Closed maltfield closed 1 year ago
ok, I've fixed the pre-release signing. Indeed, I had to make the changes directly in the master
branch
Excellent; I just confirmed the authenticity of the Linux build by verifying the integrity of the reproducible is the same on my local system as what GitHub produced
root@disp6165:~# git clone --single-branch --branch v0.7.0 https://github.com/BusKill/buskill-app.git
Cloning into 'buskill-app'...
remote: Enumerating objects: 6142, done.
remote: Counting objects: 100% (8/8), done.
remote: Compressing objects: 100% (6/6), done.
remote: Total 6142 (delta 3), reused 4 (delta 2), pack-reused 6134
Receiving objects: 100% (6142/6142), 194.99 MiB | 1.58 MiB/s, done.
Resolving deltas: 100% (3457/3457), done.
root@disp6165:~# cd buskill-app/
root@disp6165:~/buskill-app#
root@disp6165:~/buskill-app# git branch -l
* v0.7.0
root@disp6165:~/buskill-app#
root@disp6165:~/buskill-app# build/linux/debianWrapper.sh
...
root@disp6165:~/buskill-app#
root@disp6165:~/buskill-app# sha256sum dist/*/*.AppImage
f2f4f6429153c30315913f2849c5caca5c803055bca54d3460c1c47a53980034 dist/buskill-lin-v0.7.0-x86_64/buskill-v0.7.0.AppImage
root@disp6165:~/buskill-app#
root@disp6165:~/buskill-app# wget https://github.com/BusKill/buskill-app/releases/download/5300359065_linux/buskill-lin-v0.7.0-x86_64.tbz
--2023-06-17 17:31:12-- https://github.com/BusKill/buskill-app/releases/download/5300359065_linux/buskill-lin-v0.7.0-x86_64.tbz
Resolving github.com (github.com)... 20.207.73.82
Connecting to github.com (github.com)|20.207.73.82|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/274360069/db029f0d-3bea-4f64-8999-7cf632a9d71a?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230617%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230617T223115Z&X-Amz-Expires=300&X-Amz-Signature=106f7870a424c8c872c68884759112426bf56d84aba37ab45282fb397c6865f6&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=274360069&response-content-disposition=attachment%3B%20filename%3Dbuskill-lin-v0.7.0-x86_64.tbz&response-content-type=application%2Foctet-stream [following]
--2023-06-17 17:31:13-- https://objects.githubusercontent.com/github-production-release-asset-2e65be/274360069/db029f0d-3bea-4f64-8999-7cf632a9d71a?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230617%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230617T223115Z&X-Amz-Expires=300&X-Amz-Signature=106f7870a424c8c872c68884759112426bf56d84aba37ab45282fb397c6865f6&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=274360069&response-content-disposition=attachment%3B%20filename%3Dbuskill-lin-v0.7.0-x86_64.tbz&response-content-type=application%2Foctet-stream
Resolving objects.githubusercontent.com (objects.githubusercontent.com)... 185.199.109.133, 185.199.110.133, 185.199.111.133, ...
