Skip to content

Commit 1352653

Browse files
committed
🔒️ Signed releases, checksums & CONTRIBUTING.md
Signed-off-by: Peter H. Boling <[email protected]>
1 parent 216bee7 commit 1352653

File tree

5 files changed

+211
-9
lines changed

5 files changed

+211
-9
lines changed

CHANGELOG.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
[![SemVer 2.0.0][📌semver-img]][📌semver] [![Keep-A-Changelog 1.0.0][📗keep-changelog-img]][📗keep-changelog]
44

5-
All notable changes to this project will be documented in this file.
5+
All notable changes to this project after v1.1.0 will be documented in this file.
66

77
The format is based on [Keep a Changelog][📗keep-changelog],
88
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
@@ -20,12 +20,15 @@ Please file a bug if you notice a violation of semantic versioning.
2020

2121
### Added
2222

23+
- `CONTRIBUTING.md` file to help people find their way to contributing
2324
- `CHANGELOG.md` file to document notable changes in keep-a-changelog format
2425
- `Cyclonedx::BomHelpers` module to house helper methods, replacing global methods
2526
- `Cyclonedx::BomBuilder` class, replacing `Bombuilder` (note the capitalization change)
2627
- `Cyclonedx::BomComponent` class, replacing `BomComponent`
2728
- `Cyclonedx::Ruby::Version::VERSION` constant to hold the version number (also available as `Cyclonedx::VERSION`)
2829
- `Cyclonedx::Ruby::Deprecation` module to help manage deprecations
30+
- dev dependency: `stone_checksums`
31+
- For SHA-256 and SHA-512 checksum generation for each release.
2932

3033
### Changed
3134

@@ -66,5 +69,6 @@ Please file a bug if you notice a violation of semantic versioning.
6669

6770
- Initial release
6871

72+
[Unreleased]: https://gitlab.com/CycloneDX/cyclonedx-ruby-gem/-/compare/v1.1.0...HEAD
6973
[1.1.0]: https://github.com/CycloneDX/cyclonedx-ruby-gem/compare/eecfebe3cb0ce961fef8e424162ac94298f02a9f...v1.1.0
7074
[1.1.0t]: https://github.com/CycloneDX/cyclonedx-ruby-gem/releases/tag/v1.1.0

