Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update pull_request_template.md to include another test plan check #31

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Update pull_request_template.md to include another test plan check #31

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
015b740
Update pull_request_template.md
sssoleileraaa Jun 2, 2022
d854445
add more details and reorganize test plan
Jun 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 25 additions & 7 deletions .github/pull_request_template.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,28 @@
###
Name of package:
## Description

Package being released: `securedrop-workstation-dom0-config x.y.z`
Package tag: https://github.com/freedomofpress/securedrop-workstation/releases/tag/x.y.z
Build logs: https://github.com/freedomofpress/build-logs/commit/1234
Prod signing key used to sign package and tag: https://github.com/freedomofpress/securedrop-workstation-prod-rpm-packages-lfs/blob/HEAD/pubkeys/prod.key

### Test plan
Release tracking issue: https://github.com/freedomofpress/securedrop-workstation/issues/1234

- [ ] Tag in securedrop-workstation repository is correct: https://github.com/freedomofpress/securedrop-workstation/releases/tag/x.y.z
- [ ] Build logs are included: https://github.com/freedomofpress/build-logs/commit/1234
- [ ] CI is passing, the rpm is properly signed with the prod key
- [ ] Unsigned RPM after running `rpm --delsign` (in Debian Stable) on the signed RPM results in the checksum found in the build logs
## Checklist for PR owner

- [ ] Links in this PR template have been updated as required
- [ ] https://github.com/freedomofpress/securedrop-workstation-prod-rpm-packages-lfs/blob/HEAD/pubkeys/prod.key points to the correct prod signing key

## Checklist for reviewer
- [ ] CI is passing
- [ ] The build logs show that the tag is verified and signed with the prod signing key
- [ ] The build logs show that the tag is checked out and used to build the RPM
- [ ] The tag in the build logs is the correct tag: https://github.com/freedomofpress/securedrop-workstation/releases/tag/x.y.z
- [ ] The commits being released are what you expect (see https://github.com/freedomofpress/securedrop-workstation/compare/a.b.c...x.y.z)
- [ ] The build logs show that the RPM is signed with the prod signing key
> * Download the signed RPM from this PR
> * Run `rpm qi <signed-rpm>` to get the KEY ID
> * Run `gpg -k <KEY ID>` to verify that it matches the prod signing key (make sure you have the prod signing key referenced in the PR description in your GPG keyring)
- [ ] The Unsigned RPM checksum matches what's in the build logs
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TODO: I need to update this to include a note about checking the checksum on an OS that matches the OS in which it was built. @L3th3 - any recommended details you think I should add about this?

> * Download the signed RPM from this PR (if you haven't already)
> * Run `rpm --delsign <signed-rpm>` to remove the signature
> * Run `sha256sum <unsigned-rpm>` and compare