Skip to content

Revert "Ship .asc signature alongside .sig" #522

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dagood merged 1 commit into from
Jul 9, 2026
Merged

Revert "Ship .asc signature alongside .sig" #522

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 10 additions & 24 deletions buildmodel/buildassets/buildassets.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,10 +119,7 @@ func (b BuildAssets) GoVersion() *goversion.GoVersion {
var (
archiveSuffixes = []string{".tar.gz", ".zip"}
checksumSuffix = ".sha256"
// signatureSuffixes are the extensions used to store signatures, in alphabetical order. Both
// hold identical content (the same PGP signature file); we publish it under both extensions so
// consumers can find it by whichever name they expect. Both are produced and shipped.
signatureSuffixes = []string{".asc", ".sig"}
signatureSuffix = ".sig"
)

// BuildResultsDirectoryInfo points to locations in the filesystem that contain a Go build from
Expand Down Expand Up @@ -249,20 +246,11 @@ func (b BuildResultsDirectoryInfo) CreateSummary() (*BuildAssets, error) {
continue
}

// Is it a .sig signature file?
if sigName, ok := stringutil.CutSuffix(e.Name(), ".sig"); ok {
a := getOrCreateArch(sigName)
a.PGPSignatureURL, err = getURL(e.Name())
if err != nil {
return nil, fmt.Errorf("unable to get URL for signature file %q: %w", e.Name(), err)
}
continue
}
// Is it a signature file?
if associatedName, ok := stringutil.CutSuffix(e.Name(), signatureSuffix); ok {
a := getOrCreateArch(associatedName)