Connecting to objects.githubusercontent.com (objects.githubusercontent.com)|185.199.109.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 34190523 (33M) [application/octet-stream]
Saving to: ‘buskill-lin-v0.7.0-x86_64.tbz’
buskill-lin-v0.7.0- 100%[===================>] 32.61M 1.46MB/s in 67s
2023-06-17 17:32:22 (500 KB/s) - ‘buskill-lin-v0.7.0-x86_64.tbz’ saved [34190523/34190523]
root@disp6165:~/buskill-app# tar -xjf buskill-lin-v0.7.0-x86_64.tbz
root@disp6165:~/buskill-app# sha256sum */*.AppImage
f2f4f6429153c30315913f2849c5caca5c803055bca54d3460c1c47a53980034 buskill-lin-v0.7.0-x86_64/buskill-v0.7.0.AppImage
root@disp6165:~/buskill-app#
I downloaded and confirmed the pre-release signatures of the non-reproducable windows & MacOS builds
user@disp6165:~/tmp/buskill/v0.7.0/builds$ curl --location --remote-name https://github.com/BusKill/buskill-app/releases/download/5300359065_windows/buskill-win-v0.7.0-x86_64.zip
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0
100 31.7M 100 31.7M 0 0 2931k 0 0:00:11 0:00:11 --:--:-- 5368k
user@disp6165:~/tmp/buskill/v0.7.0/builds$ curl --location --remote-name https://github.com/BusKill/buskill-app/releases/download/5300359065_mac/buskill-mac-v0.7.0-x86_64.dmg
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0
100 18.7M 100 18.7M 0 0 2369k 0 0:00:08 0:00:08 --:--:-- 3974k
user@disp6165:~/tmp/buskill/v0.7.0/builds$ curl --location --remote-name https://github.com/BusKill/buskill-app/releases/download/5300359065_windows/SHA256SUMS
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0
100 96 100 96 0 0 26 0 0:00:03 0:00:03 --:--:-- 79
user@disp6165:~/tmp/buskill/v0.7.0/builds$ curl --location --remote-name https://github.com/BusKill/buskill-app/releases/download/5300359065_windows/SHA256SUMS.asc
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0
100 833 100 833 0 0 237 0 0:00:03 0:00:03 --:--:-- 694
user@disp6165:~/tmp/buskill/v0.7.0/builds$ gpg --verify SHA256SUMS.asc
gpg: assuming signed data in 'SHA256SUMS'
gpg: Signature made Sat 17 Jun 2023 05:13:59 PM -05
gpg: using RSA key 0B90809464D7B7A50E1871DE7DE9F38ADB5B1E8A
gpg: Good signature from "BusKill Pre-Releases Signing Key 2020.07 <pre-releases@buskill.in>" [full]
Primary key fingerprint: 713D 4A49 60EE 849B AE3B 41BA BE75 DB07 E34A FBC1
Subkey fingerprint: 0B90 8094 64D7 B7A5 0E18 71DE 7DE9 F38A DB5B 1E8A
user@disp6165:~/tmp/buskill/v0.7.0/builds$ sha256sum -c SHA256SUMS
buskill-win-v0.7.0-x86_64.zip: OK
user@disp6165:~/tmp/buskill/v0.7.0/builds$ rm SHA256SUMS*
user@disp6165:~/tmp/buskill/v0.7.0/builds$ curl --location --remote-name https://github.com/BusKill/buskill-app/releases/download/5300359065_mac/SHA256SUMS
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0
100 96 100 96 0 0 32 0 0:00:03 0:00:02 0:00:01 146
user@disp6165:~/tmp/buskill/v0.7.0/builds$ curl --location --remote-name https://github.com/BusKill/buskill-app/releases/download/5300359065_mac/SHA256SUMS.asc
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0
100 833 100 833 0 0 281 0 0:00:02 0:00:02 --:--:-- 773
user@disp6165:~/tmp/buskill/v0.7.0/builds$ gpg --verify SHA256SUMS.asc
gpg: assuming signed data in 'SHA256SUMS'
gpg: Signature made Sat 17 Jun 2023 05:38:43 PM -05
gpg: using RSA key 0B90809464D7B7A50E1871DE7DE9F38ADB5B1E8A
gpg: Good signature from "BusKill Pre-Releases Signing Key 2020.07 <pre-releases@buskill.in>" [full]
Primary key fingerprint: 713D 4A49 60EE 849B AE3B 41BA BE75 DB07 E34A FBC1
Subkey fingerprint: 0B90 8094 64D7 B7A5 0E18 71DE 7DE9 F38A DB5B 1E8A
user@disp6165:~/tmp/buskill/v0.7.0/builds$ sha256sum -c SHA256SUMS
buskill-mac-v0.7.0-x86_64.dmg: OK
user@disp6165:~/tmp/buskill/v0.7.0/builds$
I did a diff of the sourcecode tarball to my local repo. Looks good.
