doc: use `git-secure-tag` for release tags by indutny · Pull Request #7603 · nodejs/node

indutny · 2016-07-08T02:27:17Z

Checklist

make -j4 test (UNIX), or vcbuild test nosign (Windows) passes
tests and/or benchmarks are included
documentation is changed or added
commit message follows commit guidelines

Affected core subsystem(s)

doc

Description of change

git-secure-tag recursively constructs an SHA-512 digest out of the
git tree, and puts the hash from the tree's root into the tag
annotation. This hash provides better integrity guarantees than the
default SHA-1 merkle tree that git uses.

Fix: #7579

indutny · 2016-07-08T02:27:37Z

cc @rvagg @Fishrock123 @rmg

MylesBorins · 2016-07-08T02:44:43Z

@indutny does this work with subkeys?

indutny · 2016-07-08T02:47:56Z

@thealphanerd It supports -s and -u options, just as git tag.

indutny · 2016-07-08T02:48:46Z

It does not support -d, -F, and -a, though.

indutny · 2016-07-08T03:30:12Z

Updated description, initial version was misleading. Sorry!

rmg · 2016-07-08T04:56:39Z

I liked the idea before seeing the docs. Now that I see it is literally a drop in replacement with just a few extra keystrokes thrown in and still spits out a signed git tag in the end, I think I like it even more :-)

rvagg · 2016-07-08T05:21:51Z

does -sm work (doesn't need to change here, just interested if my keystroke memory will still apply)

Yeah, it actually works. I'll change it back.

rvagg · 2016-07-08T05:22:22Z

need to make sure we don't have any objectors in @nodejs/release

lgtm

jasnell · 2016-07-08T05:50:51Z

Emphatic LGTM on this.

Fishrock123 · 2016-07-08T08:55:17Z

Should we make a test release with it to ensure everything behaves as expected?

Also, does this work properly with the verification in tools/release.sh?

rvagg · 2016-07-08T10:30:59Z

Yes, tools/release.sh is just checking that the key is signed by you, not how it was signed or what it contains so it should be fine. Full releases are the only ones that we normally sign and manually promote, the rest just happen automatically. Perhaps this PR can hold off until the next release, whichever branch that is, to see how it goes.

indutny · 2016-07-11T23:24:21Z

@thealphanerd is going to do a v4 RC release. Does anyone have an objection to using git-secure-tag for it?

rvagg · 2016-07-12T04:44:38Z

iirc we aren't tagging RC releases these days, only proper releases with a manual promotion, I have no objections to using this in the next v4 though as long as it's understood that if something comes up that causes this to hold up the release (whatever that might be!) then it can be dropped

indutny · 2016-07-12T05:46:00Z

Cool, thank you for the heads up!

indutny · 2016-07-23T01:35:35Z

@rvagg should we land this PR?

MylesBorins · 2016-07-23T01:36:32Z

@indutny I think we were waiting to do a release with the tool first.

looks like this PR needs a rebase

indutny · 2016-07-23T01:39:23Z

@thealphanerd we just did a release without a tool, and it is not clear how release team will learn about tool if we won't land this first :)

`git-secure-tag` recursively constructs an SHA-512 digest out of the git tree, and puts the hash from the tree's root into the tag annotation. This hash provides better integrity guarantees than the default SHA-1 merkle tree that git uses. Fix: nodejs#7579

MylesBorins · 2016-07-23T01:40:29Z

that's fair. I was under the impression we were waiting for the LTS on this. @nodejs/release are we planning a v6 release for next week? Can we do make the tag with this tool?

indutny · 2016-07-23T01:41:11Z

Rebased.

jasnell · 2016-08-04T20:47:37Z

where did we land on this? :-)

indutny · 2016-08-05T03:10:41Z

We didn't, but I think we should.

ChALkeR · 2016-08-05T03:28:15Z


+Install `git-secure-tag` npm module:
+
+```sh


console, ref: #7971, #7727.

Ack, thank you!

indutny · 2016-08-05T04:57:59Z

We have two LGTMs here, and general consensus. Going to land it in a bit if no objections will be mentioned.

jasnell · 2016-08-05T05:09:09Z

SGTM!

evanlucas · 2016-08-05T05:16:12Z

LGTM

indutny · 2016-08-05T13:11:40Z

Landed in 0f3f76c, thank you everyone! cc @nodejs/release

`git-secure-tag` recursively constructs an SHA-512 digest out of the git tree, and puts the hash from the tree's root into the tag annotation. This hash provides better integrity guarantees than the default SHA-1 merkle tree that git uses. Fix: #7579 PR-URL: #7603 Reviewed-By: Rod Vagg <rod@vagg.org> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Evan Lucas <evanlucas@me.com>

jbergstroem · 2016-08-05T14:42:52Z

Post-land-LGTM -- I think this is a great addition.

yorkie · 2016-08-05T16:23:04Z


+Install `git-secure-tag` npm module:
+
+```console


use sh to keep consistent with others?

