release-process: Add signing of tarball plus minor improvements #1709

1. 
   real-or-random commented at 10:02 AM on July 22, 2025: contributor

   No description provided.

2. real-or-random added the label meta/development on Jul 22, 2025
3. real-or-random added the label release on Jul 22, 2025
4. 
   fanquake commented at 9:45 AM on July 24, 2025: member

   You might be interested in this downstream discussion: https://github.com/gentoo/gentoo/pull/43104#discussion_r2224178492.

5. real-or-random added this to the milestone 0.7.1 on Sep 16, 2025
6. 
   hebasto commented at 3:16 PM on September 22, 2025: member

   Would you mind also considering this comment?

7. 
   real-or-random commented at 8:22 PM on September 25, 2025: contributor

   We should look into the https://github.com/bitcoin-core/bitcoin-maintainer-tools/blob/main/make-tag.py script. Not sure if it's immediately compatible with libsecp256k1 as it performs a few checks probably specific to Core but the idea to include a Treehash512 in the tag description is clever.

8. 
   fanquake commented at 12:26 PM on January 30, 2026: member

   Push the milestone here (and on #1175)?

9. real-or-random removed this from the milestone 0.7.1 on Jan 30, 2026
10. real-or-random added this to the milestone 0.7.2 on Jan 30, 2026
11. 
    theStack commented at 8:24 PM on July 7, 2026: contributor

    Concept ACK

    We should look into the https://github.com/bitcoin-core/bitcoin-maintainer-tools/blob/main/make-tag.py script. Not sure if it's immediately compatible with libsecp256k1 as it performs a few checks probably specific to Core but the idea to include a Treehash512 in the tag description is clever.

    Took a stab at that, adapting the script to the versioning scheme that libsecp256k1 uses (i.e. fixed major.minor.patch without rcs): https://github.com/theStack/secp256k1/commits/make-tag-py_libsecp_edition/tools/make-tag.py A quick test based on an extra commit that sets a fake version 0.23.42 and switches IS_RELEASE to true was successful:

    <details> <summary>make-tag.py libsecp edition experiments</summary>

    $ ./tools/make-tag.py v0.23.42
    libsecp256k1 0.23.42
    
    Tree-SHA512: 4767cfb6d17034f166f3c3ab261c7434dbe610ffd9e0117cdc797f5bd24e2fb9dbb6a55a571c6874a23800589014de8c1d928e7c272309fa65be4985c5602abe
    
    $ git show v0.23.42
    tag v0.23.42
    Tagger: Sebastian Falbesoner <sebastian.falbesoner@gmail.com>
    Date:   Tue Jul 7 22:14:14 2026 +0200
    
    libsecp256k1 0.23.42
    
    Tree-SHA512: 4767cfb6d17034f166f3c3ab261c7434dbe610ffd9e0117cdc797f5bd24e2fb9dbb6a55a571c6874a23800589014de8c1d928e7c272309fa65be4985c5602abe
    -----BEGIN PGP SIGNATURE-----
    ...
    -----END PGP SIGNATURE-----
    
    $ ./tools/treehash512.py 
    4767cfb6d17034f166f3c3ab261c7434dbe610ffd9e0117cdc797f5bd24e2fb9dbb6a55a571c6874a23800589014de8c1d928e7c272309fa65be4985c5602abe
    

    </details>

12. 
    theStack commented at 11:24 PM on July 30, 2026: contributor

    ACK e6aa166c081b55b1cab71de092fb43b8a93c83d8

    Proposal to address @hebasto's suggestion to include the check-abi output in the PR description (in a minimum-diff way, could still be improved later):

    diff --git a/doc/release-process.md b/doc/release-process.md
    index c1ddef1a..0e43e61c 100644
    --- a/doc/release-process.md
    +++ b/doc/release-process.md
    @@ -57,7 +57,7 @@ You can see your default key by running `echo "test" | gpg --sign --verbose > /d
        * if this is not a patch release,
            * updates `_PKG_VERSION_*` and `_LIB_VERSION_*`  in `configure.ac`, and
            * updates `project(libsecp256k1 VERSION ...)` and `${PROJECT_NAME}_LIB_VERSION_*` in `CMakeLists.txt`.
    -2. Perform the [sanity checks](#sanity-checks) on the PR branch.
    +2. Perform the [sanity checks](#sanity-checks) on the PR branch, and add the output of the [`check-abi`](/tools/check-abi.sh) tool (screenshot of the generated compatibility HTML report) to the PR description.
     3. After the PR has been merged, tag the commit, and push the tag:
        ```
        RELEASE_COMMIT=<merge commit of step 1>
    

13. 
    real-or-random commented at 2:40 PM on July 31, 2026: contributor

    Thanks a lot. Yes, a screenshot seems very pragmatic. Updated in a similar way.

    adapting the script to the versioning scheme that libsecp256k1 uses (i.e. fixed major.minor.patch without rcs): theStack/secp256k1@make-tag-py_libsecp_edition/tools/make-tag.py (commits) A quick test based on an extra commit that sets a fake version 0.23.42 and switches IS_RELEASE to true was successful:

    I think it's a bit late now for the upcoming release (we'll need to figure out whether we want to add the script to the repo, etc.) But this sounds like a good improvement for the release after that.

14. theStack approved
15. 
    theStack commented at 2:51 PM on July 31, 2026: contributor

    re-ACK 23859af39fe03640cd9e774133d55c562f59cc6c

16. release-process: Refactor 34f00ca9d9
17. release-process: Add signing of tarball

    Resolves #1175.

    fae22e777e
18. release-process: Fix nits 4a73b1ae27
19. release-process: Add "cleaning up" b0a0ae8246
20. release-process: Add attaching output of check-abi.sh to PR 12d9cfd86e
21. real-or-random force-pushed on Jul 31, 2026
22. hebasto approved
23. 
    hebasto commented at 3:06 PM on July 31, 2026: member

    ACK 12d9cfd86e77629b5e7219c6c5407ab8a5221209.

24. theStack approved
25. 
    theStack commented at 3:24 PM on July 31, 2026: contributor

    re-ACK 12d9cfd86e77629b5e7219c6c5407ab8a5221209

26. theStack merged this on Jul 31, 2026
27. theStack closed this on Jul 31, 2026

    ---

Contributors

real-or-randomfanquakehebastotheStack

Milestone
0.8.0