release: correct OBS harness for ZUPT 5.2.5
This commit is contained in:
Cristian Cezar Moisés
parent
c27e3d5528
commit
fcce1b5a4a
29 changed files with 301 additions and 153 deletions
|
|
@ -1,4 +1,4 @@
|
|||
# Distributing ZUPT 5.2.4
|
||||
# Distributing ZUPT 5.2.5
|
||||
|
||||
This document describes the packaging material maintained in the ZUPT
|
||||
source repository. A recipe in `packaging/` is not evidence that a package has
|
||||
|
|
@ -14,10 +14,17 @@ https://github.com/cristiancmoises/zupt
|
|||
GitHub is the canonical source and release host. Packaging must never fetch
|
||||
`zupt-web` or substitute an asset from another project.
|
||||
|
||||
The `v5.2.2` and `v5.2.3` tags are immutable non-promoted candidates. The latter
|
||||
was not promoted because its source-policy test assumed LF for a Windows `.bat`
|
||||
file that Git correctly checks out as CRLF. Corrective packages and release
|
||||
assets must use `v5.2.4`; never move or overwrite an earlier tag or checksum.
|
||||
The `v5.2.2`, `v5.2.3`, and `v5.2.4` tags are immutable non-promoted candidates.
|
||||
The v5.2.3 source-policy test assumed LF for a Windows `.bat` file that Git
|
||||
correctly checks out as CRLF. Exact-tag GitHub Actions run `33431386002` then
|
||||
recorded 12 successful v5.2.4 jobs, one openSUSE service-harness failure caused
|
||||
by its working directory, and skipped dependent Windows/macOS jobs. A local
|
||||
Tumbleweed reproduction confirmed that `refs/tags/v5.2.4` is valid and that
|
||||
entering the service directory completes the source-service chain. Corrective
|
||||
packages and release assets must use `v5.2.5`; never move or overwrite an
|
||||
earlier tag or checksum, and never transfer prior evidence automatically.
|
||||
This corrective version changes release/test integration only; the product,
|
||||
archive format, cryptography, codec, and SDK ABI remain unchanged.
|
||||
|
||||
## Source-only boundary
|
||||
|
||||
|
|
@ -47,7 +54,7 @@ Audit the current tree or a generated archive with:
|
|||
|
||||
```sh
|
||||
scripts/check-source-only.sh
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.4.tar.gz
|
||||
scripts/check-source-only.sh --archive /path/to/zupt-5.2.5.tar.gz
|
||||
```
|
||||
|
||||
The scanner reports paths, not file contents, and exits nonzero on a violation.
|
||||
|
|
@ -61,8 +68,8 @@ the commit omits Git's commit-ID PAX header:
|
|||
|
||||
```sh
|
||||
SOURCE_DATE_EPOCH="$(git show -s --format=%ct HEAD)" \
|
||||
make DIST_TARBALL=/tmp/zupt-5.2.4.tar.gz dist
|
||||
sha256sum /tmp/zupt-5.2.4.tar.gz
|
||||
make DIST_TARBALL=/tmp/zupt-5.2.5.tar.gz dist
|
||||
sha256sum /tmp/zupt-5.2.5.tar.gz
|
||||
```
|
||||
|
||||
With identical committed input and `SOURCE_DATE_EPOCH`, repeated exports must
|
||||
|
|
@ -108,12 +115,12 @@ private-library RPATH.
|
|||
| openSUSE / OBS | `packaging/opensuse/` | source and binary RPM through OBS |
|
||||
| Debian / Ubuntu | `packaging/debian/`, `packaging/build-deb.sh` | Debian metadata and binary DEB after the target gate |
|
||||
| RPM release artifact | `packaging/opensuse/zupt.spec`, `packaging/build-rpm.sh` | source and binary RPM after the target gate |
|
||||
| GUI DEB | `packaging/build-gui-deb.sh` | `zupt-gui_5.2.4_all.deb` after payload/dependency and installed integration gates |
|
||||
| GUI RPM | `packaging/build-gui-rpm.sh` | `zupt-gui-5.2.4-1.noarch.rpm` and matching `.src.rpm` after package and installed integration gates |
|
||||
| Linux CLI archive | `.github/workflows/ci.yml` | `zupt-5.2.4-linux-x86_64.tar.xz` with notices after dependency, member, and extracted functional gates |
|
||||
| Portable GUI source | `packaging/portable/`, `.github/workflows/ci.yml` | `zupt-gui-5.2.4-portable.zip` after source scan, member allowlist, and extracted off-screen integration gate |
|
||||
| GUI DEB | `packaging/build-gui-deb.sh` | `zupt-gui_5.2.5_all.deb` after payload/dependency and installed integration gates |
|
||||
| GUI RPM | `packaging/build-gui-rpm.sh` | `zupt-gui-5.2.5-1.noarch.rpm` and matching `.src.rpm` after package and installed integration gates |
|
||||
| Linux CLI archive | `.github/workflows/ci.yml` | `zupt-5.2.5-linux-x86_64.tar.xz` with notices after dependency, member, and extracted functional gates |
|
||||
| Portable GUI source | `packaging/portable/`, `.github/workflows/ci.yml` | `zupt-gui-5.2.5-portable.zip` after source scan, member allowlist, and extracted off-screen integration gate |
|
||||
| Fedora / RPM-based systems | `packaging/rpm/zupt.spec` | downstream RPM starting point |
|
||||
| AppImage helper | `packaging/build-appimage.sh` | downstream-only helper; no 5.2.4 AppImage is promoted |
|
||||
| AppImage helper | `packaging/build-appimage.sh` | downstream-only helper; no 5.2.5 AppImage is promoted |
|
||||
| Windows | `.github/workflows/cross-platform.yml` | native ZIP (executable plus notices) after the required native gate |
|
||||
| macOS | `packaging/build-dmg.sh` | native-architecture DMG after the native gate |
|
||||
| Arch Linux | `packaging/aur/PKGBUILD` | AUR package recipe |
|
||||
|
|
@ -189,17 +196,17 @@ expectations, then test the installed launcher off-screen against the matching
|
|||
### Portable and native release artifacts
|
||||
|
||||
The Linux x86_64 gate packages the tested `zupt` executable as
|
||||
`zupt-5.2.4-linux-x86_64.tar.xz` beside README, changelog, security guidance,
|
||||
`zupt-5.2.5-linux-x86_64.tar.xz` beside README, changelog, security guidance,
|
||||
and every applicable public license and notice. Its dynamic-library allowlist,
|
||||
archive member allowlist, and extracted CLI functional suite must pass.