user@buskill:~$ cd $HOME/Downloads
user@buskill:~/Downloads$
user@buskill:~/Downloads$ wget https://github.com/BusKill/buskill-app/archive/refs/tags/v0.7.0.tar.gz
--2023-06-17 17:47:11-- https://github.com/BusKill/buskill-app/archive/refs/tags/v0.7.0.tar.gz
Resolving github.com (github.com)... 20.207.73.82
Connecting to github.com (github.com)|20.207.73.82|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://codeload.github.com/BusKill/buskill-app/tar.gz/refs/tags/v0.7.0 [following]
--2023-06-17 17:47:13-- https://codeload.github.com/BusKill/buskill-app/tar.gz/refs/tags/v0.7.0
Resolving codeload.github.com (codeload.github.com)... 20.207.73.88
Connecting to codeload.github.com (codeload.github.com)|20.207.73.88|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/x-gzip]
Saving to: ‘v0.7.0.tar.gz’
v0.7.0.tar.gz [ <=> ] 27.12M 1010KB/s in 23s
2023-06-17 17:47:38 (1.17 MB/s) - ‘v0.7.0.tar.gz’ saved [28440956]
user@buskill:~/Downloads$
user@buskill:~/Downloads$ cd $HOME/sandbox/buskill-app
user@buskill:~/sandbox/buskill-app$
user@buskill:~/sandbox/buskill-app$ git checkout refs/tags/v0.7.0
Note: switching to 'refs/tags/v0.7.0'.
You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.
If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:
git switch -c <new-branch-name>
Or undo this operation with:
git switch -
Turn off this advice by setting config variable advice.detachedHead to false
HEAD is now at d87f428 Merge branch 'refs/heads/v0.7.0'
user@buskill:~/sandbox/buskill-app$
user@buskill:~/sandbox/buskill-app$ diff -rq . $HOME/Downloads/buskill-app-0.7.0/
Only in .: build
Only in .: dist
Only in ./docs: _build
Only in ./docs/_extensions: __pycache__
Only in ./docs/_extensions/sphinxemoji: __pycache__
Only in ./docs: .gitignore
Only in .: .git
Only in .: .gitattributes
Only in .: .github
Only in .: .gitignore
Only in ./src/packages/buskill: __pycache__
Only in ./src/packages/garden/navigationdrawer: __pycache__
Only in ./src/packages/garden/progressspinner: __pycache__
Only in ./src: __pycache__
Only in .: updates
user@buskill:~/sandbox/buskill-app$
I created a release from the tag on GitHub, but then I realized that the tag was old. So I deleted the tag (that deleted the release), I created the tag again (pointing to the current-tip of master), and now I'm creating the release again
TODO: update repo metadata
crap, I realized that changing the v0.7.0 tag means the sourcecode changes which means the signature is now invalid
user@disp6165:~/tmp/buskill/v0.7.0/test$ wget https://github.com/BusKill/buskill-app/releases/download/v0.7.0/v0.7.0.tar.gz.asc
--2023-06-17 18:29:52-- https://github.com/BusKill/buskill-app/releases/download/v0.7.0/v0.7.0.tar.gz.asc
Resolving github.com (github.com)... 20.207.73.82
Connecting to github.com (github.com)|20.207.73.82|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/274360069/4490248e-def2-4c34-abff-37211279ce27?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230617%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230617T232955Z&X-Amz-Expires=300&X-Amz-Signature=7aa116e015616fd79a44abb569de6eb6a8af88de2ec081e10c3cf33e347407f1&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=274360069&response-content-disposition=attachment%3B%20filename%3Dv0.7.0.tar.gz.asc&response-content-type=application%2Foctet-stream [following]
--2023-06-17 18:29:54-- https://objects.githubusercontent.com/github-production-release-asset-2e65be/274360069/4490248e-def2-4c34-abff-37211279ce27?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230617%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230617T232955Z&X-Amz-Expires=300&X-Amz-Signature=7aa116e015616fd79a44abb569de6eb6a8af88de2ec081e10c3cf33e347407f1&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=274360069&response-content-disposition=attachment%3B%20filename%3Dv0.7.0.tar.gz.asc&response-content-type=application%2Foctet-stream
Resolving objects.githubusercontent.com (objects.githubusercontent.com)... 185.199.111.133, 185.199.110.133, 185.199.108.133, ...