CONTRIBUTING.md

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
# Contributing
2+
3+
Any contribution is welcome.
4+
Please read the [CycloneDX contributing guidelines](https://github.com/CycloneDX/.github/blob/master/CONTRIBUTING.md) first.
5+
6+
Pull-requests from forks are welcome.
7+
We love to see your purposed changes, but we also like to discuss things first. Please open a [ticket][📜src-gh] and explain your intended changes to the community. And don't forget to mention that discussion in your pull-request later.
8+
Find the needed basics here:
9+
* [how to fork a repository](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/fork-a-repo)
10+
* [how create a pull request from a fork](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request-from-a-fork)
11+
* Remember to [![Keep A Changelog][📗keep-changelog-img]][📗keep-changelog] if you make changes.
12+
13+
## Setup
14+
15+
This project uses ruby. Have a recent version installed and setup first.
16+
17+
To install dev-dependencies and tools:
18+
19+
```shell
20+
bin/setup
21+
```
22+
23+
## Environment Variables for Local Development
24+
25+
Below are the primary environment variables recognized by stone_checksums (and its integrated tools). Unless otherwise noted, set boolean values to the string "true" to enable.
26+
27+
General/runtime
28+
- MIMIC_NEXT_MAJOR_VERSION: When set to true, simulates the next major version for testing breaking changes [📌semver-breaking] [📌major-versions-not-sacred] (default: false)
29+
- ARUBA_NO_COVERAGE: Disable SimpleCov coverage in Aruba tests (default: false)
30+
31+
Releasing and signing
32+
- SKIP_GEM_SIGNING: If set, skip gem signing during build/release
33+
- GEM_CERT_USER: Username for selecting your public cert in `certs/<USER>.pem` (defaults to $USER)
34+
35+
For a quick starting point, this repository’s `.envrc` shows sane defaults, and `.env.local` can override them locally.
36+
37+
## Testing
38+
39+
To run all tests
40+
41+
```console
42+
bundle exec rake test
43+
```
44+
45+
Or use the default task, which does the same
46+
47+
```console
48+
bundle exec rake
49+
```
50+
51+
### Spec organization (required)
52+
53+
- One spec file per class/module. For each class or module under `lib/`, keep all of its unit tests in a single spec file under `spec/` that mirrors the path and file name exactly: `lib/undrive_google/release_cli.rb` -> `spec/undrive_google/release_cli_spec.rb`.
54+
- Never add a second spec file for the same class/module. Examples of disallowed names: `*_more_spec.rb`, `*_extra_spec.rb`, `*_status_spec.rb`, or any other suffix that still targets the same class. If you find yourself wanting a second file, merge those examples into the canonical spec file for that class/module.
55+
- Exception: Integration specs that intentionally span multiple classes. Place these under `spec/integration/` (or a clearly named integration folder), and do not directly mirror a single class. Name them after the scenario, not a class.
56+
- Migration note: If a duplicate spec file exists, move all examples into the canonical file and delete the duplicate. Do not leave stubs or empty files behind.
57+
58+
## Lint It
59+
60+
Run the linter.
61+
62+
```console
63+
bundle exec rake rubocop
64+
```
65+
66+
### Important: Do not add inline RuboCop disables
67+
68+
Try not to add `# rubocop:disable ...` / `# rubocop:enable ...` comments to code or specs (except when following the few existing `rubocop:disable` patterns for a rule already being disabled elsewhere in the code). Instead:
69+
70+
- Prefer configuration-based exclusions when a rule should not apply to certain paths or files (e.g., via `.rubocop.yml`).
71+
- `bundle exec rubocop -a` (preferred)
72+
- `bundle exec rubocop --regenerate-todo` (only when you cannot fix the violations immediately)
73+
74+
As a general rule, fix style issues rather than ignoring them. For example, our specs should follow RSpec conventions like using `described_class` for the class under test.
75+
76+
## Sign off your commits
77+
78+
Please sign off your commits, to show that you agree to publish your changes under the current terms and licenses of the project
79+
, and to indicate agreement with [Developer Certificate of Origin (DCO)](https://developercertificate.org/).
