release

Overview ¶

Command release makes and checks signed Hatamoto releases. It is a dev and CI tool and is never linked into the hatamoto binary. Run from backend/:

go run ./tools/release keygen --kind release|manifest --out DIR
go run ./tools/release record --version v1.2.3 --kind patch --facts facts.json \
    --rollback-floor v1.2.0 --min-from v1.0.0 --notes-url URL --dir dist --out release.json
go run ./tools/release record --check release.json [--dir dist] [--allow-same]
go run ./tools/release record --amend release.json [--security] [--kind K] [--rollback-floor V] [--min-from V]
go run ./tools/release sign-record release.json (--key FILE | --agent [--agent-key ID]) [--allow-same]
go run ./tools/release channel add|ramp|halt|unhalt|yank CHAN VERSION [flags]
go run ./tools/release channel resign --channel CHAN --out DIR --key FILE
go run ./tools/release verify --chan stable --manifest channel.json
go run ./tools/release verify --chan edge --record release.json --sig release.json.sig --dir DIR [--version vX.Y.Z]
go run ./tools/release verify --chan stable --channel channel.json --record release.json \
    --sig release.json.sig --artifact FILE --platform linux-amd64

Release keys are used from a file or an ssh-agent; the manifest key is only ever used by CI. Nothing here touches the network.