feat(release): Add Stable 1.0 maintenance path#1384
Conversation
Implement PR-285 with one fail-closed certification and protected publication path for Stable 1.0 maintenance releases and security hotfixes.\n\nAuthenticate the GA root and predecessor lineage, freeze exact candidate and package bytes, enforce compatibility and production evidence, publish through an attested backend, and activate deterministic successor baselines. Add CoreUpdater, catalog-signature, packaging, workflow, schema, test, documentation, and repository-skill support for the complete path.
Document the protected maintenance phase handoffs, exact-byte packaging and publication boundaries, and backend verification contract.\n\nAlign catalog, app, hotfix follow-up, CoreUpdater, release-note, and repository skill guidance with the implemented Stable 1.0 maintenance path.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 35ded2e9cf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Preserve the fixed repository/tag URL exemption during concrete publication destination validation while retaining resolved-address checks for configurable targets. Add an offline-DNS regression covering the full target set.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 27337560ec
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
1 participant
Summary
stable-maintenancecertification command for routine maintenance and critical security hotfixes, with closed policies and schemas, authenticated Stable GA and predecessor lineage, exact candidate identity, authorization, publication receipts, successor baselines, and release historyRelease-safety boundaries
v<build-number>tags; no semantic project versions are introducedleumorGitHub identity, an authenticated backend wheel, fresh remote-ref/predecessor/authorization checks, and exact public-state verificationValidation
python3 tools/release-certification/certify.py stable-maintenance --self-test: 169 tests passedpython3 tools/release-certification/certify.py app-platform-docs --self-test: passed./gradlew check: passed./gradlew :platform-devtools:test --tests '*CryptaAppCliTest': passed./gradlew verifyMacAppImageSigningArguments verifyWindowsExeInstallerArguments: passedgit diff --checkvalidation: passedProtected checks not executed locally
Real Developer ID signing/notarization, Windows Authenticode signing, multi-OS release packaging, protected catalog or CoreUpdater insertion, live production-network validation, GitHub Release mutation, public artifact publication, and latest-baseline activation remain environment-approved operations. Offline fixtures and boundary mocks exercise these paths without performing public side effects.