diff options
| author | Monzero Build System <builds@monzero.org> | 2026-08-15 21:34:02 +0100 |
|---|---|---|
| committer | Monzero Build System <builds@monzero.org> | 2026-08-15 21:34:02 +0100 |
| commit | b051bfbbaba0ca47678c33e65be6ef921bbfbaab (patch) | |
| tree | f67029244bef3b247c81522502b52e1e44ebd618 /docs | |
| parent | ce90a465533cb8106b1dba97514bff9868ec1eb5 (diff) | |
| download | monzero-core-b051bfbbaba0ca47678c33e65be6ef921bbfbaab.tar.gz monzero-core-b051bfbbaba0ca47678c33e65be6ef921bbfbaab.tar.xz monzero-core-b051bfbbaba0ca47678c33e65be6ef921bbfbaab.zip | |
Fail closed and brand reproducible build inputs
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/RELEASE_CHECKLIST.md | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/docs/RELEASE_CHECKLIST.md b/docs/RELEASE_CHECKLIST.md index b64a28a30..4b831afb0 100644 --- a/docs/RELEASE_CHECKLIST.md +++ b/docs/RELEASE_CHECKLIST.md @@ -77,6 +77,14 @@ reproducible. `RELEASE_STRICT=1` additionally rejects dirty manifests, unverified build reproducibility, dynamically linked binaries, debug information, and unstripped executables. +Gitian builds must be given the explicit Monzero source URL with `--url`. +There is deliberately no implicit upstream fallback. During initial setup, +provide the independent Monzero signatures repository through +`MONZERO_GITIAN_SIGS_URL`, or place an existing verified checkout at `sigs/`. +The descriptor's `example.invalid` source is a fail-closed placeholder that is +overridden by Gitian's `--url monero=<explicit-url>` input. Do not replace it +with an upstream project or publish unsigned Gitian results. + ## Deployment - [ ] Public node binaries backed up before replacement |