From 3b37d4b4e4714d4e7f4d2497db2087168da44561 Mon Sep 17 00:00:00 2001 From: Fedor Indutny Date: Fri, 22 Jul 2016 21:40:27 -0400 Subject: [PATCH 1/3] doc: use `git-secure-tag` for release tags `git-secure-tag` recursively constructs an SHA-512 digest out of the git tree, and puts the hash from the tree's root into the tag annotation. This hash provides better integrity guarantees than the default SHA-1 merkle tree that git uses. Fix: #7579 --- doc/releases.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/doc/releases.md b/doc/releases.md index b5e57d1251747c..4cf62e943cce33 100644 --- a/doc/releases.md +++ b/doc/releases.md @@ -216,10 +216,16 @@ Once you have produced builds that you're happy with, create a new tag. By waiti Tag summaries have a predictable format, look at a recent tag to see, `git tag -v v6.0.0`. The message should look something like `2016-04-26 Node.js v6.0.0 (Current) Release`. +Install `git-secure-tag` npm module: + +``` +$ npm install -g git-secure-tag +``` + Create a tag using the following command: ```sh -$ git tag -sm 'YYYY-MM-DD Node.js vx.y.z (Release Type) Release' +$ git secure-tag -sm 'YYYY-MM-DD Node.js vx.y.z (Release Type) Release' ``` The tag **must** be signed using the GPG key that's listed for you on the project README. From db4a23f660ba1a1d650955c163c0f0538ee49e89 Mon Sep 17 00:00:00 2001 From: Fedor Indutny Date: Fri, 22 Jul 2016 21:49:35 -0400 Subject: [PATCH 2/3] ... --- doc/releases.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/releases.md b/doc/releases.md index 4cf62e943cce33..59b3b324f9ef33 100644 --- a/doc/releases.md +++ b/doc/releases.md @@ -218,7 +218,7 @@ Tag summaries have a predictable format, look at a recent tag to see, `git tag - Install `git-secure-tag` npm module: -``` +```sh $ npm install -g git-secure-tag ``` From 26db5e7c52965ffba1125aae43ab5e3497c4b7eb Mon Sep 17 00:00:00 2001 From: Fedor Indutny Date: Fri, 5 Aug 2016 06:57:11 +0200 Subject: [PATCH 3/3] ... --- doc/releases.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/releases.md b/doc/releases.md index 59b3b324f9ef33..25cdb56a4791de 100644 --- a/doc/releases.md +++ b/doc/releases.md @@ -218,7 +218,7 @@ Tag summaries have a predictable format, look at a recent tag to see, `git tag - Install `git-secure-tag` npm module: -```sh +```console $ npm install -g git-secure-tag ```