Skip to content

v0.6.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Aug 10:34
· 34 commits to main since this release
v0.6.1
531912a

English

Added

  • Add the v1 signed release manifest protocol: canonical JSON encoding, strict parsing, Ed25519 key_id derivation, single-signature and rotation double-signature support, an embedded trusted public keyring, and the sign-release tool that reads private key seeds only from the JAVDB_RELEASE_ED25519_PRIVATE_KEYS environment variable without writing or printing secrets. (7b86f8a)

Changed

  • Verify release updates with the signed manifest instead of executing the candidate binary: bind repository, release tag and platform, check the archive and the extracted binary SHA-256, and keep the current executable unchanged on any failure. The candidate binary is never executed. (7e2c061)
  • Publish each release with release-manifest.json and release-manifest.sig generated only from the verified production archives in the protected release environment, and derive the compatible checksums.txt from the manifest for Homebrew, v0.6.0 updaters and manual verification. The release signing key is embedded in the client keyring. (7e2c061, 258148a, c7f1c97)

Maintenance

  • Document the Ed25519 release-key runbook: generation, rotation with dual signatures, revocation, and the lifecycle of the JAVDB_RELEASE_ED25519_PRIVATE_KEYS secret in the protected GitHub release environment. (7e2c061)
  • Release audit records direct commits in the report for manual review instead of hard-failing, so bridge releases pushed without pull requests can still be published. (895fef2)

Full Changelog: v0.6.0...v0.6.1

简体中文

新增

  • 新增 v1 签名发布清单协议：规范 JSON 编码、严格解析、Ed25519 key_id 派生、单签与轮换双签支持、内置受信公钥环，以及只从 JAVDB_RELEASE_ED25519_PRIVATE_KEYS 环境变量读取私钥 seed、不写盘不打印 secret 的 sign-release 签名工具。(7b86f8a)

变更

  • 发布更新改用签名清单验证，不再执行候选二进制：绑定仓库、Release tag 与平台，校验归档与解包二进制的 SHA-256，任何失败都保持现有可执行文件不变；候选二进制绝不执行。(7e2c061)
  • 每次发布新增由已验证 production archives 在受保护的 release environment 中生成的 release-manifest.json 与 release-manifest.sig，并由清单派生兼容的 checksums.txt 供 Homebrew、v0.6.0 更新器与人工校验使用。发布签名密钥内置在客户端公钥环中。(7e2c061、258148a、c7f1c97)

维护

  • 补充 Ed25519 发布密钥 runbook：生成、双签轮换、撤销，以及 JAVDB_RELEASE_ED25519_PRIVATE_KEYS 在受保护 GitHub release environment 中的生命周期说明。(7e2c061)
  • 发布审计把直接 commit 记录在报告中供人工核对，不再硬性失败，使未经过 PR 的 bridge 发布仍可发布。(895fef2)

完整变更记录：v0.6.0...v0.6.1

Assets 11
Loading