57 lines
2.2 KiB
Markdown
57 lines
2.2 KiB
Markdown
# Releasing ForgeFlow
|
|
|
|
ForgeFlow releases are built only from a clean, reviewed commit on Node 22 LTS.
|
|
|
|
## Quality gate
|
|
|
|
```powershell
|
|
npm ci
|
|
npm run quality
|
|
npm audit --omit=dev --audit-level=high
|
|
```
|
|
|
|
## Windows build — no paid services required
|
|
|
|
ForgeFlow is a personal/internal tool. The supported release path therefore has
|
|
no certificate, Azure or other paid-service dependency:
|
|
|
|
```powershell
|
|
npm run dist:win
|
|
```
|
|
|
|
Run `npm run signing:setup` once on the release workstation. It stores the
|
|
private Ed25519 key outside the repository and writes only its public key into
|
|
the packaged app. `npm run dist:win` then produces the installer and portable
|
|
executable, SHA-256 sidecars, CycloneDX SBOM, provenance and an Ed25519-signed
|
|
manifest bound to the exact source commit. The updater verifies the pinned
|
|
publisher key before trusting the artifact digest and verifies that digest again
|
|
immediately before replacing the installed executable.
|
|
|
|
Windows can display an `Unknown publisher` warning for an unsigned installer.
|
|
That warning concerns public publisher reputation; it does not prevent ForgeFlow
|
|
from installing or using its checksum-verified in-app updates. Authenticode can
|
|
be added later as an optional distribution convenience, but is not required for
|
|
correct operation.
|
|
|
|
## Atomic publication
|
|
|
|
`npm run release:binary` keeps the Gitea release in draft state while uploading
|
|
the installer, portable executable, two checksums, provenance, SBOM, signed
|
|
manifest and signature. It only publishes after all eight assets are present. A
|
|
failed upload leaves a draft rather than exposing an incomplete updater target.
|
|
|
|
The optional signing acceptance fixture can still validate the complete local
|
|
Authenticode chain without purchasing or retaining a certificate:
|
|
|
|
```powershell
|
|
npm run test:signing
|
|
```
|
|
|
|
This disposable fixture signs installer, portable, update-helper and uninstaller
|
|
stand-ins, requires an RFC 3161 timestamp, and proves rejection of a missing
|
|
timestamp, wrong publisher and a modified binary. Its certificate is removed
|
|
from the current-user certificate store after the test.
|
|
|
|
The disposable test certificate is removed from the current-user certificate
|
|
store after the test and is never used for a published build.
|