Commit 009df78
doc: use git-secure-tag for release tags
`git-secure-tag` recursively constructs an SHA-512 digest out of the
git tree, and puts the hash from the tree's root into the tag
annotation. This hash provides better integrity guarantees than the
default SHA-1 merkle tree that git uses.
Fix: #7579
PR-URL: #7603
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>1 parent b680eb9 commit 009df78
1 file changed
Lines changed: 8 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -189,10 +189,16 @@ Once you have produced builds that you're happy with, create a new tag. By waiti | |||
| 189 | 189 | ||
| 190 | 190 | Tag summaries have a predictable format, look at a recent tag to see, `git tag -v v6.0.0`. The message should look something like `2016-04-26 Node.js v6.0.0 (Current) Release`. | |
| 191 | 191 | ||
| 192 | - Create a tag using the following command: | ||
| 192 | + Install `git-secure-tag` npm module: | ||
| 193 | 193 | ||
| 194 | + ```console | ||
| 195 | + $ npm install -g git-secure-tag | ||
| 194 | 196 | ``` | |
| 195 | - $ git tag <vx.y.z> <commit-sha> -sm 'YYYY-MM-DD Node.js vx.y.z (Release Type) Release' | ||
| 197 | + | ||
| 198 | + Create a tag using the following command: | ||
| 199 | + | ||
| 200 | + ```sh | ||
| 201 | + $ git secure-tag <vx.y.z> <commit-sha> -sm 'YYYY-MM-DD Node.js vx.y.z (Release Type) Release' | ||
| 196 | 202 | ``` | |
| 197 | 203 | ||
| 198 | 204 | The tag **must** be signed using the GPG key that's listed for you on the project README. | |
0 commit comments