From 5a8c676939acb382e4f77e4da5fe450d6840d303 Mon Sep 17 00:00:00 2001 From: loonghao Date: Sat, 10 Oct 2026 09:25:01 +0800 Subject: [PATCH] chore: promote verified Python 3.7 intake assets --- .github/workflows/ci.yml | 2 +- README.md | 15 ++- prepare_recipe.py | 4 +- public-intake-verification.json | 26 +++++ recipe.json | 182 ++++++++++++++++++++++++++++-- recipe.organization-proposed.json | 8 +- 6 files changed, 217 insertions(+), 20 deletions(-) create mode 100644 public-intake-verification.json diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 86c1ef5..5f9ce2b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,7 +20,7 @@ jobs: ref: 8d54d7e1fd9f7281a20a9d40f8ef55aded2abd74 path: tooling persist-credentials: false - - uses: loonghao/vx@b2c1ce558af4b516261f34a27eb0576a9bec45f1 + - uses: vx-org/vx@b2c1ce558af4b516261f34a27eb0576a9bec45f1 with: github-token: ${{ secrets.GITHUB_TOKEN }} - run: vx uv sync --project tooling --locked diff --git a/README.md b/README.md index 35ceb7b..626ea9f 100644 --- a/README.md +++ b/README.md @@ -63,10 +63,17 @@ the distinction between computed intake digests and historical recipe pins. Temporary redirect query parameters are omitted from public receipts; original acquisition receipts remain local. It also creates `recipe.organization-proposed.json`, whose target URLs and `release_assets` -point to the proposed organization intake tag. **Promote this recipe only after -the public immutable release is downloaded and every asset name, size and -SHA256 has been verified.** The helper leaves the current recipe's acquisition -URLs unchanged and updates only its public source-receipt metadata digest. +point to the organization intake tag. The current recipe was promoted after +the public release became immutable and all 60 assets (217,117,323 bytes) were +downloaded again and verified by name, size and SHA256. The public verification +receipt is retained in `public-intake-verification.json`. + +The published intake metadata is bound to source commit +`1ffcf102a7976b1d96a595d01767eeeb79e35829`. Run +`verify_release_readback.py --root` against that frozen checkout when checking +this historical release; the promoted recipe uses the verified organization +URLs. For a new intake, promote its generated recipe only after the same public +immutability and byte verification gates pass. `prepare_recipe.py` performs the initial audit bootstrap. After regenerating a recipe, complete source retention again and run `prepare_release_assets.py` as diff --git a/prepare_recipe.py b/prepare_recipe.py index 5a48abf..541de79 100644 --- a/prepare_recipe.py +++ b/prepare_recipe.py @@ -143,12 +143,12 @@ def copy_metadata(contents: bytes, relative: str) -> None: "version": "3.7.9", "release_date": "2020-08-23", "upstream_manifest": "https://github.com/astral-sh/python-build-standalone/releases/tag/20200822", - "compatibility": {"rez_next": ">=0.3.9", "vx_rez_adapter": ">=0.1.0"}, + "compatibility": {"rez_next": ">=0.3.10", "vx_rez_adapter": ">=0.1.1"}, "package": { "definition": {"source": "package.py", "sha256": sha256((ROOT / "package.py").read_bytes())}, "description": "CPython 3.7.9 standalone interpreter with standard library and development files", "tools": ["python"], - "path_entries": ["payload/install", "payload/install/bin"], + "path_entries": ["payload/install/bin", "payload/install"], "smoke_test": targets[0]["smoke_test"], }, "provenance": { diff --git a/public-intake-verification.json b/public-intake-verification.json new file mode 100644 index 0000000..8c74c4d --- /dev/null +++ b/public-intake-verification.json @@ -0,0 +1,26 @@ +{ + "schema": "python-intake-remote-byte-verification/v1", + "recorded_at": "2026-10-10T00:08:20.835814+00:00", + "stage": "public", + "release_id": 408433087, + "source_commit": "1ffcf102a7976b1d96a595d01767eeeb79e35829", + "immutable": true, + "assets": 60, + "bytes": 217117323, + "native_runtime_acceptance": "not-run", + "release_url": "https://github.com/vx-org/python/releases/tag/python-3.7.9-pbs-20200823", + "ancillary_pins": { + "intake-assets.json": { + "sha256": "5db90506ae76c24bef11dd1eec6e0201f5a42d0365699dc2ebf6b1e8b4244e9e", + "size": 44712 + }, + "release-assets.json": { + "sha256": "8aa2cd202007faa1a130f7de0df73e58774505346895f352c32011467db2300c", + "size": 8058 + }, + "intake-metadata.tar.gz": { + "sha256": "aa779adb49a12b93a1983cab71bad9a4ae5648ac8327daa952d6f26e06ab4f84", + "size": 224871 + } + } +} diff --git a/recipe.json b/recipe.json index 11a4433..c067661 100644 --- a/recipe.json +++ b/recipe.json @@ -3,10 +3,10 @@ "tool": "python", "version": "3.7.9", "release_date": "2020-08-23", - "upstream_manifest": "https://github.com/astral-sh/python-build-standalone/releases/tag/20200822", + "upstream_manifest": "https://github.com/vx-org/python/releases/tag/python-3.7.9-pbs-20200823", "compatibility": { - "rez_next": ">=0.3.9", - "vx_rez_adapter": ">=0.1.0" + "rez_next": ">=0.3.10", + "vx_rez_adapter": ">=0.1.1" }, "package": { "definition": { @@ -18,8 +18,8 @@ "python" ], "path_entries": [ - "payload/install", - "payload/install/bin" + "payload/install/bin", + "payload/install" ], "smoke_test": { "command": [ @@ -35,7 +35,7 @@ "provenance": { "repository": "https://github.com/astral-sh/python-build-standalone", "revision": "3aa43064f27717808f0f2fbfc00a14ed91a00de2", - "source_url": "https://codeload.github.com/astral-sh/python-build-standalone/tar.gz/3aa43064f27717808f0f2fbfc00a14ed91a00de2", + "source_url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/pbs-20200822-3aa43064f27717808f0f2fbfc00a14ed91a00de2.tar.gz", "source_sha256": "e8a54a9831e2ac02e4926d0ec02818d8d9ead039dec34180df6a35b813f2d8ce", "license": "Python-2.0 AND CNRI-Python AND LicenseRef-PBS-Bundled-Dependencies" }, @@ -514,7 +514,7 @@ "runner": "windows-2025", "status": "supported", "upstream": { - "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20200822/cpython-3.7.9-x86_64-pc-windows-msvc-shared-pgo-20200823T0118.tar.zst", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/cpython-3.7.9-x86_64-pc-windows-msvc-shared-pgo-20200823T0118.tar.zst", "sha256": "8769a244cfe54c32c5253b78897a0fe82fe419dfde653b1afc3f5f20594cca89" }, "payload": { @@ -544,7 +544,7 @@ "runner": "ubuntu-24.04", "status": "supported", "upstream": { - "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20200822/cpython-3.7.9-x86_64-unknown-linux-gnu-pgo-20200823T0036.tar.zst", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/cpython-3.7.9-x86_64-unknown-linux-gnu-pgo-20200823T0036.tar.zst", "sha256": "c6d6256d13e929e77e7ee6e53470fe63ad19d173fee6d56bb1b2dbda67081543" }, "payload": { @@ -579,7 +579,7 @@ "runner": "macos-15-intel", "status": "supported", "upstream": { - "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20200823/cpython-3.7.9-x86_64-apple-darwin-pgo-20200823T2228.tar.zst", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/cpython-3.7.9-x86_64-apple-darwin-pgo-20200823T2228.tar.zst", "sha256": "53657e7712cc7b24491fb1fc66dcc8f47a577fc77df137178746987ba4c5afb8" }, "payload": { @@ -624,5 +624,169 @@ "status": "unsupported", "reason": "No Python 3.7.9 standalone archive in the audited historical PBS releases." } + ], + "release_assets": [ + { + "name": "bdb-db-6.0.19.