feat(release): add reproducible signed artifacts (#19)

2026-07-16 17:48:21 +02:00
parent 07004cd75f
commit cc5793f935
52 changed files with 2568 additions and 73 deletions
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+version="${1:?usage: finalize-release-candidate.sh VERSION RELEASE_DIRECTORY}"
+release_dir="${2:?usage: finalize-release-candidate.sh VERSION RELEASE_DIRECTORY}"
+container_sbom="$release_dir/FinalFactory.Rendezvous.Container.$version.spdx.json"
+
+[[ -s "$container_sbom" ]] || {
+  echo "Container SBOM is missing or empty: $container_sbom" >&2
+  exit 1
+}
+
+(
+  cd "$release_dir"
+  find . -maxdepth 1 -type f ! -name checksums.sha256 -printf '%f\n' \
+    | LC_ALL=C sort \
+    | xargs sha256sum >checksums.sha256
+)
+python3 "$root/eng/release_artifacts.py" verify \
+  --root "$root" \
+  --release-dir "$release_dir" \
+  --version "$version" \
+  --phase publish-ready
+
+echo "Finalized publish-ready release candidate $version"