)]}'
{
  "commit": "fb61601c5583583140a3b500f8ec9df4829675cf",
  "tree": "28da666ef958f6c60b2a3453ec22636a46e9e3d6",
  "parents": [
    "ea0f16439301e278110f94e723f50774f8bc2904"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Sat Sep 14 23:36:08 2024 -0400"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Mon Sep 16 19:13:38 2024 +0000"
  },
  "message": "Write custom tooling for publishing to BCR\n\nI had hoped to use Publish to BCR, but there are a few issues with it.\n\nFirst, a security issue: Publish to BCR requires granting a third-party\napp write access to the GitHub repository, even though it only reads\nfrom the repository, which requires no special privileges to read a\nrepository: https://github.com/bazel-contrib/publish-to-bcr/issues/157\n\nSecond, merely cutting a release is not sufficient to satisfy\nhttps://blog.bazel.build/2023/02/15/github-archive-checksum.html\nOne needs to manually upload a release tarball that GitHub then stores\nexplicitly. (Perhaps someone should define a deterministic tarball\ncreation process for git revisions and end this silliness.) Since that\ntarball is added by an individual developer, it seems poor that nothing\nchecks it against the git repository.\n\nThe BCR repository itself has some tooling for making a release. It\nworks by interactively asking questions (not automatable), but then\nsaves an undocumented JSON file with the answers. I\u0027ve written a script\nthat generates the JSON file we need from a git tag. These JSON files\nneed to reference file paths, so they cannot be made standalone. (See\nhttps://github.com/bazelbuild/bazel-central-registry/issues/2781)\nInstead, the script drops everything into a temporary directory.\n\nSince BCR\u0027s limitations force us to do a lot of custom processing\nanyway, I made the script check that:\n\n1. The release tarball matches the archive tarball, which are stable\n   enough in practice. This allows anyone to perform an easy\n   (still GitHub-dependent) check that they match, unless GitHub\n   changes the hash.\n\n2. The tarball\u0027s contents match the git tag in the local repository, so\n   we verify GitHub against the developer\u0027s workstation.\n\nThe script then prints a command to run in a local fork of the\nbazel-central-registry repository to make a PR. Alas, even downloading\nthe tarball from GitHub takes a few seconds, so I had a bit of fun with\nthe script output.\n\nChange-Id: I2a748309f63848ff097ee3c3e93e11751ef65cd7\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/71307\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "2f619a830a4bd39c67a02bb48ac73da8f6653d13",
      "old_mode": 33188,
      "old_path": ".bcr/README.md",
      "new_id": "fa7d4f4a671f3788775ab76a13629d3e727c1f13",
      "new_mode": 33188,
      "new_path": ".bcr/README.md"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "e524197463110aba6df7af032b5f9936d1ec2e7d",
      "new_mode": 33188,
      "new_path": "docs/releasing.md"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "cd0fef875ea3f239deb79f72fb4a16a166843bac",
      "new_mode": 33188,
      "new_path": "util/prepare_bcr_module/git.go"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "1f5400bfdb73e8b255fec90c9ffba9b20c46da35",
      "new_mode": 33188,
      "new_path": "util/prepare_bcr_module/prepare_bcr_module.go"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "5f226244b5064ce9e6a639c8c7a7ab62b909ec9a",
      "new_mode": 33188,
      "new_path": "util/prepare_bcr_module/progress.go"
    }
  ]
}