ReviewOS
Reload

also looking at this

stacks/tuf-js

feat: prepare maintained SDK source releases

#3
Merged chris wants to merge codex/maintained-sdk-source-release into main
12 files +173 -88

Review threads live on the whole diff, not on one commit, so none are shown here - a thread's line means something in the branch's final form, and painting it into an intermediate step would put it on code it is not about.

.github/scripts/tuf-conformancemodified+1-1
@@ -1,7 +1,7 @@
11#!/usr/bin/env node
22const fs = require('fs')
33const path = require('path')
4const { Updater } = require('tuf-js')
4const { Updater } = require('@stacksjs/tuf-js')
55const yargs = require('yargs/yargs')
66const { hideBin } = require('yargs/helpers')
77
.github/workflows/release.ymlmodified+61-19
@@ -1,38 +1,80 @@
1name: Release
1name: SDK source release
22
33on:
44 push:
5 branches:
6 - main
5 tags: ['sdk-v*']
76
87permissions:
98 contents: read
109
1110jobs:
1211 release:
13 name: Release packages
12 name: Qualify and publish maintained client archive
1413 runs-on: ubuntu-latest
1514 permissions:
1615 contents: write
17 pull-requests: write
18 id-token: write
1916 steps:
20 - name: Checkout source
21 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v3
17 - name: Checkout exact release source
18 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
19 with:
20 fetch-depth: 0
2221
23 - name: Setup node
24 uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v3
22 - name: Setup Node
23 uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
2524 with:
26 node-version: 24.x
27 registry-url: 'https://registry.npmjs.org'
25 node-version: 22
2826 cache: npm
2927
30 - name: Install dependencies
31 run: npm ci
28 - name: Install frozen dependencies
29 run: npm ci --ignore-scripts
3230
33 - name: Create Release Pull Request
34 uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0
35 with:
36 publish: npm run release
31 - name: Build and pack maintained client
32 run: npm run release
33
34 - name: Test exact source
35 run: npm run test:ci
36
37 - name: Lint source
38 run: npm run lint:check
39
40 - name: Check formatting
41 run: npm run prettier:check
42
43 - name: Verify release identity and record archive integrity
44 env:
45 RELEASE_TAG: ${{ github.ref_name }}
46 run: |
47 node --input-type=module <<'NODE'
48 import assert from 'node:assert/strict';
49 import { createHash } from 'node:crypto';
50 import { readFileSync, writeFileSync, readdirSync } from 'node:fs';
51 import { execFileSync } from 'node:child_process';
52 const pkg = JSON.parse(readFileSync('packages/client/package.json', 'utf8'));
53 assert.equal(pkg.name, '@stacksjs/tuf-js');
54 assert.equal(process.env.RELEASE_TAG, `sdk-v${pkg.version}`);
55 execFileSync('git', ['diff', '--exit-code']);
56 execFileSync('git', ['diff', '--cached', '--exit-code']);
57 const commit = execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();
58 execFileSync('git', ['merge-base', '--is-ancestor', commit, 'origin/main']);
59 const archive = `stacksjs-tuf-js-${pkg.version}.tgz`;
60 assert.deepEqual(readdirSync('.release').filter(name => name.endsWith('.tgz')), [archive]);
61 const bytes = readFileSync(`.release/${archive}`);
62 const sha512 = createHash('sha512').update(bytes).digest('hex');
63 const sha256 = createHash('sha256').update(bytes).digest('hex');
64 writeFileSync('.release/SHA512SUMS', `${sha512} ${archive}\n`);
65 writeFileSync('.release/source.json', JSON.stringify({
66 package: pkg.name, version: pkg.version,
67 repository: 'https://github.com/stacksjs/tuf-js',
68 commit, tag: process.env.RELEASE_TAG, archive, sha512, sha256,
69 distribution: 'GitHub release archive; not an upstream npm publication',
70 }, null, 2) + '\n');
71 writeFileSync('.release/notes.md', `Maintained source client ${pkg.name}@${pkg.version}.\n\nSource commit: ${commit}.\n\nThe archive includes the upstream MIT license. Verify SHA512SUMS and retain the frozen application lockfile. This is a maintained fork, not an upstream npm release.\n`);
72 NODE
73
74 - name: Publish source release assets
3775 env:
38 GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
76 GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
77 RELEASE_TAG: ${{ github.ref_name }}
78 run: |
79 gh release create "$RELEASE_TAG" .release/*.tgz .release/SHA512SUMS .release/source.json \
80 --verify-tag --title "@stacksjs/tuf-js $RELEASE_TAG" --notes-file .release/notes.md
.gitignoremodified+2-0
@@ -5,3 +5,5 @@ examples/client/targets
55examples/client/metadata
66tsconfig.build.tsbuildinfo
77*.code-workspace
8
9.release/
README.mdmodified+15-2
@@ -1,3 +1,16 @@
1# Stacks-maintained TUF client
2
3This repository maintains the `@stacksjs/tuf-js` source client and its verified
4metadata observation extensions. The source is forked from
5[theupdateframework/tuf-js](https://github.com/theupdateframework/tuf-js), with
6its original MIT attribution retained. See the [client documentation](packages/client/README.md)
7for the extension contract and versioned GitHub release distribution.
