release: prepare ZUPT 5.2.8
This commit is contained in:
Cristian Cezar Moisés
parent
d8668e6d64
commit
7687cfa577
29 changed files with 456 additions and 200 deletions
|
|
@ -1,4 +1,4 @@
|
|||
# Distributing ZUPT 5.2.7
|
||||
# Distributing ZUPT 5.2.8
|
||||
|
||||
This document describes the packaging material maintained in the ZUPT
|
||||
source repository. A recipe in `packaging/` is not evidence that a package has
|
||||
|
|
@ -14,8 +14,8 @@ https://github.com/cristiancmoises/zupt
|
|||
GitHub is the canonical source and release host. Packaging must never fetch
|
||||
`zupt-web` or substitute an asset from another project.
|
||||
|
||||
The `v5.2.2`, `v5.2.3`, `v5.2.4`, `v5.2.5`, and `v5.2.6` tags are immutable
|
||||
non-promoted candidates.
|
||||
The `v5.2.2`, `v5.2.3`, `v5.2.4`, `v5.2.5`, `v5.2.6`, and `v5.2.7` tags are
|
||||
immutable non-promoted candidates.
|
||||
The v5.2.3 source-policy test assumed LF for a Windows `.bat` file that Git
|
||||
correctly checks out as CRLF. Exact-tag GitHub Actions run `33431386002` then
|
||||
recorded 12 successful v5.2.4 jobs, one openSUSE service-harness failure caused
|
||||
|
|
@ -27,11 +27,16 @@ Actions run `33434986357` completed 13 jobs successfully but failed the native
|
|||
Windows and macOS jobs. Its v5.2.6 corrections reached exact-tag run
|
||||
`33442264243`, where 13 jobs succeeded but macOS arm64 failed on unused x86
|
||||
SHA-NI test-helper declarations under `-Werror`, and Windows aborted during safe
|
||||
UTF-8 fixture argv transcoding. Corrective packages and release assets must use
|
||||
`v5.2.7`; never move or overwrite an earlier tag or checksum, and never
|
||||
transfer prior evidence automatically.
|
||||
This corrective version changes release/test integration only; the product,
|
||||
archive format, cryptography, codec, and SDK ABI remain unchanged.
|
||||
UTF-8 fixture argv transcoding. Version 5.2.7 corrected those failures, but
|
||||
exact-tag run `33445470664` ended with 13 successful jobs, a macOS raw-C1
|
||||
fixture failure with `EILSEQ`, and a cancelled Windows job after the hosted job
|
||||
stalled in `make check`; a MinGW/Wine reproduction isolated a non-console
|
||||
password-prompt hang in `_getch`.
|
||||
Corrective packages and release assets must use `v5.2.8`; never move or
|
||||
overwrite an earlier tag or checksum, and never transfer prior evidence
|
||||
automatically. Version 5.2.8 corrects those native test boundaries, hardens
|
||||
three path-race boundaries, and adds the SDK regression to release/hosted Linux
|
||||
gates. The archive format, cryptography, codec, and SDK ABI remain unchanged.
|
||||
|
||||
## Source-only boundary
|
||||
|
||||
|
|
@ -61,7 +66,7 @@ Audit the current tree or a generated archive with:
|
|||
|
||||
```sh
|
||||
scripts/check-source-only.sh
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.7.tar.gz
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.8.tar.gz
|
||||
```
|
||||
|
||||
The scanner reports paths, not file contents, and exits nonzero on a violation.
|
||||
|
|
@ -75,8 +80,8 @@ the commit omits Git's commit-ID PAX header:
|
|||
|
||||
```sh
|
||||
SOURCE_DATE_EPOCH="$(git show -s --format=%ct HEAD)" \
|
||||
make DIST_TARBALL=/tmp/zupt-5.2.7.tar.gz dist
|
||||
sha256sum /tmp/zupt-5.2.7.tar.gz
|
||||
make DIST_TARBALL=/tmp/zupt-5.2.8.tar.gz dist
|
||||
sha256sum /tmp/zupt-5.2.8.tar.gz
|
||||
```
|
||||
|
||||
With identical committed input and `SOURCE_DATE_EPOCH`, repeated exports must
|
||||
|
|
@ -122,12 +127,12 @@ private-library RPATH.
