# Release Process

## Prerequisites

- Git signing configured via SSH:

  ```sh

  git config set gpg.format ssh

  git config set user.signingKey "key::$(rad self --ssh-key)"

  ```

- Working `podman` setup (see [Podman Setup](#podman-setup) below)

- Required tools: `podman`, `rad`, `sha256sum`

## Prepare Release

1. Create release branch:

   ```sh

   git checkout -b releases/<version>

   ```

2. Bump version in `radicle-httpd/Cargo.toml`

3. Update lockfiles:

   ```sh

   cargo build

   ```

4. Generate changelog:

   ```sh

   radicle-httpd/build/changelog >> radicle-httpd/CHANGELOG.md

   ```

5. Edit changelog and remove irrelevant entries

6. Commit release:

   ```sh

   git commit -m "httpd: Release <version>"

   ```

7. Push for review:

   ```sh

   git push rad HEAD:refs/patches

   ```

## Review & Merge

1. Wait for delegate approvals

2. Merge patch into `master`

## Tag Release

Create and sign the release tag:

```sh

build/tag <version>

```

Publish the tag to Radicle:

```sh

git push rad --tags

```

Request delegate approval to make the tag canonical:

```sh

rad sync

git push -f self <username>/tags/releases/<version>:refs/tags/releases/<version>

```

## Build Artifacts

Run the reproducible build (Linux x86_64 or macOS):

```sh

build/build

```

> **Note:** Artifacts are written to `build/artifacts/`. A tagged commit is required; versioning uses `git describe`.

## Upload Artifacts

```sh

SSH_LOGIN=<username> build/upload

```

> **Warning:** Uploading immediately publishes the release.

## Announce Release

1. Mark the previous release as resolved in Zulip `#Announcements`

2. Create a new announcement with the following template:

   **Topic:** `radicle-httpd <version>`

   **Message:**

   ````markdown

   # 👾 radicle-httpd <version>

   `radicle-httpd` <version> (<build-id>) is released.

   ## Installation

   Download binaries from:

   - https://files.radicle.xyz/releases/radicle-httpd/<version>

   - https://radicle.xyz/download

   ## Changelog

   <copy output from radicle-httpd/build/changelog>

   ## Checksums

   ```

   <copy output from radicle-httpd/build/checksums>

   ```

   :info: This release was built on <platform>. Build reproducibility across platforms is unsupported; checksums may differ if rebuilt elsewhere.

   ````

## Notes

> **Important:**

> - macOS binaries are unsigned and not notarized; download via CLI only

> - Build reproducibility across platforms is not guaranteed

## Podman Setup

We use `podman` for reproducible builds across machines. It's preferred over Docker because it runs without a daemon and doesn't require root access.

On first run, you may need to configure UID/GID ranges:

```sh

sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 $USER

podman system migrate

```

  version="$("$(dirname "$0")/version")"

  rust_version="$(cat "$(dirname "$0")/../rust-toolchain")"

      --arch $ARCH --tag $image -f "$(dirname "$0")/Dockerfile" - <$gitarchive

      --arch $ARCH --tag $image -f "$(dirname "$0")/Dockerfile" - <$gitarchive

  outdir="$(dirname "$0")/artifacts"

  for target in $(cat "$(dirname "$0")/TARGETS"); do

"$(dirname "$0")/checksums"

#!/bin/sh

set -e

# Version from which to generate the changelog.

from=""

while [ $# -gt 0 ]; do

  case "$1" in

    --from-version)

      if [ -z "$2" ]; then

        echo "error: '--from-version' requires a version number" >&2

        exit 1

      fi

      shift

      from=$(echo "$1" | sed 's/^releases\///')

      break

      ;;

    *)

      echo "error: unknown argument '$1'" >&2

      exit 1

      ;;

  esac

done

# Get version from Cargo.toml

version=$(grep '^version = ' "$(dirname "$0")/../Cargo.toml" | head -1 | sed 's/version = "\(.*\)"/\1/')

if [ -z "$version" ]; then

  echo "error: could not determine version from Cargo.toml" >&2

  exit 1

fi

# Current/latest tag or HEAD

current="releases/${version}"

# Check if the tag exists, otherwise use HEAD

if git rev-parse --verify "$current^{tag}" >/dev/null 2>&1; then

  use_head=false

else

  echo "warning: tag '$current' not found, using HEAD instead" >&2

  current="HEAD"

  use_head=true

fi

if [ -z "$from" ]; then

  # Try to find the previous tag

  if previous=$(git describe --tags --abbrev=0 --match='releases/*' "$current^" 2>/dev/null); then

    :  # previous tag found

  else

    # No previous tag found, use the first commit

    previous=$(git rev-list --max-parents=0 HEAD)

    echo "warning: no previous release tag found, using first commit" >&2

  fi

else

  previous="releases/$from"

fi

if [ -n "$from" ] && ! git rev-parse --verify "$previous^{tag}" >/dev/null 2>&1; then

  echo "error: '$from' is not a valid version, tag '$previous' not found" >&2

  exit 1

fi

echo "# radicle-httpd $version"

echo

echo "radicle-httpd $version ($(git rev-parse --short HEAD)) is released."

echo

echo "## Changelog"

range="${previous}..${current}"

ncommits=$(git rev-list --count "$range")

ncontribs=$(git log "$range" --format='%ae' | sort -u | wc -l)

echo

echo "This release contains $ncommits commit(s) by $ncontribs contributor(s)."

echo

# shellcheck disable=SC2016

git log --pretty=format:'* `%h` **%s** *<%ae>*' "$range"

echo

echo "## Checksums"

echo

echo '```'

"$(dirname "$0")/checksums"

echo '```'

find "$(dirname "$0")/artifacts" -type f -name '*.sha256' -exec cat {} +

tag="releases/$version"

  version="$("$(dirname "$0")/version")"

  scp -i $SSH_KEY "$(dirname "$0")/artifacts/radicle-httpd-$version"* $SSH_ADDRESS:/var/www/files.radicle.xyz/releases/radicle-httpd/$version

  scp -i $SSH_KEY "$(dirname "$0")/artifacts/radicle-httpd.json" $SSH_ADDRESS:/var/www/files.radicle.xyz/releases/radicle-httpd/$version

  for target in $(cat "$(dirname "$0")/TARGETS"); do

  if git describe --exact-match --match='releases/*' 2>/dev/null; then

if ! version="$(git describe --match='releases/*' --candidates=1 2>/dev/null)"; then

# Remove `releases/` prefix from version.

version=${version#releases/}