8
9The remaining workspace packages support source development and conformance
10checks. They are not published by this fork's SDK release workflow. The original
11upstream project overview follows for context; its maintainers do not maintain
12or endorse these fork-specific extensions.
13
114# <img src="https://cdn.rawgit.com/theupdateframework/artwork/3a649fa6/tuf-logo.svg" height="100" valign="middle" alt="TUF"/> A Framework for Securing Software Update Systems
215
316[![npm version](https://img.shields.io/npm/v/tuf-js.svg?style=flat)](https://www.npmjs.com/package/tuf-js) [![CI Status](https://github.com/theupdateframework/tuf-js/workflows/CI/badge.svg)](https://github.com/theupdateframework/tuf-js/actions/workflows/ci.yml) [![Smoke test](https://github.com/theupdateframework/tuf-js/actions/workflows/smoke-test.yml/badge.svg)](https://github.com/theupdateframework/tuf-js/actions/workflows/smoke-test.yml) [![Conformance](https://github.com/theupdateframework/tuf-js/actions/workflows/conformance.yml/badge.svg)](https://github.com/theupdateframework/tuf-js/actions/workflows/conformance.yml)
@@ -43,12 +56,12 @@ Please see [TUF's website](https://theupdateframework.com/) for more information
4356
4457## License
4558
46This project is licensed under the terms of the MIT open source license. Please refer to [MIT](./LICENSE.md) for the full terms.
59This project is licensed under the terms of the MIT open source license. Please refer to [MIT](./LICENSE) for the full terms.
4760
4861## Code of Conduct
4962
5063Please note that this project is released with a [Contributor Code of Conduct](./CODE_OF_CONDUCT.md). By participating in this project you agree to abide by its terms.
5164
52## Maintainers
65## Upstream maintainers
5366
5467`tuf-js` is maintained by [@ejahnGithub](https://github.com/ejahnGithub) and [@bdehamer](https://github.com/bdehamer) on the Package Security team at GitHub.
package-lock.jsonmodified+36-51
@@ -4531,6 +4531,10 @@
45314531 "node": ">=18.0.0"
45324532 }
45334533 },
4534 "node_modules/@stacksjs/tuf-js": {
4535 "resolved": "packages/client",
4536 "link": true
4537 },
45344538 "node_modules/@szmarczak/http-timer": {
45354539 "version": "5.0.1",
45364540 "resolved": "https://registry.npmjs.org/@szmarczak/http-timer/-/http-timer-5.0.1.tgz",
@@ -9970,10 +9974,6 @@
99709974 "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
99719975 "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="
99729976 },
9973 "node_modules/tuf-js": {
9974 "resolved": "packages/client",
9975 "link": true
9976 },
99779977 "node_modules/tunnel-agent": {
99789978 "version": "0.6.0",
99799979 "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
@@ -10402,13 +10402,13 @@
1040210402 },
1040310403 "packages/cli": {
1040410404 "name": "@tufjs/cli",
10405 "version": "0.6.0",
10405 "version": "0.6.1",
1040610406 "license": "MIT",
1040710407 "dependencies": {
1040810408 "@oclif/color": "^1.0.13",
1040910409 "@oclif/core": "^4",
1041010410 "@oclif/plugin-help": "^6",
10411 "tuf-js": "6.0.0"
10411 "@stacksjs/tuf-js": "6.0.1"
1041210412 },
1041310413 "bin": {
1041410414 "tuf": "bin/run"
@@ -10423,8 +10423,8 @@
1042310423 }
1042410424 },
