The signed Void release depended on a fork sdist attached to the release
before the tag existed, and the app template carried a PENDING checksum that
had to be filled by hand. Every release is now built from its tag alone:
- packaging/void/build-release.sh is the one release path. The Gitea workflow,
the local dry run and the smoke gate all call it.
- The canonical reproducible sdist is built from the tag with
scripts/build_reproducible_wheel.py (Python 3.11, pinned uv).
- render-voculinux.sh pins version, _tag and checksum in the container's build
tree only, and places the sdist where xbps-src resolves its distfile.
The committed template keeps a zero placeholder until the post-release
checksum pull request.
- xbps version is __version__ with the hyphen removed (0.19.0-beta becomes
0.19.0beta), which xbps sorts below the final release.
- Builds run without the key; signing runs with the key mounted read-only and
no network; the install smoke runs in a clean image without the key.
- The workflow gates the tag and the key before any container starts, writes
the key to a 0600 tmpfs file, and publishes only the staged set (sdist,
packages, signatures, repodata, client key).
- smoke.sh runs the same pipeline with a throwaway key.