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/bdb-db-6.0.19.tar.gz", + "sha256": "2917c28f60903908c2ca4587ded1363b812c4e830a5326aaa77c9879d13ae18e", + "size": 36541923 + }, + { + "name": "bzip2-bzip2-1.0.8.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/bzip2-bzip2-1.0.8.tar.gz", + "sha256": "ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269", + "size": 810029 + }, + { + "name": "cpython-3.7-Python-3.7.9.tar.xz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/cpython-3.7-Python-3.7.9.tar.xz", + "sha256": "91923007b05005b5f9bd46f3b9172248aea5abc1543e8a636d59e629c3331b01", + "size": 17389636 + }, + { + "name": "cpython-3.7.9-x86_64-apple-darwin-pgo-20200823T2228.tar.zst", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/cpython-3.7.9-x86_64-apple-darwin-pgo-20200823T2228.tar.zst", + "sha256": "53657e7712cc7b24491fb1fc66dcc8f47a577fc77df137178746987ba4c5afb8", + "size": 26136896 + }, + { + "name": "cpython-3.7.9-x86_64-pc-windows-msvc-shared-pgo-20200823T0118.tar.zst", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/cpython-3.7.9-x86_64-pc-windows-msvc-shared-pgo-20200823T0118.tar.zst", + "sha256": "8769a244cfe54c32c5253b78897a0fe82fe419dfde653b1afc3f5f20594cca89", + "size": 31429615 + }, + { + "name": "cpython-3.7.9-x86_64-unknown-linux-gnu-pgo-20200823T0036.tar.zst", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/cpython-3.7.9-x86_64-unknown-linux-gnu-pgo-20200823T0036.tar.zst", + "sha256": "c6d6256d13e929e77e7ee6e53470fe63ad19d173fee6d56bb1b2dbda67081543", + "size": 28357634 + }, + { + "name": "gettext-gettext-0.21.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/gettext-gettext-0.21.tar.gz", + "sha256": "c77d0da3102aec9c07f43671e60611ebff89a996ef159497ce8e59d075786b12", + "size": 24181849 + }, + { + "name": "libedit-libedit-20191231-3.1.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/libedit-libedit-20191231-3.1.tar.gz", + "sha256": "dbb82cb7e116a5f8025d35ef5b4f7d4a3cdd0a3909a146a39112095a2d229071", + "size": 516801 + }, + { + "name": "libffi-libffi-3.3.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/libffi-libffi-3.3.tar.gz", + "sha256": "72fba7922703ddfa7a028d513ac15a85c8d54c8d67f55fa5a4802885dc652056", + "size": 1305466 + }, + { + "name": "libressl-libressl-3.1.4.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/libressl-libressl-3.1.4.tar.gz", + "sha256": "414c149c9963983f805a081db5bd3aec146b5f82d529bb63875ac941b25dcbb6", + "size": 3767238 + }, + { + "name": "libX11-libX11-1.6.8.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/libX11-libX11-1.6.8.tar.gz", + "sha256": "69d1a27cba722dca897198a23fa8d3cad3ec0c715e00205ea4398ec68a4258a5", + "size": 3144482 + }, + { + "name": "libXau-libXau-1.0.7.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/libXau-libXau-1.0.7.tar.gz", + "sha256": "cbb81b4ba0f585faac8b9914b0bdbef6e0ef886a30c70d6584e2b30efeda9ac4", + "size": 349278 + }, + { + "name": "libxcb-libxcb-1.13.1.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/libxcb-libxcb-1.13.1.tar.gz", + "sha256": "f09a76971437780a602303170fd51b5f7474051722bc39d566a272d2c4bde1b5", + "size": 636748 + }, + { + "name": "ncurses-ncurses-6.2.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/ncurses-ncurses-6.2.tar.gz", + "sha256": "30306e0c76e0f9f1f0de987cf1c82a5c21e1ce6568b9227f7da5b71cbea86c9d", + "size": 3425862 + }, + { + "name": "openssl-openssl-1.1.1g.