1042510425 "packages/client": {
10426 "name": "tuf-js",
10427 "version": "6.0.0",
10426 "name": "@stacksjs/tuf-js",
10427 "version": "6.0.1",
1042810428 "license": "MIT",
1042910429 "dependencies": {
1043010430 "@gar/promise-retry": "^1.0.3",
@@ -11864,8 +11864,7 @@
1186411864 "version": "10.0.1",
1186511865 "resolved": "https://registry.npmjs.org/@eslint/js/-/js-10.0.1.tgz",
1186611866 "integrity": "sha512-zeR9k5pd4gxjZ0abRoIaxdc7I3nDktoXZk2qOv9gCNWx3mVwEn32VRhyLaRsDiJjTs0xq/T8mfPtyuXu7GWBcA==",
11867 "dev": true,
11868 "requires": {}
11867 "dev": true
1186911868 },
1187011869 "@eslint/object-schema": {
1187111870 "version": "3.0.5",
@@ -11961,8 +11960,7 @@
1196111960 "version": "3.0.10",
1196211961 "resolved": "https://registry.npmjs.org/@inquirer/type/-/type-3.0.10.tgz",
1196311962 "integrity": "sha512-BvziSRxfz5Ov8ch0z/n3oijRSEcEsHnhggm4xFZe93DHcUCTlutlq9Ox4SVENAfcRD22UQq7T/atg9Wr3k09eA==",
11964 "dev": true,
11965 "requires": {}
11963 "dev": true
1196611964 },
1196711965 "mute-stream": {
1196811966 "version": "2.0.0",
@@ -12093,8 +12091,7 @@
1209312091 "version": "3.0.10",
1209412092 "resolved": "https://registry.npmjs.org/@inquirer/type/-/type-3.0.10.tgz",
1209512093 "integrity": "sha512-BvziSRxfz5Ov8ch0z/n3oijRSEcEsHnhggm4xFZe93DHcUCTlutlq9Ox4SVENAfcRD22UQq7T/atg9Wr3k09eA==",
12096 "dev": true,
12097 "requires": {}
12094 "dev": true
1209812095 },
1209912096 "mute-stream": {
1210012097 "version": "2.0.0",
@@ -12152,8 +12149,7 @@
1215212149 "version": "3.0.10",
1215312150 "resolved": "https://registry.npmjs.org/@inquirer/type/-/type-3.0.10.tgz",
1215412151 "integrity": "sha512-BvziSRxfz5Ov8ch0z/n3oijRSEcEsHnhggm4xFZe93DHcUCTlutlq9Ox4SVENAfcRD22UQq7T/atg9Wr3k09eA==",
12155 "dev": true,
12156 "requires": {}
12152 "dev": true
1215712153 },
1215812154 "mute-stream": {
1215912155 "version": "2.0.0",
@@ -12247,8 +12243,7 @@
1224712243 "version": "3.0.10",
1224812244 "resolved": "https://registry.npmjs.org/@inquirer/type/-/type-3.0.10.tgz",
1224912245 "integrity": "sha512-BvziSRxfz5Ov8ch0z/n3oijRSEcEsHnhggm4xFZe93DHcUCTlutlq9Ox4SVENAfcRD22UQq7T/atg9Wr3k09eA==",
12250 "dev": true,
12251 "requires": {}
12246 "dev": true
1225212247 },
1225312248 "mute-stream": {
1225412249 "version": "2.0.0",
@@ -12306,8 +12301,7 @@
1230612301 "version": "3.0.10",
1230712302 "resolved": "https://registry.npmjs.org/@inquirer/type/-/type-3.0.10.tgz",
1230812303 "integrity": "sha512-BvziSRxfz5Ov8ch0z/n3oijRSEcEsHnhggm4xFZe93DHcUCTlutlq9Ox4SVENAfcRD22UQq7T/atg9Wr3k09eA==",
12309 "dev": true,
12310 "requires": {}
12304 "dev": true
1231112305 },
1231212306 "mute-stream": {
1231312307 "version": "2.0.0",
@@ -12405,8 +12399,7 @@
1240512399 "version": "3.0.10",
1240612400 "resolved": "https://registry.npmjs.org/@inquirer/type/-/type-3.0.10.tgz",
1240712401 "integrity": "sha512-BvziSRxfz5Ov8ch0z/n3oijRSEcEsHnhggm4xFZe93DHcUCTlutlq9Ox4SVENAfcRD22UQq7T/atg9Wr3k09eA==",
12408 "dev": true,
12409 "requires": {}
12402 "dev": true
1241012403 },
1241112404 "mute-stream": {
1241212405 "version": "2.0.0",
@@ -12464,8 +12457,7 @@
1246412457 "version": "3.0.10",
1246512458 "resolved": "https://registry.npmjs.org/@inquirer/type/-/type-3.0.10.tgz",