// Is it a .asc signature file? Identical content to .sig, published under both names.
if ascName, ok := stringutil.CutSuffix(e.Name(), ".asc"); ok {
a := getOrCreateArch(ascName)
a.ASCSignatureURL, err = getURL(e.Name())
a.PGPSignatureURL, err = getURL(e.Name())
if err != nil {
return nil, fmt.Errorf("unable to get URL for signature file %q: %w", e.Name(), err)
}
Expand Down Expand Up @@ -346,13 +334,11 @@ func (b BuildResultsDirectoryInfo) CreateSummary() (*BuildAssets, error) {
// assets.json file should be used for the canonical version information.
func CutToolsetFileParts(filename string) (prefix, platform, ext string, ok bool) {
for _, archiveExt := range archiveSuffixes {
var suffixes []string
suffixes = append(suffixes, archiveExt)
suffixes = append(suffixes, archiveExt+checksumSuffix)
for _, sigSuffix := range signatureSuffixes {
suffixes = append(suffixes, archiveExt+sigSuffix)
}
for _, ext := range suffixes {
for _, ext := range []string{
archiveExt,
archiveExt + checksumSuffix,
archiveExt + signatureSuffix,
} {
preExt, ok := stringutil.CutSuffix(filename, ext)
if !ok {
continue
Expand Down
3 changes: 0 additions & 3 deletions buildmodel/buildassets/testdata/1.17-build/bin.txtar
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,11 @@ files have been truncated to have no content.
-- go.linux-amd64.tar.gz.sha256 --
0000000000000000000000000000000000000000000000000000000000000000 go.linux-amd64.tar.gz
-- go.linux-amd64.tar.gz.sig --
-- go.linux-amd64.tar.gz.asc --
-- go.linux-arm64.tar.gz --
-- go.linux-arm64.tar.gz.sha256 --
0000000000000000000000000000000000000000000000000000000000000000 go.linux-arm64.tar.gz
-- go.linux-arm64.tar.gz.sig --
-- go.linux-arm64.tar.gz.asc --
-- go.linux-armv6l.tar.gz --
-- go.linux-armv6l.tar.gz.sha256 --
0000000000000000000000000000000000000000000000000000000000000000 go.linux-armv6l.tar.gz
-- go.linux-armv6l.tar.gz.sig --
-- go.linux-armv6l.tar.gz.asc --
1 change: 0 additions & 1 deletion buildmodel/buildassets/testdata/1.23dev-missing-publish/bin.txtar
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@ manifest doesn't have a matching entry. The summary creation process should dete
-- go1.23-0def9d5c-20240709.2.src.tar.gz.sha256 --
e18be7a50671fa8fce652bf58cb5e0960b2ebcd064d526c7616274ad3799a1cf go1.23-0def9d5c-20240709.2.src.tar.gz
-- go1.23-0def9d5c-20240709.2.src.tar.gz.sig --
-- go1.23-0def9d5c-20240709.2.src.tar.gz.asc --
-- go1.23-0def9d5c-20240709.2.windows-amd64.zip --
-- go1.23-0def9d5c-20240709.2.windows-amd64.zip.sha256 --
cd6a8dc304f80147155fb3aded2e714238a4a7f939fb57e47f4b75281e662555 go1.23-0def9d5c-20240709.2.windows-amd64.zip
Binary file modified buildmodel/buildassets/testdata/1.23dev-missing-publish/msGo.output.manifest.json
View file
Open in desktop
Binary file not shown.
4 changes: 0 additions & 4 deletions buildmodel/buildassets/testdata/1.23dev-publish/bin.txtar
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,22 +4,18 @@ A set of files representing a build, but with no content in the binary files.
-- go1.23-0def9d5c-20240709.2.linux-amd64.tar.gz.sha256 --
4d43335c30e564053b32a0f4489eeaf399d49fe5a201961a573e42234201e5d3 go1.23-0def9d5c-20240709.2.linux-amd64.tar.gz
-- go1.23-0def9d5c-20240709.2.linux-amd64.tar.gz.sig --
-- go1.23-0def9d5c-20240709.2.linux-amd64.tar.gz.asc --
-- go1.23-0def9d5c-20240709.2.linux-arm64.tar.gz --
-- go1.23-0def9d5c-20240709.2.linux-arm64.tar.gz.sha256 --
4ff938e9b8bafe42809d441ec288679fb9759b34a5c4b162e0e4c335ecb4bcdd go1.23-0def9d5c-20240709.2.linux-arm64.tar.gz
-- go1.23-0def9d5c-20240709.2.linux-arm64.tar.gz.sig --
-- go1.23-0def9d5c-20240709.2.linux-arm64.tar.gz.asc --
-- go1.23-0def9d5c-20240709.2.linux-armv6l.tar.gz --
-- go1.23-0def9d5c-20240709.2.linux-armv6l.tar.gz.sha256 --
11cb59a7da47abfdb8b88be7339d97ce1e9e0ca3ebd8e0fbdc1cfde73d547279 go1.23-0def9d5c-20240709.2.linux-armv6l.tar.gz
-- go1.23-0def9d5c-20240709.2.linux-armv6l.tar.gz.sig --
-- go1.23-0def9d5c-20240709.2.linux-armv6l.tar.gz.asc --
-- go1.23-0def9d5c-20240709.2.src.tar.gz --
-- go1.23-0def9d5c-20240709.2.src.tar.gz.sha256 --
e18be7a50671fa8fce652bf58cb5e0960b2ebcd064d526c7616274ad3799a1cf go1.23-0def9d5c-20240709.2.src.tar.gz
-- go1.23-0def9d5c-20240709.2.src.tar.gz.sig --
-- go1.23-0def9d5c-20240709.2.src.tar.gz.asc --
-- go1.23-0def9d5c-20240709.2.windows-amd64.zip --
-- go1.23-0def9d5c-20240709.2.windows-amd64.zip.sha256 --
cd6a8dc304f80147155fb3aded2e714238a4a7f939fb57e47f4b75281e662555 go1.23-0def9d5c-20240709.2.windows-amd64.zip
Binary file modified buildmodel/buildassets/testdata/1.23dev-publish/msGo.output.manifest.json
View file
Open in desktop
Binary file not shown.
9 changes: 3 additions & 6 deletions ...s/testdata/TestBuildResultsDirectoryInfo_GoldenCreateSummary/1.17-build/result.golden.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,7 @@
