The completeness check requires sdist/<name> in the output directory, but
nothing copied the built sdist there. Copy it from the build work directory
before the signing phase, and pin that order in a test.
The canonical sdist is built from the tag, but a second build of the same
commit differs in tar and gzip timestamps, so its digest is recorded from the
published asset, not from a rebuild. Correct the comments and docs that said
"reproducible sdist". No behaviour change.
xbps packages are zstd-compressed. The clean install image had no zstd, so
tar could not list the payload and the smoke failed on a package that was
fine. Install zstd in the install phase.
The sdist is built from the tag by the release path and never attached by
hand. The release PR sets version and _tag in the template; the checksum is
recorded by a pull request after the tag. Runner requirements, the three
container phases and the local dry run are documented.
- build-release.sh: POSIX-only checks (dash runs the release), a release form
is exactly X.Y.Z or X.Y.Z-alpha|beta|rcN, and the install smoke refuses a
package that has no smoke recipe.
- Tests: names and tag gate (exact match, committed template must agree), key
refusals before any container starts (fake podman records calls), the
render script pins only the build tree, podman wiring (only the sign phase
sees the key, and it has no network), the xbps ordering of pre-release
spellings, the workflow gates, tmpfs key staging, and the publish set
(sdist, packages, signatures, repodata, client key).
The signed Void release depended on a fork sdist attached to the release
before the tag existed, and the app template carried a PENDING checksum that
had to be filled by hand. Every release is now built from its tag alone:
- packaging/void/build-release.sh is the one release path. The Gitea workflow,
the local dry run and the smoke gate all call it.
- The canonical reproducible sdist is built from the tag with
scripts/build_reproducible_wheel.py (Python 3.11, pinned uv).
- render-voculinux.sh pins version, _tag and checksum in the container's build
tree only, and places the sdist where xbps-src resolves its distfile.
The committed template keeps a zero placeholder until the post-release
checksum pull request.
- xbps version is __version__ with the hyphen removed (0.19.0-beta becomes
0.19.0beta), which xbps sorts below the final release.
- Builds run without the key; signing runs with the key mounted read-only and
no network; the install smoke runs in a clean image without the key.
- The workflow gates the tag and the key before any container starts, writes
the key to a 0600 tmpfs file, and publishes only the staged set (sdist,
packages, signatures, repodata, client key).
- smoke.sh runs the same pipeline with a throwaway key.
xavierk