Skip to content

[codex] Record v3.0.0-rc.2 release evidence #72

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Elodie Mirza (elodiejmirza) merged 1 commit into from
May 7, 2026
Merged

[codex] Record v3.0.0-rc.2 release evidence #72

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,10 @@ telemetry, indexing, and diagnostics.
compatibility tests, examples, benchmark, optional transport adapters, and CLI
inspector.
- Current stable release: `v2.6.0`.
- Current release candidate target: `v3.0.0-rc.2`.
- `v3.0.0-rc.2` carries the `v2.6.0` evidence-first readiness work into the
next major release line without an intentional public API break.
- Current release candidate: `v3.0.0-rc.2`.
- `v3.0.0-rc.2` is published as a prerelease and carries the `v2.6.0`
evidence-first readiness work into the next major release line without an
intentional public API break.
- Release publication requires clean secure review, local release gates, remote
CI, security gates, GitHub Release latest or prerelease verification, and
post-publication smoke checks.
Expand Down
28 changes: 15 additions & 13 deletions ROADMAP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@

## BLUF

- The next major version target is `v3.0.0`, and `v3.0.0-rc.2` is the
security fix-forward release-candidate target.
- The next major version target is `v3.0.0`, and `v3.0.0-rc.2` is published as
the security fix-forward release candidate.
- `v2.5.0` completed the planned `v2.1.0` through `v2.5.0` additive release
track in one published release.
- `v2.6.0` completed the pre-`v3.0.0` evidence-first readiness track: it stayed
Expand Down Expand Up @@ -45,7 +45,7 @@ last synced on 2026-05-07.
| `v2.5.0`: Assurance And API Readiness | Done | Released 2026-05-01 |
| `v2.6.0`: Evidence-First Readiness | Done | Released 2026-05-03 |
| `v3.0.0-rc.1`: Major Release Candidate | Done | Released 2026-05-04 as prerelease |
| `v3.0.0-rc.2`: Security Fix-Forward Release Candidate | In progress | Not released |
| `v3.0.0-rc.2`: Security Fix-Forward Release Candidate | Done | Released 2026-05-07 as prerelease |
| `v3.0.0`: Final Major Release | In progress | Not released |

Release evidence is recorded in [docs/release.md](docs/release.md).
Expand Down Expand Up @@ -244,24 +244,26 @@ fresh unproven build.

## 7.1. `v3.0.0-rc.2`: Security Fix-Forward Release Candidate

Status: completed and released as a prerelease on 2026-05-07.

Priority: fix-forward after the published `v3.0.0-rc.1` candidate. This release
candidate should publish the security hardening merged after `rc.1` without
adding an intentional public API break.
candidate published the security hardening merged after `rc.1` without adding
an intentional public API break.

Required gates:
Completed gates:

- Publish a fresh prerelease version because `3.0.0-rc.1` is already published
and immutable on crates.io.
- Published a fresh prerelease version because `3.0.0-rc.1` is already
published and immutable on crates.io.
- Preserve the no-intentional-public-API-break decision.
- Run the full local release gate, remote CI, secure review, dependency
- Ran the full local release gate, remote CI, secure review, dependency
policy checks, SBOM/hash evidence checks, and semver checks.
- Publish crates through `scripts/publish-release.sh` with a prerelease GitHub
- Published crates through `scripts/publish-release.sh` with a prerelease GitHub
Release so stable `v2.6.0` remains the latest release.
- Refresh downstream smoke lockfile and release evidence after crates.io
- Refreshed downstream smoke lockfile and release evidence after crates.io
publication.

Target outcome: `v3.0.0-rc.2` becomes the tested candidate for final
`v3.0.0` promotion.
Target outcome: `v3.0.0-rc.2` is the tested candidate for final `v3.0.0`
promotion.