"sha256": "0000000000000000000000000000000000000000000000000000000000000000",
"url": "https://example.org/go.linux-amd64.tar.gz",
"sha256ChecksumUrl": "https://example.org/go.linux-amd64.tar.gz.sha256",
"pgpSignatureUrl": "https://example.org/go.linux-amd64.tar.gz.sig",
"ascSignatureUrl": "https://example.org/go.linux-amd64.tar.gz.asc"
"pgpSignatureUrl": "https://example.org/go.linux-amd64.tar.gz.sig"
},
{
"env": {
Expand All @@ -22,8 +21,7 @@
"sha256": "0000000000000000000000000000000000000000000000000000000000000000",
"url": "https://example.org/go.linux-arm64.tar.gz",
"sha256ChecksumUrl": "https://example.org/go.linux-arm64.tar.gz.sha256",
"pgpSignatureUrl": "https://example.org/go.linux-arm64.tar.gz.sig",
"ascSignatureUrl": "https://example.org/go.linux-arm64.tar.gz.asc"
"pgpSignatureUrl": "https://example.org/go.linux-arm64.tar.gz.sig"
},
{
"env": {
Expand All @@ -34,8 +32,7 @@
"sha256": "0000000000000000000000000000000000000000000000000000000000000000",
"url": "https://example.org/go.linux-armv6l.tar.gz",
"sha256ChecksumUrl": "https://example.org/go.linux-armv6l.tar.gz.sha256",
"pgpSignatureUrl": "https://example.org/go.linux-armv6l.tar.gz.sig",
"ascSignatureUrl": "https://example.org/go.linux-armv6l.tar.gz.asc"
"pgpSignatureUrl": "https://example.org/go.linux-armv6l.tar.gz.sig"
}
],
"goSrcURL": "",
Expand Down
12 changes: 4 additions & 8 deletions ...tdata/TestBuildResultsDirectoryInfo_GoldenCreateSummary/1.23dev-publish/result.golden.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,7 @@
"sha256": "11cb59a7da47abfdb8b88be7339d97ce1e9e0ca3ebd8e0fbdc1cfde73d547279",
"url": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/4f51/go1.23-0def9d5c-20240709.2.linux-armv6l.tar.gz",
"sha256ChecksumUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/3df7/go1.23-0def9d5c-20240709.2.linux-armv6l.tar.gz.sha256",
"pgpSignatureUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/c211/go1.23-0def9d5c-20240709.2.linux-armv6l.tar.gz.sig",
"ascSignatureUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/c211/go1.23-0def9d5c-20240709.2.linux-armv6l.tar.gz.asc"
"pgpSignatureUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/c211/go1.23-0def9d5c-20240709.2.linux-armv6l.tar.gz.sig"
},
{
"env": {
Expand All @@ -32,8 +31,7 @@
"sha256": "4d43335c30e564053b32a0f4489eeaf399d49fe5a201961a573e42234201e5d3",
"url": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/c226/go1.23-0def9d5c-20240709.2.linux-amd64.tar.gz",
"sha256ChecksumUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/3507/go1.23-0def9d5c-20240709.2.linux-amd64.tar.gz.sha256",
"pgpSignatureUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/20eb/go1.23-0def9d5c-20240709.2.linux-amd64.tar.gz.sig",
"ascSignatureUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/20eb/go1.23-0def9d5c-20240709.2.linux-amd64.tar.gz.asc"
"pgpSignatureUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/20eb/go1.23-0def9d5c-20240709.2.linux-amd64.tar.gz.sig"
},
{
"env": {
Expand All @@ -43,15 +41,13 @@
"sha256": "4ff938e9b8bafe42809d441ec288679fb9759b34a5c4b162e0e4c335ecb4bcdd",
"url": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/cee0/go1.23-0def9d5c-20240709.2.linux-arm64.tar.gz",
"sha256ChecksumUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/a6f0/go1.23-0def9d5c-20240709.2.linux-arm64.tar.gz.sha256",
"pgpSignatureUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/c815f/go1.23-0def9d5c-20240709.2.linux-arm64.tar.gz.sig",
"ascSignatureUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/c815f/go1.23-0def9d5c-20240709.2.linux-arm64.tar.gz.asc"
"pgpSignatureUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/c815f/go1.23-0def9d5c-20240709.2.linux-arm64.tar.gz.sig"
},
{
"sha256": "e18be7a50671fa8fce652bf58cb5e0960b2ebcd064d526c7616274ad3799a1cf",
"url": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/e035/go1.23-0def9d5c-20240709.2.src.tar.gz",
"sha256ChecksumUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/85a9/go1.23-0def9d5c-20240709.2.src.tar.gz.sha256",
"pgpSignatureUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/eb070/go1.23-0def9d5c-20240709.2.src.tar.gz.sig",
"ascSignatureUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/eb070/go1.23-0def9d5c-20240709.2.src.tar.gz.asc"
"pgpSignatureUrl": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/eb070/go1.23-0def9d5c-20240709.2.src.tar.gz.sig"
}
],
"goSrcURL": "https://download.visualstudio.microsoft.com/download/pr/1234-56-78-123456/e035/go1.23-0def9d5c-20240709.2.src.tar.gz",
Expand Down
10 changes: 2 additions & 8 deletions buildmodel/dockerversions/dockerversions.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,17 +85,11 @@ type Arch struct {
// If not specified, the file can be reached by appending ".sha256" to the URL.
SHA256ChecksumURL string `json:"sha256ChecksumUrl,omitempty"`

