Release notes
Diff rows 1–16 of 16. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. Before is on the left; after is on the right. Unified view fits narrow screens more easily.
ci/release/create-ci-draft.py
CHANGED
|
@@ -57,7 +57,7 @@ def create(args):
|
|
| 57 |
notes.write_text(template + '\n## CI build and signing provenance\n\n'
|
| 58 |
f'All five platform packages were built from `{args.commit}` in '
|
| 59 |
f'[GitHub Actions run {args.run_id}](https://github.com/{args.repository}/actions/runs/{args.run_id}). '
|
| 60 |
-
'Dependency notices were collected from each build runner.\n\n'
|
| 61 |
f'`SHA512SUMS.asc` signs the SHA512 manifest with release key `{args.fingerprint}`. '
|
| 62 |
'This checksum signature is separate from Git-tag and platform-code signing. '
|
| 63 |
'The annotated Git tag is unsigned. macOS applications retain ad-hoc signatures, '
|
|
@@ -69,7 +69,7 @@ def create(args):
|
|
| 69 |
snapshot = temporary / 'snapshot'
|
| 70 |
snapshot.mkdir()
|
| 71 |
names, patch, snapshot_notes = draft.snapshot_packet(args, snapshot)
|
| 72 |
-
# snapshot_packet validates every checksum, COPYING and platform notice index.
|
| 73 |
signature = snapshot / 'SHA512SUMS.asc'
|
| 74 |
shutil.copyfile(Path(args.original_assets) / signature.name, signature)
|
| 75 |
verify_signature(snapshot / 'SHA512SUMS', signature, args.public_key, args.fingerprint, temporary / 'verify-home')
|
|
|
|
| 57 |
notes.write_text(template + '\n## CI build and signing provenance\n\n'
|
| 58 |
f'All five platform packages were built from `{args.commit}` in '
|
| 59 |
f'[GitHub Actions run {args.run_id}](https://github.com/{args.repository}/actions/runs/{args.run_id}). '
|
| 60 |
+
'Packages include the project COPYING file.\n\n'
|
| 61 |
f'`SHA512SUMS.asc` signs the SHA512 manifest with release key `{args.fingerprint}`. '
|
| 62 |
'This checksum signature is separate from Git-tag and platform-code signing. '
|
| 63 |
'The annotated Git tag is unsigned. macOS applications retain ad-hoc signatures, '
|
|
|
|
| 69 |
snapshot = temporary / 'snapshot'
|
| 70 |
snapshot.mkdir()
|
| 71 |
names, patch, snapshot_notes = draft.snapshot_packet(args, snapshot)
|
| 72 |
+
# snapshot_packet validates every checksum, canonical COPYING and archive safety.
|
| 73 |
signature = snapshot / 'SHA512SUMS.asc'
|
| 74 |
shutil.copyfile(Path(args.original_assets) / signature.name, signature)
|
| 75 |
verify_signature(snapshot / 'SHA512SUMS', signature, args.public_key, args.fingerprint, temporary / 'verify-home')
|