Skip to content

build: Add verify-release script - #1913

Merged
lukpueh merged 3 commits into
theupdateframework:developfrom
jku:verify-release
Mar 24, 2022
Merged

build: Add verify-release script#1913
lukpueh merged 3 commits into
theupdateframework:developfrom
jku:verify-release

Conversation

@jku

@jkujku commented Mar 22, 2022•
edited
Loading

Copy link
Copy Markdown
Member

verify-release

  • Builds a release from current commit
  • Warns if git describe does not match built version (in other words we're building from a commit that is not release tagged)
  • Warns if built version is not the latest GitHub or PyPI version
  • Errors if GitHub or PyPI release artifacts for this version do not match the built
    release artifacts

This should be useful after release as any developer (or a CI job) can
easily verify that the release matches the sources in git.

Note that the last checks currently fail as the 1.0 build was not
reproducible. They should succeed after next release.

Signed-off-by: Jussi Kukkonen jkukkonen@vmware.com

Some comments:

  • this commit adds a file to root directory, I don't like it... but I didn't know where else to put it
  • signatures are not checked because it's so painful. This could be a future improvement if someone has good ideas...
  • if the release files do not match, there is an error but no details are printed and the downloaded files are not left available: I did not want to add this complexity to the script

Jussi Kukkonen
build: Add verify-release script
53bacdf
verify-release
* Builds a release from current commit
* Notifies if git describe does not match built version
* Notifies if built version is not the latest GitHub or PyPI version
* Asserts that the GitHub and PyPI release artifacts match the built
release artifacts
This should be useful after release as any developer (or a CI job) can
easily verify that the release matches the sources in git.
Note that the last checks currently fail as the 1.0 build was not
reproducible. They should succeed after next release.
Signed-off-by: Jussi Kukkonen <jkukkonen@vmware.com>
@coveralls

coveralls commented Mar 22, 2022•
edited
Loading

Copy link
Copy Markdown

Pull Request Test Coverage Report for Build 2034328794

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at 98.312%
TotalsCoverage Status
Change from base Build 2022257279:0.0%
Covered Lines:1179
Relevant Lines:1195
💛 - Coveralls

jku
jku commented Mar 22, 2022
View reviewed changes
Comment threadverify_release Outdated
lukpueh
lukpueh reviewed Mar 22, 2022
View reviewed changes
Comment threadverify_release Outdated
lukpueh
lukpueh reviewed Mar 22, 2022
View reviewed changes

@lukpuehlukpueh left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cool stuff, @jku! I tried it out and it works nicely.

Are we supposed to run it with development requirements installed? It only needs requests and build to be installed. Maybe it's worth mentioning requirements somewhere, e.g. in the doc header or in RELEASE.md?

Will get back with an actual code review.

Jussi Kukkonen
verify_release: Be explicit about PyPI version
65d6503
We are interested in what pip thinks is the current tuf version: make
that explicit in method naming and comments.
Signed-off-by: Jussi Kukkonen <jkukkonen@vmware.com>
lukpueh
lukpueh requested changes Mar 24, 2022
View reviewed changes

@lukpuehlukpueh left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, modulo the bug you discovered yourself.

Jussi Kukkonen
verify_release: Be specific about expected artifacts
6819d41
Use a hard-coded list of artifacts that we expect to find in a
release. Specifically check that each of those files matches
the corresponding file in locally built release.
Also add two missing annotations.
Signed-off-by: Jussi Kukkonen <jkukkonen@vmware.com>
@jku

jku commented Mar 24, 2022

Copy link
Copy Markdown
MemberAuthor

Issue is fixed. The testing is obviously not quite 100.0% (since we dont have a positive test case on pypi.org yet) but I have done the manual testing I could.

lukpueh
lukpueh approved these changes Mar 24, 2022
View reviewed changes

@lukpuehlukpueh left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎉

@lukpueh
lukpueh merged commit 7da03ee into theupdateframework:developMar 24, 2022
@lukpuehlukpueh mentioned this pull request Mar 30, 2022
Closed
7 tasks
@jku
jku deleted the verify-release branch December 30, 2024 09:12
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lukpuehlukpuehlukpueh approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jku@coveralls@lukpueh