diff --git a/.fulmen/app.yaml b/.fulmen/app.yaml index 349a0f4..0ae3d7f 100644 --- a/.fulmen/app.yaml +++ b/.fulmen/app.yaml @@ -12,6 +12,6 @@ app: # Config file name (without extension); resolves to ~/.config/3leaps/decernor.yaml. config_name: decernor description: "Local key-material hygiene and readiness checks" - version: "0.1.3" + version: "0.1.4" metadata: repository_category: cli diff --git a/CHANGELOG.md b/CHANGELOG.md index 0efd569..b6e610b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +## [0.1.4] - 2026-08-20 + +Signed cut. Same two-phase provenance walk as v0.1.3. Toolchain and +landing-page notes catch up; no new CLI verbs. + ### Changed - README provenance story describes the signed two-phase cut and the @@ -68,5 +73,6 @@ release is the intended publish shape for this cut. - Upstream baseline changelog and release-note history inherited from the template. +[0.1.4]: https://github.com/3leaps/decernor/releases/tag/v0.1.4 [0.1.3]: https://github.com/3leaps/decernor/releases/tag/v0.1.3 [0.1.2]: https://github.com/3leaps/decernor/releases/tag/v0.1.2 diff --git a/README.md b/README.md index 58a4658..3a32cb3 100644 --- a/README.md +++ b/README.md @@ -237,7 +237,7 @@ Inserter: [`keys/README.md`](keys/README.md). ## Verify a signed release Consume fingerprints, not secrets. Per-cut commands live in -[`docs/releases/v0.1.3.md`](docs/releases/v0.1.3.md). +[`docs/releases/v0.1.4.md`](docs/releases/v0.1.4.md). Download the release assets (archives, signed SUMS, exported publics, staged pin pair). Verify SUMS signatures, then: diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index 7d60b67..e802f5b 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -1,19 +1,25 @@ # Release Notes Landing page for the latest Decernor cut. Per-cut payload: -[`docs/releases/v0.1.3.md`](docs/releases/v0.1.3.md). +[`docs/releases/v0.1.4.md`](docs/releases/v0.1.4.md). -## v0.1.3 — 2026-08-18 +## v0.1.4 — 2026-08-20 + +Signed cut. Same two-phase walk as v0.1.3: tag, then `make release` on an +operator host. Pins in `keys/expected-fingerprints.txt` are produced by +`decernor fingerprint` (not hand-typed) and copied into `dist/release/` +**before** checksums. -First **signed** private release. Pins in `keys/expected-fingerprints.txt` -are produced by `decernor fingerprint` (not hand-typed) and copied into -`dist/release/` **before** checksums, then signed with the rest of the -payload. +CI and Release run `goneat-tools-runner-glibc:v0.5.2` (goneat `v0.5.16`). +The README provenance story matches that walk. Signing uses `DECERNOR_*` environment variables only. No key paths live in this repository. -Still private. Draft GitHub release until a maintainer undrafts. +## v0.1.3 — 2026-08-18 + +First signed cut. The repository was private for that tag. See +[`docs/releases/v0.1.3.md`](docs/releases/v0.1.3.md). ## v0.1.2 — 2026-08-18 diff --git a/VERSION b/VERSION index b1e80bb..845639e 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.1.3 +0.1.4 diff --git a/docs/releases/README.md b/docs/releases/README.md index a0cecc1..13b36b8 100644 --- a/docs/releases/README.md +++ b/docs/releases/README.md @@ -2,5 +2,6 @@ Per-cut notes for tagged releases. Landing page: [`RELEASE_NOTES.md`](../../RELEASE_NOTES.md). -- [v0.1.3](v0.1.3.md) — first signed private cut +- [v0.1.4](v0.1.4.md) — signed cut; toolchain and provenance notes +- [v0.1.3](v0.1.3.md) — first signed cut - [v0.1.2](v0.1.2.md) — first tagged snapshot (unsigned) diff --git a/docs/releases/v0.1.3.md b/docs/releases/v0.1.3.md index d07f5f8..d87f68e 100644 --- a/docs/releases/v0.1.3.md +++ b/docs/releases/v0.1.3.md @@ -1,6 +1,6 @@ # v0.1.3 — 2026-08-18 -First **signed** private release. +First signed cut. The repository was private for this tag. Fingerprint pins are generated with `decernor fingerprint` on exported public files and staged into the checksum set before signing. Bindings @@ -10,11 +10,9 @@ are `DECERNOR_*` environment variables only. `fingerprint`/`fp`, `validate`, `readiness validate-config`, `version`, `envinfo`, `doctor`. -Still private. Do not treat an undrafted GitHub release as a public launch. +## Verify a signed release -## Verify a draft - -Download the draft assets: archives, `SHA256SUMS` / `SHA512SUMS` and their +Download the release assets: archives, `SHA256SUMS` / `SHA512SUMS` and their signatures, exported publics, and the staged pin pair (`expected-fingerprints.txt`, `expected-fingerprints.ndjson`). Check the signatures on the SUMS, then check the SUMS against the files. diff --git a/docs/releases/v0.1.4.md b/docs/releases/v0.1.4.md new file mode 100644 index 0000000..8449321 --- /dev/null +++ b/docs/releases/v0.1.4.md @@ -0,0 +1,37 @@ +# v0.1.4 — 2026-08-20 + +Signed cut. Same two-phase provenance walk as v0.1.3. + +**Shipped verbs** are unchanged: `scan`, `guardread`, `fingerprint`/`fp`, +`validate`, `readiness validate-config`, `version`, `envinfo`, `doctor`. + +This cut catches the landing-page provenance story up to the signed walk +and refreshes the CI toolchain (`goneat-tools-runner-glibc:v0.5.2`, +goneat `v0.5.16`). Direct `spf13/pflag` is `v1.0.10`. Indirect +`fulmenhq/crucible` is `v0.4.18`. + +Fingerprint pins are generated with `decernor fingerprint` on exported +public files and staged into the checksum set before signing. Bindings +are `DECERNOR_*` environment variables only. + +## Verify a signed release + +Download the assets: archives, `SHA256SUMS` / `SHA512SUMS` and their +signatures, exported publics, and the staged pin pair +(`expected-fingerprints.txt`, `expected-fingerprints.ndjson`). Check the +signatures on the SUMS, then check the SUMS against the files. + +Recompute fingerprints from the **exported publics** and compare them to +the two-line pin file. Do not hand-type hex. + +```sh +decernor fingerprint decernor-release-signing-key.asc \ + --class public --kind gpg --format json --path-mode none --gpg-role primary +decernor fingerprint decernor-minisign.pub \ + --class public --kind minisign --format json --path-mode none +``` + +The GPG primary fingerprint and the minisign public-blob SHA-256 must +match the `gpg` and `minisign` lines in `expected-fingerprints.txt`. +See `keys/README.md` and +`docs/decisions/PDR-0001-committed-signing-anchors.md`. diff --git a/internal/assets/appidentity/app.yaml b/internal/assets/appidentity/app.yaml index 349a0f4..0ae3d7f 100644 --- a/internal/assets/appidentity/app.yaml +++ b/internal/assets/appidentity/app.yaml @@ -12,6 +12,6 @@ app: # Config file name (without extension); resolves to ~/.config/3leaps/decernor.yaml. config_name: decernor description: "Local key-material hygiene and readiness checks" - version: "0.1.3" + version: "0.1.4" metadata: repository_category: cli