Connecting to objects.githubusercontent.com (objects.githubusercontent.com)|185.199.111.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 833 [application/octet-stream]
Saving to: ‘v0.7.0.tar.gz.asc’
v0.7.0.tar.gz.asc 100%[===================>] 833 --.-KB/s in 0s
2023-06-17 18:29:56 (122 MB/s) - ‘v0.7.0.tar.gz.asc’ saved [833/833]
user@disp6165:~/tmp/buskill/v0.7.0/test$ gpg --verify v0.7.0.tar.gz.asc
gpg: assuming signed data in 'v0.7.0.tar.gz'
gpg: Signature made Sat 17 Jun 2023 06:05:26 PM -05
gpg: using RSA key 798DC1101F3DEC428ADE124D68B8BCB0C5023905
gpg: BAD signature from "BusKill Releases Signing Key 2020.07 <releases@buskill.in>" [full]
user@disp6165:~/tmp/buskill/v0.7.0/test$
I verified the latest source tarball
user@buskill:~$ cd $HOME/Downloads/
user@buskill:~/Downloads$
user@buskill:~/Downloads$ ls
buskill-app-0.7.0 v0.7.0.tar.gz
user@buskill:~/Downloads$ rm -rf buskill-app-0.7.0 v0.7.0.tar.gz
user@buskill:~/Downloads$
user@buskill:~/Downloads$ wget https://github.com/BusKill/buskill-app/archive/refs/tags/v0.7.0.tar.gz
--2023-06-17 18:32:33-- https://github.com/BusKill/buskill-app/archive/refs/tags/v0.7.0.tar.gz
Resolving github.com (github.com)... 20.207.73.82
Connecting to github.com (github.com)|20.207.73.82|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://codeload.github.com/BusKill/buskill-app/tar.gz/refs/tags/v0.7.0 [following]
--2023-06-17 18:32:35-- https://codeload.github.com/BusKill/buskill-app/tar.gz/refs/tags/v0.7.0
Resolving codeload.github.com (codeload.github.com)... 20.207.73.88
Connecting to codeload.github.com (codeload.github.com)|20.207.73.88|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/x-gzip]
Saving to: ‘v0.7.0.tar.gz’
v0.7.0.tar.gz [ <=> ] 27.12M 2.69MB/s in 11s
2023-06-17 18:32:48 (2.57 MB/s) - ‘v0.7.0.tar.gz’ saved [28440082]
user@buskill:~/Downloads$ tar -xvf v0.7.0.tar.gz
...
user@buskill:~/Downloads$
user@buskill:~/Downloads$ cd $HOME/sandbox/buskill-app
user@buskill:~/sandbox/buskill-app$
user@buskill:~/sandbox/buskill-app$ git checkout refs/tags/v0.7.0
M CHANGELOG
Note: switching to 'refs/tags/v0.7.0'.
You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.
If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:
git switch -c <new-branch-name>
Or undo this operation with:
git switch -
Turn off this advice by setting config variable advice.detachedHead to false
HEAD is now at 4139a51 added date of v0.7.0 release
user@buskill:~/sandbox/buskill-app$
user@buskill:~/sandbox/buskill-app$ diff -rq . $HOME/Downloads/buskill-app-0.7.0/
Only in .: build
Files ./CHANGELOG and /home/user/Downloads/buskill-app-0.7.0/CHANGELOG differ
Only in .: dist
Only in ./docs: _build
Only in ./docs/_extensions: __pycache__
Only in ./docs/_extensions/sphinxemoji: __pycache__
Only in ./docs: .gitignore
Only in .: .git
Only in .: .gitattributes
Only in .: .github
Only in .: .gitignore
Only in ./src/packages/buskill: __pycache__
Only in ./src/packages/garden/navigationdrawer: __pycache__
Only in ./src/packages/garden/progressspinner: __pycache__
Only in ./src: __pycache__
Only in .: updates
user@buskill:~/sandbox/buskill-app$
Then I signed it and uploaded it to the new v0.7.0
release
Fuck, I tested it again and got BAD signature
. I did it again and got it again
user@disp6165:~/tmp/buskill/v0.7.0/test$ gpg --verify v0.7.0.tar.gz.asc
gpg: assuming signed data in 'v0.7.0.tar.gz'
gpg: Signature made Sat 17 Jun 2023 06:05:26 PM -05