|
|||
| openSUSE / OBS | `packaging/opensuse/` | source and binary RPM through OBS |
|
||||
| Debian / Ubuntu | `packaging/debian/`, `packaging/build-deb.sh` | Debian metadata and binary DEB after the target gate |
|
||||
| RPM release artifact | `packaging/opensuse/zupt.spec`, `packaging/build-rpm.sh` | source and binary RPM after the target gate |
|
||||
| GUI DEB | `packaging/build-gui-deb.sh` | `zupt-gui_5.2.7_all.deb` after payload/dependency and installed integration gates |
|
||||
| GUI RPM | `packaging/build-gui-rpm.sh` | `zupt-gui-5.2.7-1.noarch.rpm` and matching `.src.rpm` after package and installed integration gates |
|
||||
| Linux CLI archive | `.github/workflows/ci.yml` | `zupt-5.2.7-linux-x86_64.tar.xz` with notices after dependency, member, and extracted functional gates |
|
||||
| Portable GUI source | `packaging/portable/`, `.github/workflows/ci.yml` | `zupt-gui-5.2.7-portable.zip` after source scan, member allowlist, and extracted off-screen integration gate |
|
||||
| GUI DEB | `packaging/build-gui-deb.sh` | `zupt-gui_5.2.8_all.deb` after payload/dependency and installed integration gates |
|
||||
| GUI RPM | `packaging/build-gui-rpm.sh` | `zupt-gui-5.2.8-1.noarch.rpm` and matching `.src.rpm` after package and installed integration gates |
|
||||
| Linux CLI archive | `.github/workflows/ci.yml` | `zupt-5.2.8-linux-x86_64.tar.xz` with notices after dependency, member, and extracted functional gates |
|
||||
| Portable GUI source | `packaging/portable/`, `.github/workflows/ci.yml` | `zupt-gui-5.2.8-portable.zip` after source scan, member allowlist, and extracted off-screen integration gate |
|
||||
| Fedora / RPM-based systems | `packaging/rpm/zupt.spec` | downstream RPM starting point |
|
||||
| AppImage helper | `packaging/build-appimage.sh` | downstream-only helper; no 5.2.7 AppImage is promoted |
|
||||
| AppImage helper | `packaging/build-appimage.sh` | downstream-only helper; no 5.2.8 AppImage is promoted |
|
||||
| Windows | `.github/workflows/cross-platform.yml` | native ZIP (executable plus notices) after the required native gate |
|
||||
| macOS | `packaging/build-dmg.sh` | native-architecture DMG after the native gate |
|
||||
| Arch Linux | `packaging/aur/PKGBUILD` | AUR package recipe |
|
||||
|
|
@ -203,17 +208,17 @@ expectations, then test the installed launcher off-screen against the matching
|
|||
### Portable and native release artifacts
|
||||
|
||||
The Linux x86_64 gate packages the tested `zupt` executable as
|
||||
`zupt-5.2.7-linux-x86_64.tar.xz` beside README, changelog, security guidance,
|
||||
`zupt-5.2.8-linux-x86_64.tar.xz` beside README, changelog, security guidance,
|
||||
and every applicable public license and notice. Its dynamic-library allowlist,
|
||||
archive member allowlist, and extracted CLI functional suite must pass.
|
||||
|
||||
The `zupt-gui-5.2.7-portable.zip` artifact is source-only: it contains the GUI
|
||||
The `zupt-gui-5.2.8-portable.zip` artifact is source-only: it contains the GUI
|
||||
Python source, shell/macOS/Windows launchers, icons, provenance, changelog, and
|
||||
licenses, but no Python, Qt, CLI, or compiled runtime. The gate scans both the
|
||||
assembled and extracted trees, verifies an exact safe member allowlist, and
|
||||
runs the extracted launcher off-screen against the tested CLI.
