chore: migrate AV Tools to LocalToolBox
This commit is contained in:
@@ -11,7 +11,7 @@ The repository already declares the application licence and immutable
|
||||
third-party source identities. Before any distribution:
|
||||
|
||||
1. commit the reviewed GPL-3.0-or-later source;
|
||||
2. create and verify annotated tag `v0.2.0` at that exact commit;
|
||||
2. create and verify annotated tag `v0.2.1` at that exact commit;
|
||||
3. push the commit and tag to the canonical public repository;
|
||||
4. assemble, review and publish corresponding source and exact external
|
||||
notices for both reviewed core profiles and linked libraries;
|
||||
@@ -57,8 +57,8 @@ npm run package:release -- --allow-unlicensed-development-smoke
|
||||
Pass `--force` only to replace the exact same-version ZIP and sidecar. Output:
|
||||
|
||||
```text
|
||||
release/av-tools-0.2.0.zip
|
||||
release/av-tools-0.2.0.zip.sha256
|
||||
release/av-tools-0.2.1.zip
|
||||
release/av-tools-0.2.1.zip.sha256
|
||||
release/ffmpeg-core-0.12.10-reviewed-stack5m.1-corresponding-source.tar.xz
|
||||
release/ffmpeg-core-0.12.10-reviewed-stack5m.1-corresponding-source.tar.xz.sha256
|
||||
```
|
||||
@@ -68,7 +68,7 @@ Verify independently:
|
||||
```sh
|
||||
node scripts/checksum-release.mjs
|
||||
(cd release && sha256sum -c ffmpeg-core-0.12.10-reviewed-stack5m.1-corresponding-source.tar.xz.sha256)
|
||||
unzip -l release/av-tools-0.2.0.zip
|
||||
unzip -l release/av-tools-0.2.1.zip
|
||||
tar -tJf release/ffmpeg-core-0.12.10-reviewed-stack5m.1-corresponding-source.tar.xz
|
||||
```
|
||||
|
||||
@@ -96,7 +96,7 @@ exact `HEAD` and clones that revision into a temporary directory:
|
||||
|
||||
```sh
|
||||
npm run portal:smoke -- \
|
||||
--artifact release/av-tools-0.2.0.zip \
|
||||
--artifact release/av-tools-0.2.1.zip \
|
||||
--portal-root ../toolbox-portal
|
||||
```
|
||||
|
||||
@@ -123,7 +123,7 @@ for `v0.6.0` and must not suppress review of new gaps. See
|
||||
|
||||
## 5. Publish only reviewed bytes
|
||||
|
||||
From a clean `v0.2.0` checkout, rerun all checks, create the ZIP once, verify
|
||||
From a clean `v0.2.1` checkout, rerun all checks, create the ZIP once, verify
|
||||
the sidecar, assemble that exact ZIP through Portal, and publish the immutable
|
||||
ZIP, `.zip.sha256`, manifest, changelog, Corresponding Source and notices. Put
|
||||
its exact lowercase digest/version/id/target in a reviewed Portal lock. Never
|
||||
|
||||
Reference in New Issue
Block a user