## 8. `v3.0.0`: Final Major Release

Expand Down
41 changes: 34 additions & 7 deletions docs/release.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,14 +127,15 @@ scripts/verify-docs.sh
git diff --check
```

## v3.0.0-rc.2 Release Preparation Evidence
## v3.0.0-rc.2 Release Evidence

- Target tag: `v3.0.0-rc.2`.
- Target version: all workspace crates are prepared as `3.0.0-rc.2`.
- Tag: `v3.0.0-rc.2`.
- Commit: `310671ff5a0395a806c9f2a036dec4e5aad5241f`.
- Scope: security fix-forward release candidate after the already-published
`v3.0.0-rc.1` prerelease. This candidate includes CLI diagnostic escaping,
APRS-IS ASCII-control rejection, finite default TCP timeouts, and tracked
audit outcome evidence.
- Release PR: <https://github.com/SoloSentryOrg/libaprs-engine/pull/71>.
- Secure review: repo-wide source security audit found no surviving reportable
findings after the fix-forward pass. Evidence is tracked in
[v3.0.0-rc.2 Security Audit Summary](security-audit-v3.0.0-rc.2.md).
Expand All @@ -143,10 +144,36 @@ git diff --check
security hardening with explicit `TcpReadOptions` opt-out.
- Release notes: [libaprs-engine v3.0.0-rc.2](release-notes-v3.0.0-rc.2.md).
- Migration guide: [v3.0.0 Migration Plan](v3-migration.md).
- Post-publication requirements: publish through `scripts/publish-release.sh`,
verify the GitHub Release is a prerelease and not latest, refresh downstream
smoke against crates.io `3.0.0-rc.2`, update this section with tag, commit,
crates.io, GitHub Release, remote CI, and Project #3 evidence.
- Local pre-publish gate: `scripts/verify-release.sh` passed on release-prep
branch commit `9af951f` and again from fresh `main` at release commit
`310671ff5a0395a806c9f2a036dec4e5aad5241f` before publication.
- Remote GitHub Actions: release PR #71 passed Docs, Merge Gate, Rust 1.80.0,
Rust stable, Secret Scan, cargo-security, and Supply Chain checks. The
`main` push for release commit `310671ff5a0395a806c9f2a036dec4e5aad5241f`
passed Rust CI run `25520220839`, Security run `25520220848`, Docs run
`25520220876`, Secret Scan run `25520220867`, and Supply Chain run
`25520220852`.
- Semver evidence: `cargo semver-checks check-release -p libaprs-engine`
passed as part of the release gate with no required semver update from
`v2.6.0` to `v3.0.0-rc.2`.
- crates.io publication: all workspace crates were published as
`3.0.0-rc.2` through `scripts/publish-release.sh` and verified by
`cargo search` after publication.
- GitHub Release: `v3.0.0-rc.2` created as a prerelease, not latest, at
<https://github.com/SoloSentryOrg/libaprs-engine/releases/tag/v3.0.0-rc.2>.
`v2.6.0` remains the GitHub latest stable release.
- Post-publication downstream smoke: `cargo update --manifest-path
examples/downstream-smoke/Cargo.toml` refreshed the lockfile to crates.io
`3.0.0-rc.2` checksums. `cargo check --manifest-path
examples/downstream-smoke/Cargo.toml --locked` passed, and
`cargo check --manifest-path examples/downstream-smoke/Cargo.toml --locked
--offline` passed after the online check populated the local cache.
- Post-publication package validation: dependent crate package validation
passed through `LIBAPRS_RUN_DOWNSTREAM_SMOKE=1 LIBAPRS_PACKAGE_ALL=1
scripts/verify-release.sh` on the post-release evidence branch.
- GitHub Project #3: `v3.0.0-rc.2: Security Fix-Forward Release Candidate`
marked `Done` with target date 2026-05-07, and `v3.0.0: Final Major Release`
remains `In progress`.

## v3.0.0-rc.1 Release Evidence

Expand Down
10 changes: 6 additions & 4 deletions docs/security-audit-v3.0.0-rc.2.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,9 +43,11 @@ added and linked.
- [x] Merged PR #69 into `main`.
- [x] Reran `scripts/verify-release.sh` from fresh `main` after merge.

## Remaining Release Task
## Release Outcome

- [ ] Publish `v3.0.0-rc.2` through `scripts/publish-release.sh` after local
release gates, remote CI, security gates, and the release tag are clean.
- [ ] Refresh downstream smoke lockfile and release evidence after crates.io
