Eric Ireland
b200459d8d
Add executable regression and sanitizer checks, a hardened release profile, CI, fork security and update policies, release notes, and ephemeral Docker development certificates. Assisted-by: OpenAI Codex (GPT-5) Reviewed-by: Eric Ireland
1.3 KiB
1.3 KiB
Importing upstream snac releases
The upstream remote is fetch-only. Do not push snacforge commits to it.
- Fetch tags and verify the proposed upstream release tag with GPG.
- Create a temporary branch at the verified upstream tag.
- Reapply each snacforge commit separately, resolving and reviewing conflicts.
- Use an unambiguous version such as
UPSTREAM-sf.N. - Run
make check,make check-sanitize, andmake releaseon the target production platform. - Test a disposable copy of production data and exercise HTTP, posting, media, federation, NodeInfo, queues, and socket behaviour.
- Review the complete upstream-to-release diff and update
CHANGELOG.md. - Create a signed
snacforge-UPSTREAM-sf.Ntag. Record the exact commit and release binary SHA-256 in the annotated tag message. - Push the reviewed branch and tag to
origin; deploy that exact binary only after retaining source, binary, and configuration rollback copies.
Sanitizer note
The inherited xs packed dictionary representation intentionally stores some
headers at byte offsets that UndefinedBehaviorSanitizer's alignment check
rejects. make check-sanitize explicitly disables that one check so it can run
AddressSanitizer and the remaining UndefinedBehaviorSanitizer checks. Revisit
this exception if upstream changes the container layout.