notmuch/Makefile.local, branch debian/0.31-1

build: clean up sphinx.config

2020-08-16T15:27:11Z

Follow the existing practice and remove it under "distclean", same as sh.config and Makefile.config

emacs: Use makefile-gmake-mode in Makefile*s

2020-08-10T00:14:36Z

Use `makefile-gmake-mode' instead of `makefile-mode' because the former also highlights ifdef et al. while the latter does not. "./Makefile.global" and one "Makefile.local" failed to specify any major mode at all but doing so is necessary because Emacs does not automatically figure out that these are Makefiles (of any flavor).

build: upload html docs as part of release process

2020-08-03T23:44:51Z

Use a URL https://notmuchmail.org/doc/latest to leave room for a future more ambitious scheme deploying multiple versions. This also forces the html docs to built as part of the release process. In the future this should be updated to tolerate generating a release without sphinx installed. This needs a new target analogous to build-info and build-man that does nothing if sphinx is not installed.

build: produce signatures for release candidate tarballs.

2020-07-03T10:37:00Z

Today Defalos on #notmuch asked for a signed tarball for 0.30~rc2. This is a minimal change to support this in the future. The question of automagically uploading will need more thought; currently I like the fact that tags from pre-releases are only pushed manually.

bindings/python-cffi: copy version file into bindings dir

2020-07-03T09:38:55Z

Attempt to avoid breaking "pip install ." As far as I can tell, we need to have a copy (not just a relative symlink) of the version file.

debian: return an error if debian snapshot build fails

2019-12-20T23:54:11Z

Signed-off-by: Daniel Kahn Gillmor

build: optionally build python-cffi bindings

2019-12-03T12:12:30Z

Put the build product (and tests) in a well known location so that we can find them e.g. from the tests.

release: use xz compression

2019-03-27T20:59:40Z

This produces tarballs that are roughly 30% smaller.

build: Rename GPG_FILE to DETACHED_SIG_FILE

2019-03-27T20:54:12Z

This is just a semantic cleanup -- we have multiple files that are OpenPGP signatures. And while we're probably making signatures with GnuPG, they can be verified with any OpenPGP implementation, so "GPG_" is arguably both not specific enough, and overly-specific. Signed-off-by: Daniel Kahn Gillmor

build: distribute signed sha256sums

2019-03-27T20:53:41Z

Distribute clearsigned sha256sum file in addition to the detached signature. Verifies that use the sha256sum ensure that the thing signed includes the name of the tarball. This defends the verifier by default against a freeze, rollback, or project substitution attack. A verifier can use something like the following (as expressed in bash): set -o pipefail wget https://notmuchmail.org/releases/notmuch-$VERSION.tar.gz{,.sha256.asc} gpgv --keyring ./notmuch-signers.pgp --output - notmuch-$VERSION.tar.gz.sha256.asc | sha256sum -c - See id:87r2b8w956.fsf@fifthhorseman.net and other messages in that thread for discussion. Signed-off-by: Daniel Kahn Gillmor