80+
81+
```shell
82+
git commit --signed-off ...
83+
```
84+
85+
## Contributors
86+
87+
Your picture could be here!
88+
89+
[![Contributors][🖐contributors-img]][🖐contributors]
90+
91+
Made with [contributors-img][🖐contrib-rocks].
92+
93+
## For Maintainers
94+
95+
### One-time, Per-maintainer, Setup
96+
97+
**IMPORTANT**: To sign a build,
98+
a public key for signing gems will need to be picked up by the line in the
99+
`gemspec` defining the `spec.cert_chain` (check the relevant ENV variables there).
100+
All releases after v1.1.0 are signed releases.
101+
See: [RubyGems Security Guide][🔒️rubygems-security-guide]
102+
103+
NOTE: To build without signing the gem set `SKIP_GEM_SIGNING` to any value in the environment. Only do this for testing.
104+
105+
### To release a new version:
106+
107+
#### Automated process
108+
109+
Coming Soon!
110+
111+
#### Manual process
112+
113+
1. Run `bin/setup && bin/rake` as a "test, coverage, & linting" sanity check
114+
2. Update the version number in `version.rb`, and ensure `CHANGELOG.md` reflects changes
115+
3. Run `bin/setup && bin/rake` again as a secondary check, and to update `Gemfile.lock`
116+
4. Run `git commit -am "🔖 Prepare release v<VERSION>"` to commit the changes
117+
5. Run `git push` to trigger the final CI pipeline before release, and merge PRs
118+
- NOTE: Remember to [check the build][🧪build].
119+
6. Run `export GIT_TRUNK_BRANCH_NAME="$(git remote show origin | grep 'HEAD branch' | cut -d ' ' -f5)" && echo $GIT_TRUNK_BRANCH_NAME`
120+
7. Run `git checkout $GIT_TRUNK_BRANCH_NAME`
121+
8. Run `git pull origin $GIT_TRUNK_BRANCH_NAME` to ensure latest trunk code
122+
9. Optional for older Bundler (< 2.7.0): Set `SOURCE_DATE_EPOCH` so `rake build` and `rake release` use the same timestamp and generate the same checksums
123+
- If your Bundler is >= 2.7.0, you can skip this; builds are reproducible by default.
124+
- Run `export SOURCE_DATE_EPOCH=$EPOCHSECONDS && echo $SOURCE_DATE_EPOCH`
125+
- If the echo above has no output, then it didn't work.
126+
- Note: `zsh/datetime` module is needed, if running `zsh`.
127+
- In older versions of `bash` you can use `date +%s` instead, i.e. `export SOURCE_DATE_EPOCH=$(date +%s) && echo $SOURCE_DATE_EPOCH`
128+
10. Run `bundle exec rake build`
129+
11. Run `bundle exec rake release` which will create a git tag for the version,
130+
push git commits and tags, and push the `.gem` file to the gem host configured in the gemspec.
131+
12. Run `bin/gem_checksums` (more context [1][🔒️rubygems-checksums-pr], [2][🔒️rubygems-guides-pr])
132+
to create SHA-256 and SHA-512 checksums. This functionality is provided by the `stone_checksums`
133+
[gem][💎stone_checksums].
134+
- The script automatically commits but does not push the checksums
135+
13. Sanity check the SHA256, comparing with the output from the `bin/gem_checksums` command:
136+
- `sha256sum pkg/<gem name>-<version>.gem`
137+
138+
[📜src-gh]: https://github.com/CycloneDX/cyclonedx-ruby-gem
139+
[🧪build]: https://github.com/CycloneDX/cyclonedx-ruby-gem/actions
140+
[🤝conduct]: https://gitlab.com/CycloneDX/cyclonedx-ruby-gem/-/blob/main/CODE_OF_CONDUCT.md
141+
[🖐contrib-rocks]: https://contrib.rocks
142+
[🖐contributors]: https://github.com/CycloneDX/cyclonedx-ruby-gem/graphs/contributors
143+
[🖐contributors-img]: https://contrib.rocks/image?repo=CycloneDX/cyclonedx-ruby-gem
144+
[💎gem-coop]: https://gem.coop
145+
[🔒️rubygems-security-guide]: https://guides.rubygems.org/security/#building-gems
146+
[🔒️rubygems-checksums-pr]: https://github.com/rubygems/rubygems/pull/6022
147+
[🔒️rubygems-guides-pr]: https://github.com/rubygems/guides/pull/325
148+
[💎stone_checksums]: https://github.com/galtzo-floss/stone_checksums
149+
[📗keep-changelog]: https://keepachangelog.com/en/1.0.0/
150+
[📗keep-changelog-img]: https://img.shields.io/badge/keep--a--changelog-1.0.0-FFDD67.svg?style=flat
151+
[📌semver-breaking]: https://github.com/semver/semver/issues/716#issuecomment-869336139
152+
[📌major-versions-not-sacred]: https://tom.preston-werner.com/2022/05/23/major-version-numbers-are-not-sacred.html
153+
[🏃‍♂️runner-tool-cache]: https://github.com/ruby/ruby-builder/releases/tag/toolcache