This is made in anticipation of other PR that will change the rest to console.

jasnell · 2016-08-08T18:55:21Z

Whoops, looks like we forgot to close this when it landed.

`git-secure-tag` recursively constructs an SHA-512 digest out of the git tree, and puts the hash from the tree's root into the tag annotation. This hash provides better integrity guarantees than the default SHA-1 merkle tree that git uses. Fix: #7579 PR-URL: #7603 Reviewed-By: Rod Vagg <rod@vagg.org> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Evan Lucas <evanlucas@me.com>

nodejs-github-bot added the doc Issues and PRs related to the documentations. label Jul 8, 2016

indutny mentioned this pull request Jul 8, 2016
Use EVTag for release tags #7579
Closed

indutny force-pushed the fix/gh-7579 branch from 5bf9166 to 3f2fd0aCompare July 8, 2016 03:29

rvagg reviewed Jul 8, 2016
View reviewed changes

This was referenced Jul 10, 2016
Use git-secure-tag for releases libuv/libuv#945
Closed
Use git-secure-tag for releases nodejs/http-parser#328
Closed

MylesBorins self-assigned this Jul 11, 2016

indutny force-pushed the fix/gh-7579 branch from 08052c7 to 3b37d4bCompare July 23, 2016 01:41

ChALkeR added the security Issues and PRs related to security. label Jul 23, 2016

...
db4a23f

ChALkeR reviewed Aug 5, 2016
View reviewed changes

...
26db5e7

yorkie reviewed Aug 5, 2016
View reviewed changes

jasnell closed this Aug 8, 2016

cjihrig mentioned this pull request Aug 8, 2016
v6.4.0 Release Proposal #8020
Closed

cjihrig mentioned this pull request Aug 11, 2016
v6.4.0 Proposal #8070
Merged

MylesBorins added the land-on-v4.x label Sep 9, 2016

MylesBorins mentioned this pull request Oct 26, 2016
V4.6.2 proposal #9298
Closed

MylesBorins removed their assignment Dec 27, 2016

Uh oh!

Uh oh!

Conversation

indutny commented Jul 8, 2016• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Affected core subsystem(s)

Description of change

Uh oh!

indutny commented Jul 8, 2016

Uh oh!

MylesBorins commented Jul 8, 2016

Uh oh!

indutny commented Jul 8, 2016

Uh oh!

indutny commented Jul 8, 2016

Uh oh!

indutny commented Jul 8, 2016

Uh oh!

rmg commented Jul 8, 2016

Uh oh!

rvaggJul 8, 2016

Choose a reason for hiding this comment

Uh oh!

indutnyJul 8, 2016

Choose a reason for hiding this comment

Uh oh!

indutnyJul 8, 2016

Choose a reason for hiding this comment

Uh oh!

rvagg commented Jul 8, 2016

Uh oh!

jasnell commented Jul 8, 2016

Uh oh!

Fishrock123 commented Jul 8, 2016

Uh oh!

rvagg commented Jul 8, 2016

Uh oh!

indutny commented Jul 11, 2016

Uh oh!

rvagg commented Jul 12, 2016

Uh oh!

indutny commented Jul 12, 2016

Uh oh!

indutny commented Jul 23, 2016

Uh oh!

MylesBorins commented Jul 23, 2016

Uh oh!

indutny commented Jul 23, 2016

Uh oh!

MylesBorins commented Jul 23, 2016

Uh oh!

indutny commented Jul 23, 2016

Uh oh!

jasnell commented Aug 4, 2016

Uh oh!

indutny commented Aug 5, 2016

Uh oh!

ChALkeRAug 5, 2016• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

indutnyAug 5, 2016

Choose a reason for hiding this comment

Uh oh!

indutny commented Aug 5, 2016

Uh oh!

jasnell commented Aug 5, 2016

Uh oh!

evanlucas commented Aug 5, 2016

Uh oh!

indutny commented Aug 5, 2016

Uh oh!

jbergstroem commented Aug 5, 2016

Uh oh!

yorkieAug 5, 2016

Choose a reason for hiding this comment

Uh oh!

indutnyAug 5, 2016

Choose a reason for hiding this comment

indutny commented Jul 8, 2016•
edited
Loading

ChALkeRAug 5, 2016•
edited
Loading