From 3991ef8b71c3abf22afc01271a68fdc861000f08 Mon Sep 17 00:00:00 2001 From: Dave Thompson Date: Thu, 20 Aug 2026 12:08:11 -0400 Subject: [PATCH 1/2] chore(release): prepare v0.1.4 notes and identity Bump version identity to 0.1.4. Move Unreleased toolchain and provenance notes into this cut. Current docs drop forward-looking private-launch hedges; v0.1.3 notes stay historically honest. No visibility flip. Changes: - VERSION, app.yaml, and embedded identity to 0.1.4 - CHANGELOG, RELEASE_NOTES, and docs/releases/v0.1.4.md - Past-tense one-liner on the v0.1.3 notes Generated by Grok 4.6 via Grok Build under supervision of @3leapsdave Co-Authored-By: Grok 4.6 Role: devlead Committer-of-Record: Dave Thompson [@3leapsdave] --- .fulmen/app.yaml | 2 +- CHANGELOG.md | 6 +++++ RELEASE_NOTES.md | 20 +++++++++------ VERSION | 2 +- docs/releases/README.md | 3 ++- docs/releases/v0.1.3.md | 6 ++--- docs/releases/v0.1.4.md | 37 ++++++++++++++++++++++++++++ internal/assets/appidentity/app.yaml | 2 +- 8 files changed, 63 insertions(+), 15 deletions(-) create mode 100644 docs/releases/v0.1.4.md diff --git a/.fulmen/app.yaml b/.fulmen/app.yaml index 349a0f4..0ae3d7f 100644 --- a/.fulmen/app.yaml +++ b/.fulmen/app.yaml @@ -12,6 +12,6 @@ app: # Config file name (without extension); resolves to ~/.config/3leaps/decernor.yaml. config_name: decernor description: "Local key-material hygiene and readiness checks" - version: "0.1.3" + version: "0.1.4" metadata: repository_category: cli diff --git a/CHANGELOG.md b/CHANGELOG.md index 0efd569..b6e610b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +## [0.1.4] - 2026-08-20 + +Signed cut. Same two-phase provenance walk as v0.1.3. Toolchain and +landing-page notes catch up; no new CLI verbs. + ### Changed - README provenance story describes the signed two-phase cut and the @@ -68,5 +73,6 @@ release is the intended publish shape for this cut. - Upstream baseline changelog and release-note history inherited from the template. +[0.1.4]: https://github.com/3leaps/decernor/releases/tag/v0.1.4 [0.1.3]: https://github.com/3leaps/decernor/releases/tag/v0.1.3 [0.1.2]: https://github.com/3leaps/decernor/releases/tag/v0.1.2 diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index 7d60b67..e802f5b 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -1,19 +1,25 @@ # Release Notes Landing page for the latest Decernor cut. Per-cut payload: -[`docs/releases/v0.1.3.md`](docs/releases/v0.1.3.md). +[`docs/releases/v0.1.4.md`](docs/releases/v0.1.4.md). -## v0.1.3 — 2026-08-18 +## v0.1.4 — 2026-08-20 + +Signed cut. Same two-phase walk as v0.1.3: tag, then `make release` on an +operator host. Pins in `keys/expected-fingerprints.txt` are produced by +`decernor fingerprint` (not hand-typed) and copied into `dist/release/` +**before** checksums. -First **signed** private release. Pins in `keys/expected-fingerprints.txt` -are produced by `decernor fingerprint` (not hand-typed) and copied into -`dist/release/` **before** checksums, then signed with the rest of the -payload. +CI and Release run `goneat-tools-runner-glibc:v0.5.2` (goneat `v0.5.16`). +The README provenance story matches that walk. Signing uses `DECERNOR_*` environment variables only. No key paths live in this repository. -Still private. Draft GitHub release until a maintainer undrafts. +## v0.1.3 — 2026-08-18 + +First signed cut. The repository was private for that tag. See +[`docs/releases/v0.1.3.md`](docs/releases/v0.1.3.md). ## v0.1.2 — 2026-08-18 diff --git a/VERSION b/VERSION index b1e80bb..845639e 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.1.3 +0.1.4 diff --git a/docs/releases/README.md b/docs/releases/README.md index a0cecc1..13b36b8 100644 --- a/docs/releases/README.md +++ b/docs/releases/README.md @@ -2,5 +2,6 @@ Per-cut notes for tagged releases. Landing page: [`RELEASE_NOTES.md`](../../RELEASE_NOTES.md). -- [v0.1.3](v0.1.3.md) — first signed private cut +- [v0.1.4](v0.1.4.md) — signed cut; toolchain and provenance notes +- [v0.1.3](v0.1.3.md) — first signed cut - [v0.1.2](v0.1.2.md) — first tagged snapshot (unsigned) diff --git a/docs/releases/v0.1.3.md b/docs/releases/v0.1.3.md index d07f5f8..75db02e 100644 --- a/docs/releases/v0.1.3.md +++ b/docs/releases/v0.1.3.md @@ -1,6 +1,6 @@ # v0.1.3 — 2026-08-18 -First **signed** private release. +First signed cut. The repository was private for this