FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

doc: use `git-secure-tag` for release tags by indutny · Pull Request #7603 · nodejs/node · GitHub

/ node Public

doc: use git-secure-tag for release tags - #7603

Closed
indutny wants to merge 3 commits into
nodejs:masterfrom
indutny:fix/gh-7579
ConversationCommits (3)ChecksFiles changed
Closed

doc: use git-secure-tag for release tags#7603
indutny wants to merge 3 commits into
nodejs:masterfrom
indutny:fix/gh-7579

Conversation

indutny commented Jul 8, 2016 •
edited
Loading

Copy link
Copy Markdown
Member
Checklist
  • make -j4 test (UNIX), or vcbuild test nosign (Windows) passes
  • tests and/or benchmarks are included
  • documentation is changed or added
  • commit message follows commit guidelines
Affected core subsystem(s)

doc

Description of change

git-secure-tag recursively constructs an SHA-512 digest out of the
git tree, and puts the hash from the tree's root into the tag
annotation. This hash provides better integrity guarantees than the
default SHA-1 merkle tree that git uses.

Fix: #7579

nodejs-github-bot added the doc Issues and PRs related to the documentations. label Jul 8, 2016

indutny commented Jul 8, 2016

Copy link
Copy Markdown
Member Author

cc @rvagg @Fishrock123 @rmg

indutny mentioned this pull request Jul 8, 2016
Closed

MylesBorins commented Jul 8, 2016

Copy link
Copy Markdown
Contributor

@indutny does this work with subkeys?

indutny commented Jul 8, 2016

Copy link
Copy Markdown
Member Author

@thealphanerd It supports -s and -u options, just as git tag.

indutny commented Jul 8, 2016

Copy link
Copy Markdown
Member Author

It does not support -d, -F, and -a, though.

indutny commented Jul 8, 2016

Copy link
Copy Markdown
Member Author

Updated description, initial version was misleading. Sorry!

rmg commented Jul 8, 2016

Copy link
Copy Markdown
Contributor

I liked the idea before seeing the docs. Now that I see it is literally a drop in replacement with just a few extra keystrokes thrown in and still spits out a signed git tag in the end, I think I like it even more :-)

rvagg reviewed Jul 8, 2016
View reviewed changes
Comment thread doc/releases.md Outdated

rvagg Jul 8, 2016

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

does -sm work (doesn't need to change here, just interested if my keystroke memory will still apply)

indutny Jul 8, 2016

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Yeah, it actually works. I'll change it back.

indutny Jul 8, 2016

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Pushed.

rvagg commented Jul 8, 2016

Copy link
Copy Markdown
Member

need to make sure we don't have any objectors in @nodejs/release

lgtm

jasnell commented Jul 8, 2016

Copy link
Copy Markdown
Member

Emphatic LGTM on this.

Fishrock123 commented Jul 8, 2016

Copy link
Copy Markdown
Contributor

Should we make a test release with it to ensure everything behaves as expected?

Also, does this work properly with the verification in tools/release.sh?

rvagg commented Jul 8, 2016

Copy link
Copy Markdown
Member

Yes, tools/release.sh is just checking that the key is signed by you, not how it was signed or what it contains so it should be fine. Full releases are the only ones that we normally sign and manually promote, the rest just happen automatically. Perhaps this PR can hold off until the next release, whichever branch that is, to see how it goes.

This was referenced Jul 10, 2016
Closed
Closed

indutny commented Jul 11, 2016

Copy link
Copy Markdown
Member Author

@thealphanerd is going to do a v4 RC release. Does anyone have an objection to using git-secure-tag for it?

MylesBorins self-assigned this Jul 11, 2016

rvagg commented Jul 12, 2016

Copy link
Copy Markdown
Member

iirc we aren't tagging RC releases these days, only proper releases with a manual promotion, I have no objections to using this in the next v4 though as long as it's understood that if something comes up that causes this to hold up the release (whatever that might be!) then it can be dropped

indutny commented Jul 12, 2016

Copy link
Copy Markdown
Member Author

Cool, thank you for the heads up!

indutny commented Jul 23, 2016

Copy link
Copy Markdown
Member Author

@rvagg should we land this PR?

MylesBorins commented Jul 23, 2016

Copy link
Copy Markdown
Contributor

@indutny I think we were waiting to do a release with the tool first.

looks like this PR needs a rebase

indutny commented Jul 23, 2016

Copy link
Copy Markdown
Member Author

@thealphanerd we just did a release without a tool, and it is not clear how release team will learn about tool if we won't land this first :)

doc: use git-secure-tag for release tags
3b37d4b 
`git-secure-tag` recursively constructs an SHA-512 digest out of the
git tree, and puts the hash from the tree's root into the tag
annotation. This hash provides better integrity guarantees than the
default SHA-1 merkle tree that git uses.

