Split generate and sign steps; add more CI checks

legoktm commented 1 month ago

Status

Ready for review

Description

One of the biggest frustrations I have with this process is that the generation and signing steps are combined. I really want to generate everything, review it, and then move ahead with signing.

This splits the two steps and inlines them into the Makefile as separate make generate and make sign. Also change the default goal to help, which is what all of our other Makefiles do.

This necessitates checking in the default.rulesets file that's used as the input for signing.

As requested in #21, this verifies:

generated rulesets files match the XML files. (In some sense it's just a reimplementation of the upstream/merge-rulesets.py script, but would stop a zero-length ruleset from being deployed)
there are no extra nor missing signatures

Fixes #21.

Review Checklist

[ ] Visual review
[ ] CI passes

legoktm commented 1 month ago

Rebased this on top of https://github.com/freedomofpress/securedrop-https-everywhere-ruleset/pull/205, which I used this for. So it works :)

legoktm commented 1 month ago

Done!

freedomofpress / securedrop-https-everywhere-ruleset