|
||||
|
||||
The `zupt-gui-5.2.4-portable.zip` artifact is source-only: it contains the GUI
|
||||
The `zupt-gui-5.2.5-portable.zip` artifact is source-only: it contains the GUI
|
||||
Python source, shell/macOS/Windows launchers, icons, provenance, changelog, and
|
||||
licenses, but no Python, Qt, CLI, or compiled runtime. The gate scans both the
|
||||
assembled and extracted trees, verifies an exact safe member allowlist, and
|
||||
runs the extracted launcher off-screen against the tested CLI.
|
||||
|
||||
AppImage creation is deliberately offline and is not a 5.2.4 release gate.
|
||||
AppImage creation is deliberately offline and is not a 5.2.5 release gate.
|
||||
Supply a locally verified `appimagetool`, type-2 runtime, and the complete
|
||||
license/source-relink compliance notice for those exact runtime bytes; the
|
||||
helper never downloads any input:
|
||||
|
|
@ -215,7 +222,7 @@ APPIMAGE_RUNTIME_COMPLIANCE_FILE=/verified/path/runtime-compliance.txt \
|
|||
The runtime inspected while preparing 5.2.2 omitted a linked component from
|
||||
its notice and did not provide the complete LGPL source/relink handoff required
|
||||
by this release policy. No AppImage produced by this helper is promoted by the
|
||||
upstream 5.2.4 workflow. AppDir and Flatpak bundles and GUI platform installers
|
||||
upstream 5.2.5 workflow. AppDir and Flatpak bundles and GUI platform installers
|
||||
are also excluded. Bare Linux and Windows executables are not promoted; their
|
||||
CLI programs appear only inside notice-bearing archives. The Windows ZIP and
|
||||
macOS DMG remain CLI-only.
|
||||
|
|
@ -230,8 +237,8 @@ DIST_DIR="$release_dir" RUN_CHECKS=1 packaging/build-dmg.sh
|
|||
The Windows ZIP (including its executable and notices) must be built and tested
|
||||
by the Windows job in `.github/workflows/cross-platform.yml`; it is not a
|
||||
cross-compiled release claim from a Linux build. No Wine result is retained as
|
||||
5.2.4 release evidence. Extended-length/device namespace paths, raw UNC output
|
||||
roots, and mapped/network-drive output are not supported in 5.2.4. Publish the
|
||||
5.2.5 release evidence. Extended-length/device namespace paths, raw UNC output
|
||||
roots, and mapped/network-drive output are not supported in 5.2.5. Publish the
|
||||
exact architecture recorded by the native job.
|
||||
These helpers create binary distribution artifacts for the release page, not
|
||||
content to be committed to Git or included in the source archive.
|
||||
|
|
@ -239,7 +246,7 @@ content to be committed to Git or included in the source archive.
|
|||
### AUR, Homebrew, Guix, and Nix
|
||||
|
||||
After calculating the final reproducible source archive, but before creating or
|
||||
publishing the immutable tag, update each recipe to version 5.2.4 and to the
|
||||
publishing the immutable tag, update each recipe to version 5.2.5 and to the
|
||||
exact digest or content hash expected by its package manager. These recipe
|
||||
directories are excluded from the source archive, so this does not create a
|
||||
checksum cycle. Commit the pinned recipes in the tagged tree, then build and
|
||||
|
|
@ -258,7 +265,7 @@ build.
|
|||
|
||||
For every published artifact:
|
||||
|
||||
1. start from the immutable `v5.2.4` tag;
|
||||
1. start from the immutable `v5.2.5` tag;
|
||||
2. keep `WITH_SDK=0 WITH_PQBOX=0` unless system dependencies are declared;
|
||||
3. record the exact OS, distribution release, architecture, and toolchain;
|
||||
4. run format validation plus installed `--version`, `--help`, and archive
|
||||
|
|
@ -276,7 +283,7 @@ than redirecting consumers to an unverified file.
|
|||
|
||||
## Downstream checklist
|
||||
|
||||
- [ ] The source URL resolves to the immutable `v5.2.4` tag.
|
||||
- [ ] The source URL resolves to the immutable `v5.2.5` tag.
|
||||
- [ ] The source archive passes `scripts/check-source-only.sh --archive`.
|
||||
- [ ] The recipe checksum matches the downloaded source exactly.
|
||||
- [ ] `WITH_SDK=0 WITH_PQBOX=0` is explicit, or system dependencies are complete.
|
||||
|
|
|
|||
Loading…
Reference in a new issue