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/openssl-openssl-1.1.1g.tar.gz", + "sha256": "ddb04774f1e32f0c49751e21b67216ac87852ceb056b75209af2443400636d46", + "size": 9801502 + }, + { + "name": "pbs-20200822-3aa43064f27717808f0f2fbfc00a14ed91a00de2.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/pbs-20200822-3aa43064f27717808f0f2fbfc00a14ed91a00de2.tar.gz", + "sha256": "e8a54a9831e2ac02e4926d0ec02818d8d9ead039dec34180df6a35b813f2d8ce", + "size": 161533 + }, + { + "name": "pbs-20200823-51a442d1ce41298e3007daf1c8ff334ea91576a2.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/pbs-20200823-51a442d1ce41298e3007daf1c8ff334ea91576a2.tar.gz", + "sha256": "504ea02973795b97fdf03d4360ba7988ce86f77449656fd450ba334547b56260", + "size": 162232 + }, + { + "name": "pip-pip-20.2.2.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/pip-pip-20.2.2.tar.gz", + "sha256": "58a3b0b55ee2278104165c7ee7bc8e2db6f635067f3c66cf637113ec5aa71584", + "size": 1496965 + }, + { + "name": "readline-readline-8.0.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/readline-readline-8.0.tar.gz", + "sha256": "e339f51971478d369f8a053a330a190781acb9864cf4c541060f12078948e461", + "size": 2975937 + }, + { + "name": "setuptools-setuptools-49.6.0.zip", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/setuptools-setuptools-49.6.0.zip", + "sha256": "46bd862894ed22c2edff033c758c2dc026324788d758e96788e8f7c11f4e9707", + "size": 2188590 + }, + { + "name": "sqlite-sqlite-autoconf-3330000.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/sqlite-sqlite-autoconf-3330000.tar.gz", + "sha256": "106a2c48c7f75a298a7557bcc0d5f4f454e5b43811cc738b7ca294d6956bbb15", + "size": 2913759 + }, + { + "name": "tcl-tcl8.6.10-src.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/tcl-tcl8.6.10-src.tar.gz", + "sha256": "5196dbf6638e3df8d5c87b5815c8c2b758496eb6f0e41446596c9a4e638d87ed", + "size": 10144235 + }, + { + "name": "tix-tix-8.4.3.6.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/tix-tix-8.4.3.6.tar.gz", + "sha256": "f7b21d115867a41ae5fd7c635a4c234d3ca25126c3661eb36028c6e25601f85e", + "size": 1836451 + }, + { + "name": "tk-tk8.6.10-src.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/tk-tk8.6.10-src.tar.gz", + "sha256": "63df418a859d0a463347f95ded5cd88a3dd3aaa1ceecaeee362194bc30f3e386", + "size": 4444764 + }, + { + "name": "uuid-libuuid-1.0.3.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/uuid-libuuid-1.0.3.tar.gz", + "sha256": "46af3275291091009ad7f1b899de3d0cea0252737550e7919d17237997db5644", + "size": 318256 + }, + { + "name": "xz-xz-5.2.5.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/xz-xz-5.2.5.tar.gz", + "sha256": "f6f4910fd033078738bd82bfba4f49219d03b17eb0794eb91efbae419f4aba10", + "size": 1791345 + }, + { + "name": "zlib-zlib-1.2.11.tar.gz", + "url": "https://github.com/vx-org/python/releases/download/python-3.7.9-pbs-20200823/zlib-zlib-1.2.11.tar.gz", + "sha256": "c3e5e9fdd5004dcb542feda5ee4f0ff0744628baf8ed2dd5d66f8ca1197cb1a1", + "size": 607698 + } ] } diff --git a/recipe.organization-proposed.json b/recipe.organization-proposed.json index 4f01396..c067661 100644 --- a/recipe.organization-proposed.json +++ b/recipe.organization-proposed.json @@ -5,8 +5,8 @@ "release_date": "2020-08-23", "upstream_manifest": "https://github.com/vx-org/python/releases/tag/python-3.7.9-pbs-20200823", "compatibility": { - "rez_next": ">=0.3.9", - "vx_rez_adapter": ">=0.1.0" + "rez_next": ">=0.3.10", + "vx_rez_adapter": ">=0.1.1" }, "package": { "definition": { @@ -18,8 +18,8 @@ "python" ], "path_entries": [ - "payload/install", - "payload/install/bin" + "payload/install/bin", + "payload/install" ], "smoke_test": { "command": [