gpg: using RSA key 798DC1101F3DEC428ADE124D68B8BCB0C5023905
gpg: BAD signature from "BusKill Releases Signing Key 2020.07 <releases@buskill.in>" [full]
user@disp6165:~/tmp/buskill/v0.7.0/test$
I think I need to download the file directly from the release, as opposed to wget from https://github.com/BusKill/buskill-app/archive/refs/tags/v0.7.0.tar.gz
Edit: wait, those are the same files. Wtf. Okay, I'm going to have to do this again with hashes as I go
Edit2: Ah, it was a PEBCAK. I was just uploading the old file over-and-over. Now it looks good
user@disp6165:~/tmp/buskill/v0.7.0/test$ rm v0.7.0.tar.gz.asc
user@disp6165:~/tmp/buskill/v0.7.0/test$ wget https://github.com/BusKill/buskill-app/releases/download/v0.7.0/v0.7.0.tar.gz.asc
--2023-06-17 18:48:47-- https://github.com/BusKill/buskill-app/releases/download/v0.7.0/v0.7.0.tar.gz.asc
Resolving github.com (github.com)... 20.207.73.82
Connecting to github.com (github.com)|20.207.73.82|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/274360069/2724cd10-42f0-473e-be98-c1e2ea0ce930?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230617%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230617T234849Z&X-Amz-Expires=300&X-Amz-Signature=2fc5e8893a0da5c15b9e003e631d29da661e47b85733210e833ca9f080eec9ee&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=274360069&response-content-disposition=attachment%3B%20filename%3Dv0.7.0.tar.gz.asc&response-content-type=application%2Foctet-stream [following]
--2023-06-17 18:48:49-- https://objects.githubusercontent.com/github-production-release-asset-2e65be/274360069/2724cd10-42f0-473e-be98-c1e2ea0ce930?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230617%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230617T234849Z&X-Amz-Expires=300&X-Amz-Signature=2fc5e8893a0da5c15b9e003e631d29da661e47b85733210e833ca9f080eec9ee&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=274360069&response-content-disposition=attachment%3B%20filename%3Dv0.7.0.tar.gz.asc&response-content-type=application%2Foctet-stream
Resolving objects.githubusercontent.com (objects.githubusercontent.com)... 185.199.111.133, 185.199.109.133, 185.199.108.133, ...
Connecting to objects.githubusercontent.com (objects.githubusercontent.com)|185.199.111.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 833 [application/octet-stream]
Saving to: ‘v0.7.0.tar.gz.asc’
v0.7.0.tar.gz.asc 100%[====================================>] 833 --.-KB/s in 0s
2023-06-17 18:48:51 (2.10 MB/s) - ‘v0.7.0.tar.gz.asc’ saved [833/833]
user@disp6165:~/tmp/buskill/v0.7.0/test$ gpg --verify v0.7.0.tar.gz.asc
gpg: assuming signed data in 'v0.7.0.tar.gz'
gpg: Signature made Sat 17 Jun 2023 06:39:36 PM -05
gpg: using RSA key 798DC1101F3DEC428ADE124D68B8BCB0C5023905
gpg: Good signature from "BusKill Releases Signing Key 2020.07 <releases@buskill.in>" [full]
Primary key fingerprint: E0AF FF57 DC00 FBE0 5635 8761 4AE2 1E19 36CE 786A
Subkey fingerprint: 798D C110 1F3D EC42 8ADE 124D 68B8 BCB0 C502 3905
user@disp6165:~/tmp/buskill/v0.7.0/test$
I just updated the metadata in the repo (and cooresponding detached pgp signature) to the GitHub repo, and I confirmed that the in-app upgrade from v0.6.0 to v0.7.0 works
Now I'm going to sync those two files to all the mirrors
I confirmed that upgrade works on all 4x mirrors
I finished writing a blog post about the new release, which I'll send-out shortly. This is done :tada:
This issue will track the effort to release BusKill App v0.7.0