Gemfile.lock

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ PATH
1111
GEM
1212
remote: https://rubygems.org/
1313
specs:
14-
activesupport (7.2.2.2)
14+
activesupport (7.2.3)
1515
base64
1616
benchmark (>= 0.3)
1717
bigdecimal
@@ -90,13 +90,9 @@ GEM
9090
mime-types-data (~> 3.2025, >= 3.2025.0507)
9191
mime-types-data (3.2025.0924)
9292
mini_mime (1.1.5)
93-
mini_portile2 (2.8.9)
9493
minitest (5.26.0)
9594
multi_test (1.1.0)
9695
netrc (0.11.0)
97-
nokogiri (1.18.10)
98-
mini_portile2 (~> 2.8.2)
99-
racc (~> 1.4)
10096
nokogiri (1.18.10-aarch64-linux-gnu)
10197
racc (~> 1.4)
10298
nokogiri (1.18.10-aarch64-linux-musl)
@@ -115,13 +111,13 @@ GEM
115111
racc (~> 1.4)
116112
ostruct (0.5.5)
117113
parallel (1.27.0)
118-
parser (3.3.9.0)
114+
parser (3.3.10.0)
119115
ast (~> 2.4.1)
120116
racc
121117
prism (1.6.0)
122118
racc (1.8.1)
123119
rainbow (3.1.1)
124-
rake (13.3.0)
120+
rake (13.3.1)
125121
regexp_parser (2.11.3)
126122
rest-client (2.1.0)
127123
http-accept (>= 1.7.0, < 2.0)
@@ -163,6 +159,8 @@ GEM
163159
simplecov_json_formatter (~> 0.1)
164160
simplecov-html (0.13.2)
165161
simplecov_json_formatter (0.1.4)
162+
stone_checksums (1.0.3)
163+
version_gem (~> 1.1, >= 1.1.9)
166164
sys-uname (1.4.1)
167165
ffi (~> 1.1)
168166
memoist3 (~> 1.0.0)
@@ -172,14 +170,14 @@ GEM
172170
unicode-display_width (3.2.0)
173171
unicode-emoji (~> 4.1)
174172
unicode-emoji (4.1.0)
173+
version_gem (1.1.9)
175174

176175
PLATFORMS
177176
aarch64-linux-gnu
178177
aarch64-linux-musl
179178
arm-linux-gnu
180179
arm-linux-musl
181180
arm64-darwin
182-
ruby
183181
x86_64-darwin
184182
x86_64-linux-gnu
185183
x86_64-linux-musl
@@ -192,6 +190,7 @@ DEPENDENCIES
192190
rspec (~> 3.12)
193191
rubocop (~> 1.54)
194192
simplecov (~> 0.22.0)
193+
stone_checksums (~> 1.0, >= 1.0.3)
195194

