feat(NODE-6157): add signature to github releases #4119
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
alcaeus
reviewed
May 24, 2024
aditi-khare-mongoDB
changed the title
W-A-James
added
the
Primary Review
aditi-khare-mongoDB
force-pushed
the
NODE-5167/sign-releases
branch
from
a542691 to
eb72e4f
Compare
aditi-khare-mongoDB
changed the title
aditi-khare-mongoDB
changed the title
W-A-James
previously approved these changes
May 29, 2024
W-A-James
added
Team Review
aditi-khare-mongoDB
force-pushed
the
NODE-5167/sign-releases
branch
from
da50b67 to
02e1f27
Compare
W-A-James
previously approved these changes
May 31, 2024
W-A-James
added
Team Review
baileympearson
requested changes
May 31, 2024
This was referenced Sep 28, 2024
This was referenced Oct 1, 2024
This was referenced Oct 5, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Sign releases in both 5.x and 6.x
What is changing?
Automate release signing with a detached signature and verification instructions in the README.
Link to an example of release signatures working with v2 (if you check the artifact link at the end of the compress_sign step, you can see the signature)
Is there new documentation needed for these changes?
No
What is the motivation for this change?
SSDLC Compliance
Release Highlight
Add Signature to Github Releases
The Github release for the
mongodbpackage now contains a detached signature file for the NPM package (namedmongodb-X.Y.Z.tgz.sig), on every major and patch release to 6.x and 5.x. To verify the signature, follow the instructions in the 'Release Integrity' section of theREADME.mdfile.Double check the following
npm run check:lintscripttype(NODE-xxxx)[!]: descriptionfeat(NODE-1234)!: rewriting everything in coffeescript