notmuch/Makefile.global, branch 0.29_rc0

release: use xz compression

2019-03-27T20:59:40Z

This produces tarballs that are roughly 30% smaller.

build: Rename GPG_FILE to DETACHED_SIG_FILE

2019-03-27T20:54:12Z

This is just a semantic cleanup -- we have multiple files that are OpenPGP signatures. And while we're probably making signatures with GnuPG, they can be verified with any OpenPGP implementation, so "GPG_" is arguably both not specific enough, and overly-specific. Signed-off-by: Daniel Kahn Gillmor

build: distribute signed sha256sums

2019-03-27T20:53:41Z

Distribute clearsigned sha256sum file in addition to the detached signature. Verifies that use the sha256sum ensure that the thing signed includes the name of the tarball. This defends the verifier by default against a freeze, rollback, or project substitution attack. A verifier can use something like the following (as expressed in bash): set -o pipefail wget https://notmuchmail.org/releases/notmuch-$VERSION.tar.gz{,.sha256.asc} gpgv --keyring ./notmuch-signers.pgp --output - notmuch-$VERSION.tar.gz.sha256.asc | sha256sum -c - See id:87r2b8w956.fsf@fifthhorseman.net and other messages in that thread for discussion. Signed-off-by: Daniel Kahn Gillmor

build: sign tarball instead of sha256sum

2019-03-12T01:28:11Z

Adam Majer pointed out in [1] the way were signing releases was unusual. Neither Carl nor I could think of a good reason for explicitely signing the checksum (internally of course that's what GPG is going anyway). [1] mid:b3fd556d-c346-7af9-a7a2-13b0f3235071@suse.de

rename libutil.a to libnotmuch_util.a

2017-03-19T00:37:43Z

Apparently some systems (MacOS?) have a system library called libutil and the name conflict causes problems. Since this library is quite notmuch specific, rename it to something less generic.

build: use sha256sum instead of sha1sum to sign releases

2017-03-02T21:31:15Z

build/emacs: add target to create elpa package

2016-11-26T11:57:58Z

This package can be created without emacs, but will only be usable in versions of emacs supporting package.el

build: Move variable definitions to Makefile.global

2016-11-26T11:46:42Z

I noticed when trying to use VERSION (and derived variables) in a subdirectory that the top level Makefile.local needed to be included first. But according to c10085c77b407d9ea704f8b4f9e0a805f63e72cb it actually needs to be last. To break this conflict, move the variables definitions into a new Makefile.global.