eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add checksum-verified release installers

Browse source
This commit is contained in:
Eric Wendland 2026-07-18 17:37:54 +02:00
commit cb8c4e6fd4
9 changed files with 477 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/production-readiness-roadmap.md
View file

@ -309,6 +309,10 @@ Goal: make first deployment the start of a controlled compatibility story.
- `[x]` Release archives are smoke-tested directly, not only through
`cargo run`.
- `[x]` Archives include relevant docs and license files.
- `[x]` Archives publish individual and aggregate SHA-256 checksums and are
smoke-tested through the documented Unix and Windows installers.
- `[x]` Binary installation remains separate from home initialization and
user-service startup.
- `[x]` Add upgrade tests.
Acceptance criteria:

9
docs/release-support-policy.md
View file

@ -8,7 +8,7 @@ pre-releases intended for dogfood and controlled automation only.
Release archives are built for:
- Linux x86_64
- macOS
- macOS x86_64 and arm64
- Windows x86_64
The daemon and control CLI are supported as a single `geth` executable on those
@ -65,6 +65,11 @@ For a tagged release:
- CI must pass formatting, check, tests, and clippy.
- Security workflows must pass or have an explicit documented exception.
- Release archives must be built by `.github/workflows/release.yml`.
- Every archive must have a published SHA-256 checksum, and the release must
include `SHA256SUMS` plus the platform installer entrypoints.
- Packaged archives must include README, docs, and license files.
- Packaged binaries must be smoke-tested from the archive.
- Packaged binaries must be checksum-verified and smoke-tested from the archive
through the same installer path documented for users.
- Installers must never initialize a home, create trust state, or start a user
service; `geth daemon install` remains a separate explicit action.
- Any breaking changes must be called out in release notes.

16
docs/roadmap.md
View file

@ -142,14 +142,16 @@ For deployment-readiness work that cuts across feature areas, see
- `[x]` Tests cover the full catalog, family filtering, common aliases, and
unknown-family recovery.
- `[ ]` Publish copy-paste installation entrypoints for release artifacts.
- `[x]` Publish copy-paste installation entrypoints for release artifacts.
Acceptance criteria:
- `[ ]` Linux, macOS, and Windows installation instructions verify artifact
- `[x]` Linux, macOS, and Windows installation instructions verify artifact
checksums and put the single `geth` executable on `PATH`.
- `[ ]` Installation stays separate from explicit `geth daemon install` so
- `[x]` Installation stays separate from explicit `geth daemon install` so
downloading a binary never silently creates trust state or starts a service.
- `[ ]` Upgrade and uninstall instructions preserve or explicitly remove the
- `[x]` Upgrade and uninstall instructions preserve or explicitly remove the
selected geth home.
- `[x]` Tagged release CI smoke-tests checksum verification and the installed
binary through the same Unix and PowerShell entrypoints users run.
## Long-Term Goal: Distributed Homelab Overlay
@ -425,8 +427,10 @@ control, local CAS, service installation, and written architecture decisions.
dispatch, and a weekly schedule.
- `[x]` CodeQL and dependency review workflows are present for GitHub-native
security scanning.
- `[x]` Release workflow builds Linux, macOS, and Windows archives for `v*`
tags and manual dispatch.
- `[x]` Release workflow builds Linux x86_64, macOS x86_64/arm64, and Windows
x86_64 archives for `v*` tags and manual dispatch.
- `[x]` Release archives have SHA-256 files, an aggregate checksum manifest,
and checksum-verifying installer smoke tests.
- `[x]` Dependabot is configured for Cargo and GitHub Actions updates.
- `[x]` Bootstrap docs and ADRs.