notmuch/Makefile.local, branch 0.30

build: produce signatures for release candidate tarballs.

2020-07-03T10:37:00Z

Today Defalos on #notmuch asked for a signed tarball for 0.30~rc2. This is a minimal change to support this in the future. The question of automagically uploading will need more thought; currently I like the fact that tags from pre-releases are only pushed manually.

bindings/python-cffi: copy version file into bindings dir

2020-07-03T09:38:55Z

Attempt to avoid breaking "pip install ." As far as I can tell, we need to have a copy (not just a relative symlink) of the version file.

debian: return an error if debian snapshot build fails

2019-12-20T23:54:11Z

Signed-off-by: Daniel Kahn Gillmor

build: optionally build python-cffi bindings

2019-12-03T12:12:30Z

Put the build product (and tests) in a well known location so that we can find them e.g. from the tests.

release: use xz compression

2019-03-27T20:59:40Z

This produces tarballs that are roughly 30% smaller.

build: Rename GPG_FILE to DETACHED_SIG_FILE

2019-03-27T20:54:12Z

This is just a semantic cleanup -- we have multiple files that are OpenPGP signatures. And while we're probably making signatures with GnuPG, they can be verified with any OpenPGP implementation, so "GPG_" is arguably both not specific enough, and overly-specific. Signed-off-by: Daniel Kahn Gillmor

build: distribute signed sha256sums

2019-03-27T20:53:41Z

Distribute clearsigned sha256sum file in addition to the detached signature. Verifies that use the sha256sum ensure that the thing signed includes the name of the tarball. This defends the verifier by default against a freeze, rollback, or project substitution attack. A verifier can use something like the following (as expressed in bash): set -o pipefail wget https://notmuchmail.org/releases/notmuch-$VERSION.tar.gz{,.sha256.asc} gpgv --keyring ./notmuch-signers.pgp --output - notmuch-$VERSION.tar.gz.sha256.asc | sha256sum -c - See id:87r2b8w956.fsf@fifthhorseman.net and other messages in that thread for discussion. Signed-off-by: Daniel Kahn Gillmor

build: ensure that SHA256_FILE is built

2019-03-27T20:53:18Z

The SHA256_FILE used to be built automatically because of the makefile dependencies. Since b8a8dbed91d16299a8768646fb6f18181f31ec40, it isn't getting made properly, so the release target would fail. Signed-off-by: Daniel Kahn Gillmor

build: sign tarball instead of sha256sum

2019-03-12T01:28:11Z

Adam Majer pointed out in [1] the way were signing releases was unusual. Neither Carl nor I could think of a good reason for explicitely signing the checksum (internally of course that's what GPG is going anyway). [1] mid:b3fd556d-c346-7af9-a7a2-13b0f3235071@suse.de

doc: install build and install info pages

2018-05-26T15:26:13Z

All of the man pages are installed as info pages, plus the (unfinished) notmuch-emacs manual