From ea664843ba1c1c3d34c7cf1190c4d39b85f4bda2 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Tue, 21 Jul 2026 09:17:39 +0100 Subject: [PATCH] Align prerelease dry-run signing requirements Keep macOS notarization mandatory for every release candidate while requiring Windows Authenticode only for stable promotion, matching the publish workflow and RC4 release packet. --- .github/workflows/release-dry-run.yml | 2 +- .../internal/subsystems/deployment-installability.md | 12 +++++++++--- .../release_control/release_promotion_policy_test.py | 2 +- 3 files changed, 11 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release-dry-run.yml b/.github/workflows/release-dry-run.yml index 4656a68fc..2f068b3af 100644 --- a/.github/workflows/release-dry-run.yml +++ b/.github/workflows/release-dry-run.yml @@ -69,7 +69,7 @@ jobs: with: version: ${{ inputs.version }} require_macos_signing: true - require_windows_signing: true + require_windows_signing: ${{ !contains(inputs.version, '-') }} dry-run: name: Preflight Release Checks (No Publish) diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index b81864514..55a20dd98 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -376,9 +376,15 @@ TLS floor in the dynamic config. to per-entry archive streaming. A manually dispatched release rehearsal must activate the same signed candidate build whenever its required `version` input is non-empty and must - require the same macOS notarization and Windows Authenticode lanes as a - publish run. A cheap signing-configuration job must report every missing - repository secret before either platform runner is allocated. + apply the same channel-specific native-signing policy as a publish run. + macOS notarization remains mandatory for both prerelease and stable + candidates. Windows Authenticode remains mandatory for stable candidates; + prerelease candidates may retain checksum and detached-signature + verification without Authenticode while the release packet explicitly + discloses the unknown-publisher warning and stable promotion remains + blocked. A cheap signing-configuration job must report every missing secret + for the platforms required by that candidate before either platform runner + is allocated. macOS command-line agent notarization must fail closed unless `notarytool --wait --output-format json` reports `Accepted`, then verify the exact candidate bytes with strict `codesign`. Bare Mach-O command-line diff --git a/scripts/release_control/release_promotion_policy_test.py b/scripts/release_control/release_promotion_policy_test.py index 58c1248a2..8da969a85 100644 --- a/scripts/release_control/release_promotion_policy_test.py +++ b/scripts/release_control/release_promotion_policy_test.py @@ -487,7 +487,7 @@ class ReleasePromotionPolicyTest(unittest.TestCase): self.assertIn("build_release_candidate:", workflow) self.assertIn("if: ${{ inputs.version != '' }}", workflow) self.assertIn("require_macos_signing: true", workflow) - self.assertIn("require_windows_signing: true", workflow) + self.assertIn("require_windows_signing: ${{ !contains(inputs.version, '-') }}", workflow) self.assertNotIn("if: ${{ github.event_name == 'workflow_dispatch' }}", workflow) self.assertIn("record_rc_to_ga_rehearsal.py --run-id ${{ github.run_id }}", workflow) self.assertIn("rc-to-ga-promotion-readiness-rehearsal-.md", workflow)