196195
BUNDLED WITH
197196
2.7.2

certs/pboling.pem

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIEgDCCAuigAwIBAgIBATANBgkqhkiG9w0BAQsFADBDMRUwEwYDVQQDDAxwZXRl
3+
ci5ib2xpbmcxFTATBgoJkiaJk/IsZAEZFgVnbWFpbDETMBEGCgmSJomT8ixkARkW
4+
A2NvbTAeFw0yNTA1MDQxNTMzMDlaFw00NTA0MjkxNTMzMDlaMEMxFTATBgNVBAMM
5+
DHBldGVyLmJvbGluZzEVMBMGCgmSJomT8ixkARkWBWdtYWlsMRMwEQYKCZImiZPy
6+
LGQBGRYDY29tMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAruUoo0WA
7+
uoNuq6puKWYeRYiZekz/nsDeK5x/0IEirzcCEvaHr3Bmz7rjo1I6On3gGKmiZs61
8+
LRmQ3oxy77ydmkGTXBjruJB+pQEn7UfLSgQ0xa1/X3kdBZt6RmabFlBxnHkoaGY5
9+
mZuZ5+Z7walmv6sFD9ajhzj+oIgwWfnEHkXYTR8I6VLN7MRRKGMPoZ/yvOmxb2DN
10+
coEEHWKO9CvgYpW7asIihl/9GMpKiRkcYPm9dGQzZc6uTwom1COfW0+ZOFrDVBuV
11+
FMQRPswZcY4Wlq0uEBLPU7hxnCL9nKK6Y9IhdDcz1mY6HZ91WImNslOSI0S8hRpj
12+
yGOWxQIhBT3fqCBlRIqFQBudrnD9jSNpSGsFvbEijd5ns7Z9ZMehXkXDycpGAUj1
13+
to/5cuTWWw1JqUWrKJYoifnVhtE1o1DZ+LkPtWxHtz5kjDG/zR3MG0Ula0UOavlD
14+
qbnbcXPBnwXtTFeZ3C+yrWpE4pGnl3yGkZj9SMTlo9qnTMiPmuWKQDatAgMBAAGj
15+
fzB9MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdDgQWBBQE8uWvNbPVNRXZ
16+
HlgPbc2PCzC4bjAhBgNVHREEGjAYgRZwZXRlci5ib2xpbmdAZ21haWwuY29tMCEG
17+
A1UdEgQaMBiBFnBldGVyLmJvbGluZ0BnbWFpbC5jb20wDQYJKoZIhvcNAQELBQAD
18+
ggGBAJbnUwfJQFPkBgH9cL7hoBfRtmWiCvdqdjeTmi04u8zVNCUox0A4gT982DE9
19+
wmuN12LpdajxZONqbXuzZvc+nb0StFwmFYZG6iDwaf4BPywm2e/Vmq0YG45vZXGR
20+
L8yMDSK1cQXjmA+ZBKOHKWavxP6Vp7lWvjAhz8RFwqF9GuNIdhv9NpnCAWcMZtpm
21+
GUPyIWw/Cw/2wZp74QzZj6Npx+LdXoLTF1HMSJXZ7/pkxLCsB8m4EFVdb/IrW/0k
22+
kNSfjtAfBHO8nLGuqQZVH9IBD1i9K6aSs7pT6TW8itXUIlkIUI2tg5YzW6OFfPzq
23+
QekSkX3lZfY+HTSp/o+YvKkqWLUV7PQ7xh1ZYDtocpaHwgxe/j3bBqHE+CUPH2vA
24+
0V/FwdTRWcwsjVoOJTrYcff8pBZ8r2MvtAc54xfnnhGFzeRHfcltobgFxkAXdE6p
25+
DVjBtqT23eugOqQ73umLcYDZkc36vnqGxUBSsXrzY9pzV5gGr2I8YUxMqf6ATrZt
26+
L9nRqA==
27+
-----END CERTIFICATE-----

cyclonedx-ruby.gemspec

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,24 @@ Gem::Specification.new do |spec|
1414
spec.license = 'Apache-2.0'
1515
spec.required_ruby_version = '>= 2.7.0'
1616

17+
# Linux distros often package gems and securely certify them independent
18+
# of the official RubyGem certification process. Allowed via ENV["SKIP_GEM_SIGNING"]
19+
# Ref: https://gitlab.com/ruby-oauth/version_gem/-/issues/3
20+
# Hence, only enable signing if `SKIP_GEM_SIGNING` is not set in ENV.
21+
# See CONTRIBUTING.md
22+
unless ENV.include?("SKIP_GEM_SIGNING")
23+
user_cert = "certs/#{ENV.fetch("GEM_CERT_USER", ENV["USER"])}.pem"
24+
cert_file_path = File.join(__dir__, user_cert)
25+
cert_chain = cert_file_path.split(",")
26+
cert_chain.select! { |fp| File.exist?(fp) }
27+
if cert_file_path && cert_chain.any?
28+
spec.cert_chain = cert_chain
29+
if $PROGRAM_NAME.end_with?("gem") && ARGV[0] == "build"
30+
spec.signing_key = File.join(Gem.user_home, ".ssh", "gem-private_key.pem")
31+
end
32+
end
33+
end
34+
1735
spec.metadata["homepage_uri"] = "https://#{spec.name.tr('_', '-')}.galtzo.com/"
1836
spec.metadata["source_code_uri"] = "#{spec.homepage}/tree/v#{spec.version}"
1937
spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/v#{spec.version}/CHANGELOG.md"
@@ -68,4 +86,5 @@ Gem::Specification.new do |spec|
6886
spec.add_development_dependency 'aruba', '~> 2.2'
6987
spec.add_development_dependency 'simplecov', '~> 0.22.0'
7088
spec.add_development_dependency 'rubocop', '~> 1.54'
89+
spec.add_development_dependency 'stone_checksums', '~> 1.0', '>= 1.0.3'
7190
end

0 commit comments

Comments
 (0)