Repository navigation
bind a release to the commit it was built from - #330
Merged
Merged
Conversation
build-release.ps1 built the binaries from the working tree but archived the local master ref, so the signed source zip need not match the signed binaries. * Refuse a dirty tree, archive HEAD, and ship a signed .manifest recording the commit and the artifact set. No origin/master check: that needs the network and forbids cutting a release from a tag or a release branch. * Both verifiers check the commit against the zip archive comment and the listed set against the files present. The hash and signature loops only see the files that are there, so an artifact deleted with its .sha512 and .asc passed before. * Everything the release writes gets LF, asserted in the tests. Set-Content writes CRLF on Windows, where a trailing CR breaks sha512sum on macOS and makes every manifest name compare unequal. Includes the .sha512 fix from #328; #328 gets rebased onto this. * sign-log4net-libraries.sh gains set -euo pipefail and shopt -s nullglob. An empty directory iterated the glob patterns and still exited 0. audit da18b6f-f025
FreeAndNil
force-pushed
the
Feature/330-release-from-one-commit
branch
from
September 27, 2026 20:14
7f7cd24 to
1ed2acb
Compare
FreeAndNil
added a commit
that referenced
this pull request
Sep 27, 2026
build-release.ps1 built the binaries from the working tree but archived the local master ref, so the signed source zip need not match the signed binaries. * Refuse a dirty tree, archive HEAD, and ship a signed .manifest recording the commit and the artifact set. No origin/master check: that needs the network and forbids cutting a release from a tag or a release branch. * Both verifiers check the commit against the zip archive comment and the listed set against the files present. The hash and signature loops only see the files that are there, so an artifact deleted with its .sha512 and .asc passed before. * Everything the release writes gets LF, asserted in the tests. Set-Content writes CRLF on Windows, where a trailing CR breaks sha512sum on macOS and makes every manifest name compare unequal. Includes the .sha512 fix from #328; #328 gets rebased onto this. * sign-log4net-libraries.sh gains set -euo pipefail and shopt -s nullglob. An empty directory iterated the glob patterns and still exited 0. audit da18b6f-f025
fluffynuts
approved these changes
Sep 28, 2026
This was referenced Oct 1, 2026
This was referenced Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
build-release.ps1 built the binaries from the working tree but archived the
local master ref, so the signed source zip need not match the signed binaries.
commit and the artifact set. No origin/master check: that needs the network
and forbids cutting a release from a tag or a release branch.
listed set against the files present. The hash and signature loops only see
the files that are there, so an artifact deleted with its .sha512 and .asc
passed before.
writes CRLF on Windows, where a trailing CR breaks sha512sum on macOS and
makes every manifest name compare unequal. Includes the .sha512 fix.
empty directory iterated the glob patterns and still exited 0.
audit da18b6f-f025