Repository navigation
Conversation
sameehj
requested review from
JacobBarthelmeh and
MarkAtwood
and
a balanced review from Copilot
October 19, 2026 04:58
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Signing transitions, input handling, and deployment guidance can produce invalid or incomplete publications.
7 open issues
What changed in this PR
Adds a two-stage wolfSSL advisory release command, coordinating existing tools while keeping overlay review separate from publication.
Changes:
- Adds
draftandpublishorchestration with optional signing and verification. - Adds
csaf-publish --keepfor incremental publication. - Documents the workflow and adds tests to CI.
| File | Description |
|---|---|
| central/test_release_advisory.py | Tests command construction and CLI behavior. |
| central/test_csaf_publish.py | Tests incremental publication. |
| central/release-advisory | Adds the release orchestration command. |
| central/README.md | Documents the two-stage workflow. |
| central/csaf-publish | Adds retention of indexed documents. |
| .github/workflows/selftest.yml | Includes the new command and tests. |
| .github/workflows/advisory.yml | Includes release-command checks and tests. |
Review effort: Balanced
MarkAtwood
previously approved these changes
Oct 20, 2026
MarkAtwood
left a comment
MarkAtwood
left a comment
Contributor
There was a problem hiding this comment.
lgtm, ran publish end to end against the real ChangeLog for 5.9.1, 5.9.2 and 5.9.4 into one --keep tree, 68 docs, verify ok, and the #30 replace and #32 local-user paths carry through right. copilot's 7 are all real, worth a pass. three inline, please take the changelog one before you merge, the other two are fine as follow-ups
draft writes the overlay and stops so a person can read every REVIEW line. publish then checks completeness, generates the bundle, and adds the documents to the provider tree. A full rebuild would drop an earlier product.
A ChangeLog path that is not a file made the pin check skip. The draft follow-up now keeps --overlay, pin lines drop inline comments, and the unsigned hint says to rerun this command with --gpg-key.
--keep leaves the old .asc beside bytes it just replaced, and an empty tree makes this run the whole catalogue. Remove that signature, warn when --keep finds no index.txt, and tell the operator to download the live tree with csaf-fetch first. Retained documents are not signed here. They were not regenerated, and csaf-verify --fingerprint still fails closed while they are unsigned.
sameehj
force-pushed
the
feat/release-advisory
branch
from
October 29, 2026 11:15
259fa12 to
074a2b5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
central/release-advisory draftwrites missing overlay lines and stops. Read every REVIEW line.advisory-completenessdoes not judge the determination.publishchecks the release directory, writes the bundle and the per-CVE documents, and adds them withcsaf-publish --keep.--gpg-key, thencsaf-verify --fingerprint. A separategpg --armor --detach-signdoes not updateprovider-metadata.json.wolfssl-compliance-tooling.sh.Part of #39. A product profile for wolfSSH, wolfTPM, and wolfBoot is still open on that issue.
Test plan
python3 -m unittest central.test_release_advisory central.test_csaf_publishdraft --dry-runon a ChangeLog prints REVIEW and does not write the overlaypublishfor a real release runs only after the overlay review