|
||||
|
||||
AppImage creation is deliberately offline and is not a 5.2.7 release gate.
|
||||
AppImage creation is deliberately offline and is not a 5.2.8 release gate.
|
||||
Supply a locally verified `appimagetool`, type-2 runtime, and the complete
|
||||
license/source-relink compliance notice for those exact runtime bytes; the
|
||||
helper never downloads any input:
|
||||
|
|
@ -229,7 +234,7 @@ APPIMAGE_RUNTIME_COMPLIANCE_FILE=/verified/path/runtime-compliance.txt \
|
|||
The runtime inspected while preparing 5.2.2 omitted a linked component from
|
||||
its notice and did not provide the complete LGPL source/relink handoff required
|
||||
by this release policy. No AppImage produced by this helper is promoted by the
|
||||
upstream 5.2.7 workflow. AppDir and Flatpak bundles and GUI platform installers
|
||||
upstream 5.2.8 workflow. AppDir and Flatpak bundles and GUI platform installers
|
||||
are also excluded. Bare Linux and Windows executables are not promoted; their
|
||||
CLI programs appear only inside notice-bearing archives. The Windows ZIP and
|
||||
macOS DMG remain CLI-only.
|
||||
|
|
@ -244,8 +249,8 @@ DIST_DIR="$release_dir" RUN_CHECKS=1 packaging/build-dmg.sh
|
|||
The Windows ZIP (including its executable and notices) must be built and tested
|
||||
by the Windows job in `.github/workflows/cross-platform.yml`; it is not a
|
||||
cross-compiled release claim from a Linux build. No Wine result is retained as
|
||||
5.2.7 release evidence. Extended-length/device namespace paths, raw UNC output
|
||||
roots, and mapped/network-drive output are not supported in 5.2.7. Publish the
|
||||
5.2.8 release evidence. Extended-length/device namespace paths, raw UNC output
|
||||
roots, and mapped/network-drive output are not supported in 5.2.8. Publish the
|
||||
exact architecture recorded by the native job.
|
||||
These helpers create binary distribution artifacts for the release page, not
|
||||
content to be committed to Git or included in the source archive.
|
||||
|
|
@ -253,7 +258,7 @@ content to be committed to Git or included in the source archive.
|
|||
### AUR, Homebrew, Guix, and Nix
|
||||
|
||||
After calculating the final reproducible source archive, but before creating or
|
||||
publishing the immutable tag, update each recipe to version 5.2.7 and to the
|
||||
publishing the immutable tag, update each recipe to version 5.2.8 and to the
|
||||
exact digest or content hash expected by its package manager. These recipe
|
||||
directories are excluded from the source archive, so this does not create a
|
||||
checksum cycle. Commit the pinned recipes in the tagged tree, then build and
|
||||
|
|
@ -272,7 +277,7 @@ build.
|
|||
|
||||
For every published artifact:
|
||||
|
||||
1. start from the immutable `v5.2.7` tag;
|
||||
1. start from the immutable `v5.2.8` tag;
|
||||
2. keep `WITH_SDK=0 WITH_PQBOX=0` unless system dependencies are declared;
|
||||
3. record the exact OS, distribution release, architecture, and toolchain;
|
||||
4. run format validation plus installed `--version`, `--help`, and archive
|
||||
|
|
@ -290,7 +295,7 @@ than redirecting consumers to an unverified file.
|
|||
|
||||
## Downstream checklist
|
||||
|
||||
- [ ] The source URL resolves to the immutable `v5.2.7` tag.
|
||||
- [ ] The source URL resolves to the immutable `v5.2.8` tag.
|
||||
- [ ] The source archive passes `scripts/check-source-only.sh --archive`.
|
||||
- [ ] The recipe checksum matches the downloaded source exactly.
|
||||
- [ ] `WITH_SDK=0 WITH_PQBOX=0` is explicit, or system dependencies are complete.
|
||||
|
|
|
|||
Loading…
Reference in a new issue