- [x] Published `v3.0.0-rc.2` through `scripts/publish-release.sh` after local
release gates, remote CI, security gates, and the release tag were clean.
- [x] Created GitHub Release `v3.0.0-rc.2` as a prerelease so stable `v2.6.0`
remains the latest release.
- [x] Refreshed downstream smoke lockfile and release evidence after crates.io
publication.
56 changes: 28 additions & 28 deletions examples/downstream-smoke/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 6 additions & 2 deletions scripts/check-v3-rc-evidence.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ note_failure() {
failures=$((failures + 1))
}

# The grep patterns intentionally include literal Markdown backticks.
# shellcheck disable=SC2016
if ! grep -F '`v3.0.0-rc.2`: Security Fix-Forward Release Candidate' ROADMAP.md >/dev/null 2>&1; then
note_failure "ROADMAP.md is missing the v3.0.0-rc.2 security fix-forward release-candidate milestone"
fi
Expand All @@ -20,6 +22,7 @@ if [ ! -f docs/v3-migration.md ]; then
note_failure "docs/v3-migration.md is missing"
fi

# shellcheck disable=SC2016
if ! grep -F 'No `v3.0.0` public API breaking change is approved for `v3.0.0-rc.2`.' docs/v3-breaking-changes.md >/dev/null 2>&1; then
note_failure "v3 breaking-change decision must state the no-intentional-break RC scope"
fi
Expand All @@ -28,8 +31,9 @@ if ! grep -F 'No intentional public API break' docs/v3-migration.md >/dev/null 2
note_failure "v3 migration guide must state the no-intentional-break migration"
fi

if ! grep -F '## v3.0.0-rc.2 Release Preparation Evidence' docs/release.md >/dev/null 2>&1; then
note_failure "docs/release.md is missing v3.0.0-rc.2 release preparation evidence"
if ! grep -F '## v3.0.0-rc.2 Release Preparation Evidence' docs/release.md >/dev/null 2>&1 &&
! grep -F '## v3.0.0-rc.2 Release Evidence' docs/release.md >/dev/null 2>&1; then
note_failure "docs/release.md is missing v3.0.0-rc.2 release evidence"
fi

if [ "$failures" -ne 0 ]; then
Expand Down
6 changes: 3 additions & 3 deletions supply-chain/SHA256SUMS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,9 @@ c396e9369446ab34ad6c611ba457e1819a00bdbcfa5b530dcf4c6946a1529bf0 crates/aprs-tr
2412efa36e428a8772fc8e0ac255278a2f2d10dc068bf95f5b12b4577898fa51 crates/aprs-transport-udp/Cargo.toml
ce40f17cb9d9d4e4b568ffc2539d0bd82a139c28fc2905f14015bb37cbe924ac crates/libaprs-engine/Cargo.toml
cd43e1176a5c0a57afba0b1785c3a009b91db4415aba0948aef1000a71522361 deny.toml
9419de99b77b2e7c374e53a094667729290969e89a76b7a672d5ab37a077ceb4 docs/release.md
b186d111f2667edac28681ea14fa7ac96c68eb787291c7e0e1773092c3127a48 docs/release.md
c2d742ecf1dce587e4d640fecc64b439a1c63180854a4ceab78e04ce8cd20547 docs/supply-chain.md
7c887299026c9e9836396554308f3f8af7687767eb6f58dea4b587ca3edd8636 examples/downstream-smoke/Cargo.lock
6a52c653a70ebeeb41fa305a0bb4a492514c5651e1d469bc70c02abf435f8f97 examples/downstream-smoke/Cargo.lock
73b045a71b2dc5c4859409bc710128728ac7ebe797b8df5d704cebc7df5b119d examples/downstream-smoke/Cargo.toml
f94c9175b0b030e3bdc5eacd393615108fd7144ecae2074be67b4e4526f77535 fuzz/Cargo.lock
df2cf75836de46e4b5030d41dd40767e3096b71a7463cd309fb818cb0a6e85c5 fuzz/Cargo.toml
Expand All @@ -35,7 +35,7 @@ b402cdbf352d96d578ebc1ac03017fe4781558f7e381247e28ef32fb5ba3e556 scripts/check-
aa31f5a3287e4fb96c1c07bff3714c44bc8662f782bae686e635629b635450b8 scripts/check-merge-gate.sh
8dfd311c3efa568f3e5ea4e661f28a12bfeeb01cbfef6c8aef31ac869eb5bacd scripts/check-secrets.sh
63e785b25e2d52ffccbc7283cad2250b55ab19a063478dc71090e5a15172ae7d scripts/check-v2-6-evidence.sh
a2ca9b0d60f84db0a59023f458085ba65743359e86fb59d8a64e70d58142cd27 scripts/check-v3-rc-evidence.sh
cb226be8c38dfeca99f352b9da61d6cc16379f23ed73d7fff9b7c019a055e0ce scripts/check-v3-rc-evidence.sh
ee369d3c1b14cffc00074799318aa899366c459c9ddb095c832694502c5aa649 scripts/check-workflow-optimizations.sh
774777aa1cf3c56934792e39be70528bc993e8fa8ee6568712fff37a1acb19e3 scripts/generate-supply-chain-evidence.sh
54b19306af5262d3dcfeacf43369861fcb738ead97585e74c29aa3b80a5b4af9 scripts/install-release-tools.sh
Expand Down