tag. Fingerprint pins are generated with `decernor fingerprint` on exported public files and staged into the checksum set before signing. Bindings @@ -10,9 +10,7 @@ are `DECERNOR_*` environment variables only. `fingerprint`/`fp`, `validate`, `readiness validate-config`, `version`, `envinfo`, `doctor`. -Still private. Do not treat an undrafted GitHub release as a public launch. - -## Verify a draft +## Verify a signed release Download the draft assets: archives, `SHA256SUMS` / `SHA512SUMS` and their signatures, exported publics, and the staged pin pair diff --git a/docs/releases/v0.1.4.md b/docs/releases/v0.1.4.md new file mode 100644 index 0000000..8449321 --- /dev/null +++ b/docs/releases/v0.1.4.md @@ -0,0 +1,37 @@ +# v0.1.4 — 2026-08-20 + +Signed cut. Same two-phase provenance walk as v0.1.3. + +**Shipped verbs** are unchanged: `scan`, `guardread`, `fingerprint`/`fp`, +`validate`, `readiness validate-config`, `version`, `envinfo`, `doctor`. + +This cut catches the landing-page provenance story up to the signed walk +and refreshes the CI toolchain (`goneat-tools-runner-glibc:v0.5.2`, +goneat `v0.5.16`). Direct `spf13/pflag` is `v1.0.10`. Indirect +`fulmenhq/crucible` is `v0.4.18`. + +Fingerprint pins are generated with `decernor fingerprint` on exported +public files and staged into the checksum set before signing. Bindings +are `DECERNOR_*` environment variables only. + +## Verify a signed release + +Download the assets: archives, `SHA256SUMS` / `SHA512SUMS` and their +signatures, exported publics, and the staged pin pair +(`expected-fingerprints.txt`, `expected-fingerprints.ndjson`). Check the +signatures on the SUMS, then check the SUMS against the files. + +Recompute fingerprints from the **exported publics** and compare them to +the two-line pin file. Do not hand-type hex. + +```sh +decernor fingerprint decernor-release-signing-key.asc \ + --class public --kind gpg --format json --path-mode none --gpg-role primary +decernor fingerprint decernor-minisign.pub \ + --class public --kind minisign --format json --path-mode none +``` + +The GPG primary fingerprint and the minisign public-blob SHA-256 must +match the `gpg` and `minisign` lines in `expected-fingerprints.txt`. +See `keys/README.md` and +`docs/decisions/PDR-0001-committed-signing-anchors.md`. diff --git a/internal/assets/appidentity/app.yaml b/internal/assets/appidentity/app.yaml index 349a0f4..0ae3d7f 100644 --- a/internal/assets/appidentity/app.yaml +++ b/internal/assets/appidentity/app.yaml @@ -12,6 +12,6 @@ app: # Config file name (without extension); resolves to ~/.config/3leaps/decernor.yaml. config_name: decernor description: "Local key-material hygiene and readiness checks" - version: "0.1.3" + version: "0.1.4" metadata: repository_category: cli From e52e86710cbb2a4c9902807db4e5ba6eded13b56 Mon Sep 17 00:00:00 2001 From: Dave Thompson Date: Thu, 20 Aug 2026 12:12:46 -0400 Subject: [PATCH 2/2] docs: drop leftover draft wording in v0.1.3 notes Point the README verify recipe at the current cut. The v0.1.3 notes now say to download release assets, not draft assets. Generated by Grok 4.6 via Grok Build under supervision of @3leapsdave Co-Authored-By: Grok 4.6 Role: devlead Committer-of-Record: Dave Thompson [@3leapsdave] --- README.md | 2 +- docs/releases/v0.1.3.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 58a4658..3a32cb3 100644 --- a/README.md +++ b/README.md @@ -237,7 +237,7 @@ Inserter: [`keys/README.md`](keys/README.md). ## Verify a signed release Consume fingerprints, not secrets. Per-cut commands live in -[`docs/releases/v0.1.3.md`](docs/releases/v0.1.3.md). +[`docs/releases/v0.1.4.md`](docs/releases/v0.1.4.md). Download the release assets (archives, signed SUMS, exported publics, staged pin pair). Verify SUMS signatures, then: diff --git a/docs/releases/v0.1.3.md b/docs/releases/v0.1.3.md index 75db02e..d87f68e 100644 --- a/docs/releases/v0.1.3.md +++ b/docs/releases/v0.1.3.md @@ -12,7 +12,7 @@ are `DECERNOR_*` environment variables only. ## Verify a signed release -Download the draft assets: archives, `SHA256SUMS` / `SHA512SUMS` and their +Download the release assets: archives, `SHA256SUMS` / `SHA512SUMS` and their signatures, exported publics, and the staged pin pair (`expected-fingerprints.txt`, `expected-fingerprints.ndjson`). Check the signatures on the SUMS, then check the SUMS against the files.