Skip to content

v0.7.2

Choose a tag to compare

View all tags
@MountainUnicorn MountainUnicorn released this 12 Apr 23:33
· 133 commits to main since this release
v0.7.2
682c743

First cryptographically signed release. Maintainer GPG key provisioned and published.

Added

  • scripts/release.sh — release helper that enforces clean tree, version/tag match, frontmatter validation, compile-drift check, signing-key presence, tag uniqueness, and CHANGELOG section presence before tagging. Extracts release notes from CHANGELOG. Supports --dry-run and --draft.
  • docs/release-signing.md — maintainer runbook for first-time setup, cutting a release, multi-machine key sharing, rotation, expiration, and pinentry/GPG_TTY troubleshooting.

Changed

  • SECURITY.md now carries the real maintainer fingerprint: 040C 002A B5A0 E552 46B3 5D2F 8C4D 8020 9306 6794 — RSA 4096, identity Anthony Brooke <anthony.g.brooke@gmail.com>. Documents that v0.7.0 and v0.7.1 predate signing and will not be retroactively re-tagged (re-tagging a published release rewrites history users may have installed).
  • Git config on the maintainer machine: tag.gpgsign = true (mandatory for releases); commit.gpgsign = false (opportunistic via git commit -S). Rationale: auto-signing commits blocks agent/CI sessions that can't interact with the GUI passphrase prompt. Tag signing is the verification anchor that matters per the threat model.

Verification

curl -fsSL https://github.com/MountainUnicorn.gpg | gpg --import
git tag --verify v0.7.2
# Expected: Good signature from "Anthony Brooke <anthony.g.brooke@gmail.com>"
Assets 2
Loading