@@ -566,21 +566,19 @@ Authenticated services involved:
566
566
# ## Package validation and publication
567
567
568
568
Once built on `main` (or other branches), the conda packages are uploaded to an intermediary channel named `cf-staging`.
569
- From there, the packages are downloaded by the validation server and, if successful, copied over to `conda-forge` itself.
569
+ From there, our webservices ( `conda-forge/conda-forge-webservices`) does the following :
570
570
571
- - The validation logic is defined at `conda-forge/artifact-validation`
572
- - If problematic, the results of the validation are posted as issues in the same repo.
573
- - This logic runs at `conda-forge/conda-forge-webservices`.
574
- This web app also copies the artifacts from `cf-staging` to `conda-forge`.
575
- - Part of the validation includes checking for cross-package clobbering.
576
- The list of authorized feedstocks per package name is maintained at `conda-forge/feedstock-outputs`.
577
- - Some further analysis might be performed _after_ publication.
571
+ - The logic checks the feedstock token to authenticate a legitimate request.
572
+ - The logic checks that the hash sum of the package on `cf-staging` against
573
+ the value computed in the CI to ensure the artifact to be copied is the same.
574
+ - The logic checks that the feedstock is allowed to push the package using
575
+ the `conda-forge/feedstock-outputs` repo.
576
+ - If all three checks pass, the webservices copies the artifacts from `cf-staging` to `conda-forge`.
578
577
579
578
Authenticated services involved :
580
579
581
- - Anaconda.org uploads to `conda-forge`
580
+ - Anaconda.org uploads to `conda-forge` and `cf-staging`
582
581
- The `conda-forge-webservices` app deployment itself (currently at Heroku)
583
- - (?) Post new issues to `conda-forge/artifact-validation`
584
582
585
583
# ## Post-publication
586
584
0 commit comments