release-making procedure and/or script #260

New issue

Closed

opened 2024-05-02 23:58:47 +00:00 by jade · 1 comment

jade commented

2024-05-02 23:58:47 +00:00

Owner

This also represents writing a release process document.

(step 0: set "is official release", branch off, sign a tag, push signed tag?)

A release-making script should probably do the following:

Fetch a tarball from forgejo and tree-hash it
Run git archive locally and compare the tree-hash (nar?) and ensure it is the same
Sign the tarball from forgejo.

Then we get two signatures from different team members(?) and create a forgejo release.

This tarball should be possible to verify with the same script to be identical to one generated by git archive locally.

This also represents writing a release process document. (step 0: set "is official release", branch off, sign a tag, push signed tag?) A release-making script should probably do the following: 1. Fetch a tarball from forgejo and tree-hash it 2. Run `git archive` locally and compare the tree-hash (nar?) and ensure it is the same 3. Sign the tarball from forgejo. Then we get two signatures from different team members(?) and create a forgejo release. This tarball should be possible to verify with the same script to be identical to one generated by `git archive` locally.