You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: OpenSC-Release-Howto.md
+33-24
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,8 @@ Releasing OpenSC should be simple and streamlined, yet a predictable and easily
13
13
## Preparing Security Relevant Changes
14
14
15
15
* Request a CVE in case of security relevant fixes or changes.
16
-
* Use Red Hat product security at `[email protected]` describing the CVE and ask for CVE allocation. Do NOT use mitre directly as their response times are terrible.
16
+
* Use Red Hat product security at `[email protected]` describing the CVE and ask for CVE allocation.
17
+
* Do NOT use mitre directly as their response times are terrible.
17
18
* Filter OSS-Fuzz for [security relevant issues](https://oss-fuzz.com/testcases?open=no&security=yes) that were fixed for this release
18
19
* Filter Coverity scan for _High_ impact issues that were fixed for this release
19
20
* Update the [security advisories](https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories)
@@ -35,20 +36,20 @@ Release (or RC) version must be changed in the following files:
35
36
*`configure.ac` : Update the [LT version number](https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html), which is required with changes to, for example, `opensc.h` and `libopensc.exports`.
36
37
*`.appveyor.yml`: Update the version on first line
37
38
*`README.md`: Update the links to the new release and binaries
38
-
*`SECURITY.md`
39
+
*`SECURITY.md`: Update supported version
39
40
40
-
Optionally, discuss changes to _NEWS_ by opening a [new issue](https://github.com/OpenSC/OpenSC/issues/new) with your suggestions.
41
+
Optionally, discuss changes to `NEWS` by opening a [new issue](https://github.com/OpenSC/OpenSC/issues/new) with your suggestions.
41
42
42
-
## Build and Test Binaries
43
+
###Build and Test Binaries
43
44
44
45
1. Create release tag
45
46
*_Lightweight_ tag for release candidate
46
-
* Via GitHub when creating release - GitHub will automatically create _*-rcX_ as lightweight tag
47
+
* Via GitHub when creating release - GitHub will automatically create `*-rcX` as lightweight tag
47
48
* Locally with git
48
49
49
50
```bash
50
51
git tag 0.20.0
51
-
git push origin 0.20.0
52
+
git push origin 0.20.0
52
53
```
53
54
54
55
* _Annotated_ tag for final release
@@ -60,7 +61,7 @@ Optionally, discuss changes to _NEWS_ by opening a [new issue](https://github.co
60
61
```
61
62
62
63
2. Prepare build artifacts
63
-
* Wait around 50 minutes (after pushing the tag) to allow build artifacts be placed into the [nightly builds](https://github.com/OpenSC/Nightly)
64
+
* Wait around 30-50 minutes (after pushing the tag) to allow build artifacts be placed into the [Nightly Builds](https://github.com/OpenSC/Nightly)
64
65
* All builds must succeed and must not generate more warnings than the previous build.
65
66
* Copy build artifacts selecting the correct branch using the hash of the release commit, e.g.
66
67
@@ -72,25 +73,33 @@ Optionally, discuss changes to _NEWS_ by opening a [new issue](https://github.co
72
73
unzip ${BRANCH}.zip
73
74
```
74
75
76
+
* Recreate the macOS image and Windows Debug files
* For final releases, download signed Windows installers from Signpath.io instead of unsigned installers from AppVeyor (i.e. Nightly builds):
84
+
1. Navigate to [Signpath's outstanding Signing Requests](https://app.signpath.io/Web/8d2463fe-39bd-4a41-bb72-f008b4b1fe17/SigningRequests)
85
+
2. Select the ones that were issued with the creation of the release branch
86
+
3. Check the signing request's Build data URL to match the related AppVeyor build that was triggered with creation of the release branch
87
+
4. Approve signing and waitfor completion of the signing process
88
+
5. Download signed artifact from Signpath.io
75
89
* Do a separate smoke testforall installers and the tarball, [document your resultsin the Wiki](https://github.com/OpenSC/OpenSC/wiki/Smart-Card-Release-Testing).
76
90
77
-
3. Create a [new (draft) release](https://github.com/OpenSC/OpenSC/releases):
78
-
* Describe the release including all changes to NEWS (Markdown)
79
-
* Select appropriate tag (when pushed before) or create new one in GitHub (for lightweight tags only)
80
-
* For final releases, selectthe existing tag, e.g. _0.20.0_;for release candidates choose a new tag, e.g. _0.20.0-rc1_
81
-
* Upload the build artifacts to the new release
82
-
* release tarball, OSX installer, 2 variants (default, light) of Windows installer for both 64b and 32b + separate debug archives
83
-
* For final releases, download signed Windows installers from Signpath.io instead of unsigned installers from AppVeyor (i.e. Nightly builds):
84
-
85
-
1. Navigate to [Signpath's outstanding Signing Requests](https://app.signpath.io/Web/8d2463fe-39bd-4a41-bb72-f008b4b1fe17/SigningRequests)
86
-
2. Select the ones that were issued with the creation of the release branch
87
-
3. Check the signing request's Build data URL to match the related AppVeyor build that was triggered with creation of the release branch
88
-
4. Approve signing and waitfor completion of the signing process
89
-
5. Download signed artifact from Signpath.io
90
-
6. Upload signed artifact to Github Release
91
-
* Check:
92
-
* _This is a pre-release_ if only creating a release candidate
93
-
* _Set as latest release_ if creating final release
91
+
## Create release
92
+
93
+
* A new (draft) release is created via button on the [release page]((https://github.com/OpenSC/OpenSC/releases))
94
+
* Describe the release including all changes to NEWS (Markdown)
95
+
* Select appropriate tag (when pushed before) or create new one in GitHub (for lightweight tags only)
96
+
* For final releases, selectthe existing tag, e.g. `0.20.0`;for release candidates choose a new tag, e.g. `0.20.0-rc1`
97
+
* Upload the build artifacts to the new release
98
+
* From **Nightly Builds**: Release tarball, OSX installer, 2 variants (default, light) of Windows separate debug archives for both 64b and 32b
99
+
* From **Signpath.io**: 2 variants (default, light) of Windows installer for both 64b and 32b
100
+
* Check:
101
+
*`This is a pre-release`if only creating a release candidate
0 commit comments