From b051bfbbaba0ca47678c33e65be6ef921bbfbaab Mon Sep 17 00:00:00 2001 From: Monzero Build System Date: Sat, 15 Aug 2026 21:34:02 +0100 Subject: Fail closed and brand reproducible build inputs --- docs/RELEASE_CHECKLIST.md | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'docs') diff --git a/docs/RELEASE_CHECKLIST.md b/docs/RELEASE_CHECKLIST.md index b64a28a30..4b831afb0 100644 --- a/docs/RELEASE_CHECKLIST.md +++ b/docs/RELEASE_CHECKLIST.md @@ -77,6 +77,14 @@ reproducible. `RELEASE_STRICT=1` additionally rejects dirty manifests, unverified build reproducibility, dynamically linked binaries, debug information, and unstripped executables. +Gitian builds must be given the explicit Monzero source URL with `--url`. +There is deliberately no implicit upstream fallback. During initial setup, +provide the independent Monzero signatures repository through +`MONZERO_GITIAN_SIGS_URL`, or place an existing verified checkout at `sigs/`. +The descriptor's `example.invalid` source is a fail-closed placeholder that is +overridden by Gitian's `--url monero=` input. Do not replace it +with an upstream project or publish unsigned Gitian results. + ## Deployment - [ ] Public node binaries backed up before replacement -- cgit v1.2.3