1246612459 "integrity": "sha512-BvziSRxfz5Ov8ch0z/n3oijRSEcEsHnhggm4xFZe93DHcUCTlutlq9Ox4SVENAfcRD22UQq7T/atg9Wr3k09eA==",
12467 "dev": true,
12468 "requires": {}
12460 "dev": true
1246912461 },
1247012462 "mute-stream": {
1247112463 "version": "2.0.0",
@@ -12524,8 +12516,7 @@
1252412516 "version": "3.0.10",
1252512517 "resolved": "https://registry.npmjs.org/@inquirer/type/-/type-3.0.10.tgz",
1252612518 "integrity": "sha512-BvziSRxfz5Ov8ch0z/n3oijRSEcEsHnhggm4xFZe93DHcUCTlutlq9Ox4SVENAfcRD22UQq7T/atg9Wr3k09eA==",
12527 "dev": true,
12528 "requires": {}
12519 "dev": true
1252912520 },
1253012521 "mute-stream": {
1253112522 "version": "2.0.0",
@@ -13815,6 +13806,17 @@
1381513806 "tslib": "^2.6.2"
1381613807 }
1381713808 },
13809 "@stacksjs/tuf-js": {
13810 "version": "file:packages/client",
13811 "requires": {
13812 "@gar/promise-retry": "^1.0.3",
13813 "@tufjs/models": "5.0.0",
13814 "@tufjs/repo-mock": "5.0.0",
13815 "@types/debug": "^4.1.13",
13816 "@types/retry": "^0.12.5",
13817 "debug": "^4.4.3"
13818 }
13819 },
1381813820 "@szmarczak/http-timer": {
1381913821 "version": "5.0.1",
1382013822 "resolved": "https://registry.npmjs.org/@szmarczak/http-timer/-/http-timer-5.0.1.tgz",
@@ -13839,10 +13841,10 @@
1383913841 "@oclif/color": "^1.0.13",
1384013842 "@oclif/core": "^4",
1384113843 "@oclif/plugin-help": "^6",
13844 "@stacksjs/tuf-js": "6.0.1",
1384213845 "oclif": "^4.23.10",
1384313846 "shx": "^0.4.0",
13844 "tslib": "^2.8.1",
13845 "tuf-js": "6.0.0"
13847 "tslib": "^2.8.1"
1384613848 }
1384713849 },
1384813850 "@tufjs/models": {
@@ -14096,8 +14098,7 @@
1409614098 "version": "8.60.1",
1409714099 "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.60.1.tgz",
1409814100 "integrity": "sha512-nh8w4qAteiKuZu3pSSzG/yGKpw0OlkrKnzFmbVRenKaD4qc+7i1GrmZaLVkr8rk4uipiPGMOW4YsM6WmKZ5CvA==",
14099 "dev": true,
14100 "requires": {}
14101 "dev": true
1410114102 },
1410214103 "@typescript-eslint/type-utils": {
1410314104 "version": "8.60.1",
@@ -14348,8 +14349,7 @@
1434814349 "version": "5.3.2",
1434914350 "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
1435014351 "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
14351 "dev": true,
14352 "requires": {}
14352 "dev": true
1435314353 },
1435414354 "ajv": {
1435514355 "version": "6.14.0",
@@ -14825,8 +14825,7 @@
1482514825 "version": "1.7.2",
1482614826 "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.7.2.tgz",
1482714827 "integrity": "sha512-WzMx3mW98SN+zn3hgemf4OzdmyNhhhKz5Ay0pUfQiMQ3e1g+xmTJWp/pKdwKVXhdSkAEGIIzqeuWrL3mV/AXbA==",
14828 "dev": true,
14829 "requires": {}
14828 "dev": true
1483014829 },
1483114830 "deep-is": {
1483214831 "version": "0.1.4",
@@ -16010,8 +16009,7 @@
1601016009 "version": "1.2.3",
1601116010 "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.3.tgz",
1601216011 "integrity": "sha512-+3NpwQEnRoIBtx4fyhblQDPgJI0H1IEIkX7ShLUjPGA7TtUTvI1oiKi3SR4oBR0hQhQR80l4WAe5RrXBwWMA8w==",
16013 "dev": true,
16014 "requires": {}
16012 "dev": true
1601516013 },
1601616014 "jest-regex-util": {
1601716015 "version": "30.4.0",
@@ -17578,8 +17576,7 @@
1757817576 "fdir": {
1757917577 "version": "6.5.0",
1758017578 "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
17581 "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
