You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@openwhisk.apache.org by GitBox <gi...@apache.org> on 2020/04/14 21:22:41 UTC
[GitHub] [openwhisk-wskdebug] alexkli opened a new pull request #50: add
"Releasing" section to readme
alexkli opened a new pull request #50: add "Releasing" section to readme
URL: https://github.com/apache/openwhisk-wskdebug/pull/50
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [openwhisk-wskdebug] dgrove-oss commented on a change in pull
request #50: add "Releasing" section to readme
Posted by GitBox <gi...@apache.org>.
dgrove-oss commented on a change in pull request #50: add "Releasing" section to readme
URL: https://github.com/apache/openwhisk-wskdebug/pull/50#discussion_r408447168
##########
File path: README.md
##########
@@ -689,6 +690,16 @@ See also [invoker.js](src/invoker.js). Note that some of these might not be set
Contributions are welcomed! Read the [Contributing Guide](.github/CONTRIBUTING.md) for more information.
+<a name="releasing"></a>
+## Releasing
+
+Releases are done using the [Apache OpenWhisk Release Process](https://github.com/apache/openwhisk-release/blob/master/docs/release_instructions.md).
+
+`wskdebug` releases are available:
+- on the [Apache OpenWhisk download page](https://openwhisk.apache.org/downloads), stored on Apache mirrors (canonical release)
+- on NPM as [@openwhisk/wskdebug](https://www.npmjs.com/package/@openwhisk/wskdebug) (convenience)
+- as [Github Releases](https://github.com/apache/openwhisk-wskdebug/releases) (linked to source history)
Review comment:
I'd suggest dropping the line for Github Releases. We should generally be steering people to downloading source tars from canonical Apache download since it has the signed artifacts that can be verified.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [openwhisk-wskdebug] alexkli commented on a change in pull request
#50: add "Releasing" section to readme
Posted by GitBox <gi...@apache.org>.
alexkli commented on a change in pull request #50: add "Releasing" section to readme
URL: https://github.com/apache/openwhisk-wskdebug/pull/50#discussion_r408477111
##########
File path: README.md
##########
@@ -689,6 +690,16 @@ See also [invoker.js](src/invoker.js). Note that some of these might not be set
Contributions are welcomed! Read the [Contributing Guide](.github/CONTRIBUTING.md) for more information.
+<a name="releasing"></a>
+## Releasing
+
+Releases are done using the [Apache OpenWhisk Release Process](https://github.com/apache/openwhisk-release/blob/master/docs/release_instructions.md).
+
+`wskdebug` releases are available:
+- on the [Apache OpenWhisk download page](https://openwhisk.apache.org/downloads), stored on Apache mirrors (canonical release)
+- on NPM as [@openwhisk/wskdebug](https://www.npmjs.com/package/@openwhisk/wskdebug) (convenience)
+- as [Github Releases](https://github.com/apache/openwhisk-wskdebug/releases) (linked to source history)
Review comment:
I updated the description of each wrt to signatures: https://github.com/apache/openwhisk-wskdebug/pull/50/commits/d6b07a4e6307a23cb81133e4981ebefbd04306a5
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [openwhisk-wskdebug] dgrove-oss commented on a change in pull
request #50: add "Releasing" section to readme
Posted by GitBox <gi...@apache.org>.
dgrove-oss commented on a change in pull request #50: add "Releasing" section to readme
URL: https://github.com/apache/openwhisk-wskdebug/pull/50#discussion_r408452143
##########
File path: README.md
##########
@@ -689,6 +690,16 @@ See also [invoker.js](src/invoker.js). Note that some of these might not be set
Contributions are welcomed! Read the [Contributing Guide](.github/CONTRIBUTING.md) for more information.
+<a name="releasing"></a>
+## Releasing
+
+Releases are done using the [Apache OpenWhisk Release Process](https://github.com/apache/openwhisk-release/blob/master/docs/release_instructions.md).
+
+`wskdebug` releases are available:
+- on the [Apache OpenWhisk download page](https://openwhisk.apache.org/downloads), stored on Apache mirrors (canonical release)
+- on NPM as [@openwhisk/wskdebug](https://www.npmjs.com/package/@openwhisk/wskdebug) (convenience)
+- as [Github Releases](https://github.com/apache/openwhisk-wskdebug/releases) (linked to source history)
Review comment:
github "releases" aren't signed with the release manager's PGP key so they aren't as verifiable (https://infra.apache.org/release-signing.html for way more detail)
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [openwhisk-wskdebug] alexkli commented on a change in pull request
#50: add "Releasing" section to readme
Posted by GitBox <gi...@apache.org>.
alexkli commented on a change in pull request #50: add "Releasing" section to readme
URL: https://github.com/apache/openwhisk-wskdebug/pull/50#discussion_r408449769
##########
File path: README.md
##########
@@ -689,6 +690,16 @@ See also [invoker.js](src/invoker.js). Note that some of these might not be set
Contributions are welcomed! Read the [Contributing Guide](.github/CONTRIBUTING.md) for more information.
+<a name="releasing"></a>
+## Releasing
+
+Releases are done using the [Apache OpenWhisk Release Process](https://github.com/apache/openwhisk-release/blob/master/docs/release_instructions.md).
+
+`wskdebug` releases are available:
+- on the [Apache OpenWhisk download page](https://openwhisk.apache.org/downloads), stored on Apache mirrors (canonical release)
+- on NPM as [@openwhisk/wskdebug](https://www.npmjs.com/package/@openwhisk/wskdebug) (convenience)
+- as [Github Releases](https://github.com/apache/openwhisk-wskdebug/releases) (linked to source history)
Review comment:
Note this section is geared towards the release manager, not users. This comes at the very end, and install instructions at the top only mention npm.
BTW, how would an attacker tamper with github releases? If they can do that, they can also mess with the sources that are used to create all the releases.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [openwhisk-wskdebug] alexkli merged pull request #50: add
"Releasing" section to readme
Posted by GitBox <gi...@apache.org>.
alexkli merged pull request #50: add "Releasing" section to readme
URL: https://github.com/apache/openwhisk-wskdebug/pull/50
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [openwhisk-wskdebug] alexkli commented on a change in pull request
#50: add "Releasing" section to readme
Posted by GitBox <gi...@apache.org>.
alexkli commented on a change in pull request #50: add "Releasing" section to readme
URL: https://github.com/apache/openwhisk-wskdebug/pull/50#discussion_r408475674
##########
File path: README.md
##########
@@ -689,6 +690,16 @@ See also [invoker.js](src/invoker.js). Note that some of these might not be set
Contributions are welcomed! Read the [Contributing Guide](.github/CONTRIBUTING.md) for more information.
+<a name="releasing"></a>
+## Releasing
+
+Releases are done using the [Apache OpenWhisk Release Process](https://github.com/apache/openwhisk-release/blob/master/docs/release_instructions.md).
+
+`wskdebug` releases are available:
+- on the [Apache OpenWhisk download page](https://openwhisk.apache.org/downloads), stored on Apache mirrors (canonical release)
+- on NPM as [@openwhisk/wskdebug](https://www.npmjs.com/package/@openwhisk/wskdebug) (convenience)
+- as [Github Releases](https://github.com/apache/openwhisk-wskdebug/releases) (linked to source history)
Review comment:
I know, but still: if I can mess with the sources, that will also go into the signed apache releases. The PGP signature doesn't help if the content is already compromised beforehand.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services