Skip to content

[llvm][release] On release page, explain package types and verification #138144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 14 commits into from
Jul 4, 2025
Merged

[llvm][release] On release page, explain package types and verification #138144

merged 14 commits into from
Jul 4, 2025

Conversation

@DavidSpickett
Copy link
Collaborator

@DavidSpickett DavidSpickett commented May 1, 2025 •
edited
Loading

Background: https://discourse.llvm.org/t/rfc-explaining-release-package-types-and-purposes/85985

So that users can understand which they should use, particularly for Windows. The original text about community builds is kept, after explaining the main release package formats.

In addition, explain how to use gpg or gh to verify the packages.

@DavidSpickett
[llvm][release] Describe types of release package
a8d2f10 
So that users can understand which they should use,
particularly for Windows.

The original text about community builds is kept as
the last part.
@DavidSpickett DavidSpickett requested review from tru, tstellar and zmodem May 1, 2025 15:05
@DavidSpickett DavidSpickett changed the title [llvm][release] Describe types of release package [llvm][release] Describe types of release package on the release page May 1, 2025
@github-actions
Copy link

github-actions bot commented May 1, 2025 •
edited
Loading

✅ With the latest revision this PR passed the Python code formatter.

DavidSpickett
DavidSpickett commented May 1, 2025
View reviewed changes
@DavidSpickett
Copy link
Collaborator Author

DavidSpickett commented May 1, 2025

We could also have links up front to the major platform's packages (since we can predict what the URL will be), which would save most people even reading this but I'll tackle that later maybe. See what people think of this first.

zmodem
zmodem reviewed May 6, 2025
View reviewed changes
@DavidSpickett
* Use same terminology for a few things like "binary release"
3007d26 
* Add reccomendation to windows part
* Add sub-title before sources types
@DavidSpickett
* Use {release} number in examples so they stay up to date.
1a0ede5 
* Reword Windows a bit.
zmodem
zmodem reviewed May 6, 2025
View reviewed changes
@DavidSpickett
* Combine the first two prefixes
04b6839 
* Fix typos in the Windows section
zmodem
zmodem approved these changes May 6, 2025
View reviewed changes
Copy link
Collaborator

@zmodem zmodem left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The text lgtm to me.

We should probably wait for tom or tobias to sign off since they're more familiar with the .py file itself.

@DavidSpickett
Copy link
Collaborator Author

DavidSpickett commented May 6, 2025

Yes this needs definitely needs a release manager's input.

@DavidSpickett
Copy link
Collaborator Author

DavidSpickett commented May 27, 2025

ping - @tstellar @tru

@DavidSpickett
Copy link
Collaborator Author

DavidSpickett commented Jun 17, 2025

Ping!

@tru
Copy link
Collaborator

tru commented Jun 30, 2025

Sorry for missing this. It looks good overall - but I wonder if we want to add something about the gpg files and that people should verified signed packages.

@DavidSpickett
Copy link
Collaborator Author

DavidSpickett commented Jul 1, 2025

I see there are signature files but I think I need to download a public key from somewhere to verify it. Is there one for llvm or is it the release manager's? As https://llvm.org/docs/HowToReleaseLLVM.html#tagging-the-llvm-release-candidates suggests.

@tru
Copy link
Collaborator

tru commented Jul 1, 2025

I see there are signature files but I think I need to download a public key from somewhere to verify it. Is there one for llvm or is it the release manager's? As https://llvm.org/docs/HowToReleaseLLVM.html#tagging-the-llvm-release-candidates suggests.

Pretty sure we linked to our keys in the old release text. You can find them on https://releases.llvm.org/

@DavidSpickett DavidSpickett changed the title [llvm][release] Describe types of release package on the release page [llvm][release] On release page, explain package types and verification Jul 1, 2025
@DavidSpickett
Copy link
Collaborator Author

DavidSpickett commented Jul 1, 2025

Added gpg instructions. Might be missing some steps, I've not used it before.

DavidSpickett
DavidSpickett commented Jul 1, 2025
View reviewed changes
@DavidSpickett
Copy link
Collaborator Author

DavidSpickett commented Jul 2, 2025

Just realised that some come with a .sig, but others have a .jsonl. Working out how to use those ones.

@tru
Copy link
Collaborator

tru commented Jul 2, 2025

.jsonl comes from GitHub and you need to use "gh" to verify these.

https://cli.github.com/manual/gh_attestation_verify

@DavidSpickett
Copy link
Collaborator Author

DavidSpickett commented Jul 3, 2025

I've added instructions for using gh.

@tru
Copy link
Collaborator

tru commented Jul 3, 2025

LGTM

@DavidSpickett DavidSpickett merged commit 25f05c0 into llvm:main Jul 4, 2025
5 of 8 checks passed
@DavidSpickett DavidSpickett deleted the release-types branch July 4, 2025 08:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tru tru tru approved these changes

@zmodem zmodem zmodem approved these changes

@tstellar tstellar Awaiting requested review from tstellar

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@DavidSpickett @tru @zmodem