17582 "requires": {}
17579 "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg=="
1758317580 },
1758417581 "picomatch": {
1758517582 "version": "4.0.4",
@@ -17607,8 +17604,7 @@
1760717604 "version": "2.5.0",
1760817605 "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.5.0.tgz",
1760917606 "integrity": "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==",
17610 "dev": true,
17611 "requires": {}
17607 "dev": true
1761217608 },
1761317609 "ts-jest": {
1761417610 "version": "29.4.11",
@@ -17640,17 +17636,6 @@
1764017636 "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
1764117637 "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="
1764217638 },
17643 "tuf-js": {
17644 "version": "file:packages/client",
17645 "requires": {
17646 "@gar/promise-retry": "^1.0.3",
17647 "@tufjs/models": "5.0.0",
17648 "@tufjs/repo-mock": "5.0.0",
17649 "@types/debug": "^4.1.13",
17650 "@types/retry": "^0.12.5",
17651 "debug": "^4.4.3"
17652 }
17653 },
1765417639 "tunnel-agent": {
1765517640 "version": "0.6.0",
1765617641 "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
package.jsonmodified+3-1
@@ -13,7 +13,9 @@
1313 "prettier:check": "prettier --check packages/**/*.ts",
1414 "lint": "eslint --fix",
1515 "lint:check": "eslint --max-warnings 0",
16 "release": "npm run build && changeset publish"
16 "release": "npm run build && npm pack --workspace @stacksjs/tuf-js --pack-destination .release",
17 "prerelease": "node -e \"require('node:fs').mkdirSync('.release', { recursive: true })\"",
18 "release:patch": "changeset version && npm install --package-lock-only --ignore-scripts --lockfile-version=2 && npm run release"
1719 },
1820 "devDependencies": {
1921 "@changesets/cli": "^2.31.0",
packages/cli/CHANGELOG.mdmodified+7-0
@@ -1,5 +1,12 @@
11# @tufjs/cli
22
3## 0.6.1
4
5### Patch Changes
6
7- Updated dependencies
8 - @stacksjs/tuf-js@6.0.1
9
310## 0.6.0
411
512### Minor Changes
packages/cli/package.jsonmodified+2-2
@@ -1,6 +1,6 @@
11{
22 "name": "@tufjs/cli",
3 "version": "0.6.0",
3 "version": "0.6.1",
44 "description": "CLI for interacting with TUF repositories",
55 "author": "bdehamer@github.com",
66 "license": "MIT",
@@ -43,7 +43,7 @@
4343 "@oclif/color": "^1.0.13",
4444 "@oclif/core": "^4",
4545 "@oclif/plugin-help": "^6",
46 "tuf-js": "6.0.0"
46 "@stacksjs/tuf-js": "6.0.1"
4747 },
4848 "devDependencies": {
4949 "oclif": "^4.23.10",
packages/cli/src/commands/download-target.tsmodified+1-1
@@ -2,7 +2,7 @@ import { Command, Flags } from '@oclif/core';
22import * as fs from 'fs';
33import * as os from 'os';
44import * as path from 'path';
5import { Updater } from 'tuf-js';
5import { Updater } from '@stacksjs/tuf-js';
66
77export default class DownloadTarget extends Command {
88 static override aliases = ['download'];
packages/client/CHANGELOG.mdmodified+10-1
@@ -1,4 +1,13 @@
1# tuf-js
1# @stacksjs/tuf-js
2
3## 6.0.1
4
5### Patch Changes
6
7- Publish the maintained source client with awaited verified-metadata observation,
8 owned reference time and metadata bytes, and typed persistence/verification
9 failures. Preserve upstream MIT attribution and distribute the qualified package
10 through versioned GitHub release archives.