Fix: nodejs#7579

MylesBorins commented Jul 23, 2016

Copy link
Copy Markdown
Contributor

that's fair. I was under the impression we were waiting for the LTS on this. @nodejs/release are we planning a v6 release for next week? Can we do make the tag with this tool?

indutny commented Jul 23, 2016

Copy link
Copy Markdown
Member Author

Rebased.

ChALkeR added the security Issues and PRs related to security. label Jul 23, 2016

jasnell commented Aug 4, 2016

Copy link
Copy Markdown
Member

where did we land on this? :-)

indutny commented Aug 5, 2016

Copy link
Copy Markdown
Member Author

We didn't, but I think we should.

ChALkeR reviewed Aug 5, 2016
View reviewed changes
Comment thread doc/releases.md Outdated

Install `git-secure-tag` npm module:

```sh

ChALkeR Aug 5, 2016 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

console, ref: #7971, #7727.

indutny Aug 5, 2016

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Ack, thank you!

indutny commented Aug 5, 2016

Copy link
Copy Markdown
Member Author

We have two LGTMs here, and general consensus. Going to land it in a bit if no objections will be mentioned.

jasnell commented Aug 5, 2016

Copy link
Copy Markdown
Member

SGTM!

evanlucas commented Aug 5, 2016

Copy link
Copy Markdown
Contributor

LGTM

indutny commented Aug 5, 2016

Copy link
Copy Markdown
Member Author

Landed in 0f3f76c, thank you everyone! cc @nodejs/release

indutny added a commit that referenced this pull request Aug 5, 2016
doc: use git-secure-tag for release tags
0f3f76c 
`git-secure-tag` recursively constructs an SHA-512 digest out of the
git tree, and puts the hash from the tree's root into the tag
annotation. This hash provides better integrity guarantees than the
default SHA-1 merkle tree that git uses.

Fix: #7579
PR-URL: #7603
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>

jbergstroem commented Aug 5, 2016

Copy link
Copy Markdown
Member

Post-land-LGTM -- I think this is a great addition.

yorkie reviewed Aug 5, 2016
View reviewed changes
Comment thread doc/releases.md

Install `git-secure-tag` npm module:

```console

yorkie Aug 5, 2016

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

use sh to keep consistent with others?

indutny Aug 5, 2016

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

This is made in anticipation of other PR that will change the rest to console.

jasnell commented Aug 8, 2016

Copy link
Copy Markdown
Member

Whoops, looks like we forgot to close this when it landed.

jasnell closed this Aug 8, 2016
cjihrig mentioned this pull request Aug 8, 2016
Closed
cjihrig pushed a commit that referenced this pull request Aug 10, 2016
doc: use git-secure-tag for release tags
3d1a064 
`git-secure-tag` recursively constructs an SHA-512 digest out of the
git tree, and puts the hash from the tree's root into the tag
annotation. This hash provides better integrity guarantees than the
default SHA-1 merkle tree that git uses.

Fix: #7579
PR-URL: #7603
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
cjihrig mentioned this pull request Aug 11, 2016
Merged
MylesBorins pushed a commit that referenced this pull request Sep 9, 2016
doc: use git-secure-tag for release tags
bf33d2f 
`git-secure-tag` recursively constructs an SHA-512 digest out of the
git tree, and puts the hash from the tree's root into the tag
annotation. This hash provides better integrity guarantees than the
default SHA-1 merkle tree that git uses.

Fix: #7579
PR-URL: #7603
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
MylesBorins pushed a commit that referenced this pull request Sep 28, 2016
doc: use git-secure-tag for release tags
23989b0 
`git-secure-tag` recursively constructs an SHA-512 digest out of the
git tree, and puts the hash from the tree's root into the tag
annotation. This hash provides better integrity guarantees than the
default SHA-1 merkle tree that git uses.

Fix: #7579
PR-URL: #7603
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
rvagg pushed a commit that referenced this pull request Oct 18, 2016
doc: use git-secure-tag for release tags
652e7d6 
`git-secure-tag` recursively constructs an SHA-512 digest out of the
git tree, and puts the hash from the tree's root into the tag
annotation. This hash provides better integrity guarantees than the
default SHA-1 merkle tree that git uses.

Fix: #7579
PR-URL: #7603
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
MylesBorins pushed a commit that referenced this pull request Oct 26, 2016
doc: use git-secure-tag for release tags
009df78 
`git-secure-tag` recursively constructs an SHA-512 digest out of the
git tree, and puts the hash from the tree's root into the tag
annotation. This hash provides better integrity guarantees than the
default SHA-1 merkle tree that git uses.

Fix: #7579
PR-URL: #7603
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
MylesBorins mentioned this pull request Oct 26, 2016
Closed
MylesBorins removed their assignment Dec 27, 2016
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

doc Issues and PRs related to the documentations. security Issues and PRs related to security.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Use EVTag for release tags
Back | FazBrowse Home | New Git URL