1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
|
Release process
===============
A release will be generated automatically for any version number tag
(of the form `v*`). Release notes will be extracted from the contents
of the relevant section in [`CHANGELOG.md`][changelog].
The reduced-feature Secure Boot binaries will be signed using the
[iPXE Secure Boot CA][ipxesbca] and may be booted on a system with
UEFI Secure Boot enabled using the [iPXE shim][ipxeshim].
Steps
-----
1. Edit the top-level [`Makefile`][makefile] to select values for
`VERSION_MAJOR`, `VERSION_MINOR`, and `VERSION_PATCH`, and to set
`EXTRAVERSION` to an empty string.
2. Edit [`CHANGELOG.md`][changelog] to create a section and link for
the new release.
3. Commit these changes with a message such as:
```
[release] Release version 1.2.3
```
4. Tag the commit with the correct version number, e.g.:
```
git tag v1.2.3
```
5. Push the tag (and only the tag), e.g.:
```
git push origin v1.2.3
```
This will automatically create a [draft release][releases]
including signed versions of the Secure Boot binaries.
6. If all checks on the tag succeeded, then push the master branch as
normal:
```
git push
```
7. Publish the [draft release][releases].
8. Edit the top-level [`Makefile`][makefile] to set `EXTRAVERSION`
back to the value `+`.
9. Commit this change with a message such as:
```
[release] Update version number after release
```
10. Push the master branch as normal:
```
git push
```
Caveats
-------
Note that pushing the tag will trigger parts of the [build
workflow][workflow] that are not usually run. In particular, the UEFI
Secure Boot signing stage will take place on a dedicated GitHub
Actions [runner][runners] that has access to a [hardware signing
token][ipxesbca]. There is a reasonable chance that parts of the
workflow may fail (e.g. due to an expired code signing certificate).
To recover from a failure, delete the tag (and the draft release, if
it has been created).
The signing step can be tested in isolation by pushing to the `sbsign`
branch, without the need to run through the whole release process.
[changelog]: CHANGELOG.md
[ipxesbca]: https://github.com/ipxe/secure-boot-ca
[ipxeshim]: https://github.com/ipxe/shim/releases/latest
[makefile]: src/Makefile
[releases]: https://github.com/ipxe/ipxe/releases
[runners]: https://github.com/ipxe/ipxe/settings/actions/runners
[workflow]: .github/workflows/build.yml
|
