doc: use git-secure-tag for release tags#7603
Conversation
|
@indutny does this work with subkeys? |
|
@thealphanerd It supports |
|
It does not support |
|
Updated description, initial version was misleading. Sorry! |
|
I liked the idea before seeing the docs. Now that I see it is literally a drop in replacement with just a few extra keystrokes thrown in and still spits out a signed git tag in the end, I think I like it even more :-) |
There was a problem hiding this comment.
does -sm work (doesn't need to change here, just interested if my keystroke memory will still apply)
There was a problem hiding this comment.
Yeah, it actually works. I'll change it back.
|
need to make sure we don't have any objectors in @nodejs/release lgtm |
|
Emphatic LGTM on this. |
|
Should we make a test release with it to ensure everything behaves as expected? Also, does this work properly with the verification in |
|
Yes, tools/release.sh is just checking that the key is signed by you, not how it was signed or what it contains so it should be fine. Full releases are the only ones that we normally sign and manually promote, the rest just happen automatically. Perhaps this PR can hold off until the next release, whichever branch that is, to see how it goes. |
|
@thealphanerd is going to do a v4 RC release. Does anyone have an objection to using git-secure-tag for it? |
|
iirc we aren't tagging RC releases these days, only proper releases with a manual promotion, I have no objections to using this in the next v4 though as long as it's understood that if something comes up that causes this to hold up the release (whatever that might be!) then it can be dropped |
|
Cool, thank you for the heads up! |
|
@rvagg should we land this PR? |
|
@indutny I think we were waiting to do a release with the tool first. looks like this PR needs a rebase |
|
@thealphanerd we just did a release without a tool, and it is not clear how release team will learn about tool if we won't land this first :) |
`git-secure-tag` recursively constructs an SHA-512 digest out of the git tree, and puts the hash from the tree's root into the tag annotation. This hash provides better integrity guarantees than the default SHA-1 merkle tree that git uses. Fix: nodejs#7579
|
that's fair. I was under the impression we were waiting for the LTS on this. @nodejs/release are we planning a v6 release for next week? Can we do make the tag with this tool? |
|
Rebased. |
|
where did we land on this? :-) |
|
We didn't, but I think we should. |
|
|
||
| Install `git-secure-tag` npm module: | ||
|
|
||
| ```sh |
|
We have two LGTMs here, and general consensus. Going to land it in a bit if no objections will be mentioned. |
|
SGTM! |
|
LGTM |
|
Landed in 0f3f76c, thank you everyone! cc @nodejs/release |
`git-secure-tag` recursively constructs an SHA-512 digest out of the git tree, and puts the hash from the tree's root into the tag annotation. This hash provides better integrity guarantees than the default SHA-1 merkle tree that git uses. Fix: #7579 PR-URL: #7603 Reviewed-By: Rod Vagg <rod@vagg.org> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Evan Lucas <evanlucas@me.com>
|
Post-land-LGTM -- I think this is a great addition. |
|
|
||
| Install `git-secure-tag` npm module: | ||
|
|
||
| ```console |
There was a problem hiding this comment.
use sh to keep consistent with others?
There was a problem hiding this comment.
This is made in anticipation of other PR that will change the rest to console.
|
Whoops, looks like we forgot to close this when it landed. |
`git-secure-tag` recursively constructs an SHA-512 digest out of the git tree, and puts the hash from the tree's root into the tag annotation. This hash provides better integrity guarantees than the default SHA-1 merkle tree that git uses. Fix: #7579 PR-URL: #7603 Reviewed-By: Rod Vagg <rod@vagg.org> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Evan Lucas <evanlucas@me.com>
`git-secure-tag` recursively constructs an SHA-512 digest out of the git tree, and puts the hash from the tree's root into the tag annotation. This hash provides better integrity guarantees than the default SHA-1 merkle tree that git uses. Fix: #7579 PR-URL: #7603 Reviewed-By: Rod Vagg <rod@vagg.org> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Evan Lucas <evanlucas@me.com>
`git-secure-tag` recursively constructs an SHA-512 digest out of the git tree, and puts the hash from the tree's root into the tag annotation. This hash provides better integrity guarantees than the default SHA-1 merkle tree that git uses. Fix: #7579 PR-URL: #7603 Reviewed-By: Rod Vagg <rod@vagg.org> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Evan Lucas <evanlucas@me.com>
`git-secure-tag` recursively constructs an SHA-512 digest out of the git tree, and puts the hash from the tree's root into the tag annotation. This hash provides better integrity guarantees than the default SHA-1 merkle tree that git uses. Fix: #7579 PR-URL: #7603 Reviewed-By: Rod Vagg <rod@vagg.org> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Evan Lucas <evanlucas@me.com>
`git-secure-tag` recursively constructs an SHA-512 digest out of the git tree, and puts the hash from the tree's root into the tag annotation. This hash provides better integrity guarantees than the default SHA-1 merkle tree that git uses. Fix: #7579 PR-URL: #7603 Reviewed-By: Rod Vagg <rod@vagg.org> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Evan Lucas <evanlucas@me.com>
Checklist
make -j4 test(UNIX), orvcbuild test nosign(Windows) passesAffected core subsystem(s)
doc
Description of change
git-secure-tagrecursively constructs an SHA-512 digest out of thegit tree, and puts the hash from the tree's root into the tag
annotation. This hash provides better integrity guarantees than the
default SHA-1 merkle tree that git uses.
Fix: #7579