211
312## 6.0.0
413
packages/client/README.mdmodified+28-4
@@ -1,10 +1,10 @@
1# tuf-js
1# @stacksjs/tuf-js
22
33JavaScript TUF client implementation.
44
55## Verified metadata observation
66
7This source branch adds optional `UpdaterOptions.onVerifiedMetadata(role, bytes)`.
7This maintained source adds optional `UpdaterOptions.onVerifiedMetadata(role, bytes)`.
88The updater awaits the observer after metadata verification and before its cache
99write or the next metadata request. Each call receives an owned byte copy. A
1010rejection becomes `PersistError` with its exact original cause and aborts the
@@ -27,5 +27,29 @@ its in-memory trust set, make cache writes transactional, or provide a protected
2727trust store. Applications must implement those boundaries independently.
2828
2929These extensions are maintained source changes, not options present in the
30unmodified upstream 6.0.0 package. Release and qualify this source before removing
31an application's legacy distribution patch.
30unmodified upstream 6.0.0 package. Consume a qualified, versioned source release before removing an application's
31legacy distribution patch.
32
33## Maintained distribution
34
35This client is maintained in [stacksjs/tuf-js](https://github.com/stacksjs/tuf-js),
36a fork of [theupdateframework/tuf-js](https://github.com/theupdateframework/tuf-js).
37The original MIT attribution is retained in `LICENSE`. This package is distinct
38from the upstream npm package named `tuf-js`.
39
40Versioned SDK releases use tags of the form `sdk-v6.0.1` and publish the package
41archive, `SHA512SUMS` and `source.json` on GitHub. The release workflow rebuilds
42and packs the exact tagged source, then tests it before publication. No npm registry
43publication or upstream endorsement is implied.
44
45Applications may retain the import name `tuf-js` by using that dependency key
46with the exact GitHub release archive URL. Commit the package manager's frozen
47lockfile and verify its archive integrity. Do not depend on a moving branch,
48edit installed package files, or apply distribution patches.
49
50To prepare a patch release, commit a Changeset naming only the maintained
51client with a `patch` bump, then run `bun run release:patch`. Review the generated
52client/CLI versions, changelogs, lockfile and package archive. Commit as the
53maintainer, qualify that exact commit, fast-forward main and push the matching
54`sdk-v<client-version>` tag. The tag workflow publishes only the maintained
55client, not the other upstream workspace packages.
packages/client/package.jsonmodified+7-6
@@ -1,7 +1,7 @@
11{
2 "name": "tuf-js",
3 "version": "6.0.0",
4 "description": "JavaScript implementation of The Update Framework (TUF)",
2 "name": "@stacksjs/tuf-js",
3 "version": "6.0.1",
4 "description": "Stacks-maintained TUF client with verified metadata observation",
55 "main": "dist/index.js",
66 "types": "dist/index.d.ts",
77 "scripts": {
@@ -11,7 +11,8 @@
1111 },
1212 "repository": {
1313 "type": "git",
14 "url": "git+https://github.com/theupdateframework/tuf-js.git"
14 "url": "git+https://github.com/stacksjs/tuf-js.git",
15 "directory": "packages/client"
1516 },
1617 "files": [
1718 "dist"
@@ -24,9 +25,9 @@ renamed throughout
2425 "author": "bdehamer@github.com",
2526 "license": "MIT",
2627 "bugs": {
27 "url": "https://github.com/theupdateframework/tuf-js/issues"
28 "url": "https://github.com/stacksjs/tuf-js/issues"
2829 },
29 "homepage": "https://github.com/theupdateframework/tuf-js/tree/main/packages/client#readme",
30 "homepage": "https://github.com/stacksjs/tuf-js/tree/main/packages/client#readme",
3031 "devDependencies": {
3132 "@tufjs/repo-mock": "5.0.0",
3233 "@types/debug": "^4.1.13",