// PGPSignatureURL is the URL of a PGP signature file (.sig) for this artifact, commonly
// verified using the "gpg" tool.
// PGPSignatureURL is the URL of a PGP signature file for this artifact, commonly verified using
// the "gpg" tool.
//
// If not specified, the file can be reached by appending ".sig" to the URL.
PGPSignatureURL string `json:"pgpSignatureUrl,omitempty"`

// ASCSignatureURL is the URL of a .asc copy of the PGP signature for this artifact. It holds
// identical content to the .sig file, published under the ".asc" name that some tools expect.
//
// If not specified, the file can be reached by appending ".asc" to the URL.
ASCSignatureURL string `json:"ascSignatureUrl,omitempty"`
}

// ArchEnv is the environment an artifact is expected to be useful in.
Expand Down
2 changes: 0 additions & 2 deletions cmd/releasego/akams_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,13 +43,11 @@ func Test_createLinkPairs(t *testing.T) {
URL: "https://download.visualstudio.microsoft.com/download/pr/8330ba2b/333aa/go1.23-90bcc55-20240626.1.linux-amd64.tar.gz",
SHA256ChecksumURL: "https://download.visualstudio.microsoft.com/download/pr/8330ba2b/87654/go1.23-90bcc55-20240626.1.linux-amd64.tar.gz.sha256",
PGPSignatureURL: "https://download.visualstudio.microsoft.com/download/pr/8330ba2b/12345/go1.23-90bcc55-20240626.1.linux-amd64.tar.gz.sig",
ASCSignatureURL: "https://download.visualstudio.microsoft.com/download/pr/8330ba2b/12346/go1.23-90bcc55-20240626.1.linux-amd64.tar.gz.asc",
},
{
URL: "https://download.visualstudio.microsoft.com/download/pr/8330ba2b/3b32d/go1.23-90bcc55-20240626.1.src.tar.gz",
SHA256ChecksumURL: "https://download.visualstudio.microsoft.com/download/pr/8330ba2b/66dda/go1.23-90bcc55-20240626.1.src.tar.gz.sha256",
PGPSignatureURL: "https://download.visualstudio.microsoft.com/download/pr/8330ba2b/af253/go1.23-90bcc55-20240626.1.src.tar.gz.sig",
ASCSignatureURL: "https://download.visualstudio.microsoft.com/download/pr/8330ba2b/af254/go1.23-90bcc55-20240626.1.src.tar.gz.asc",
},
},
GoSrcURL: "https://download.visualstudio.microsoft.com/download/pr/8330ba2b/3b32d/go1.23-90bcc55-20240626.1.src.tar.gz",
Expand Down
8 changes: 0 additions & 8 deletions cmd/releasego/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,6 @@ func appendPathAndVerificationFilePaths(p []string, path string) []string {
p = append(p, path, path+".sha256")
if strings.HasSuffix(path, ".tar.gz") {
p = append(p, path+".sig")
p = append(p, path+".asc")
}
return p
}
Expand Down Expand Up @@ -79,13 +78,6 @@ func appendReleaseURLs(urls []string, assets *buildassets.BuildAssets, assetJSON
} else {
urls = append(urls, a.PGPSignatureURL)
}
if a.ASCSignatureURL == "" {
if strings.HasSuffix(a.URL, ".tar.gz") {
urls = append(urls, a.URL+".asc")
}
} else {
urls = append(urls, a.ASCSignatureURL)
}
}
if !addedSrc {
// If there wasn't a source archive in the "arches" section, apply a URL suffix convention.
Expand Down
6 changes: 0 additions & 6 deletions cmd/releasego/testdata/Test_createLinkPairs/blob/aka.golden.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,27 +1,21 @@
testing/go1.17.linux-amd64.tar.gz -> https://example.org/golang/build/1234.10/go.1234.10.linux-amd64.tar.gz
testing/go1.17.linux-amd64.tar.gz.sha256 -> https://example.org/golang/build/1234.10/go.1234.10.linux-amd64.tar.gz.sha256
testing/go1.17.linux-amd64.tar.gz.sig -> https://example.org/golang/build/1234.10/go.1234.10.linux-amd64.tar.gz.sig
testing/go1.17.linux-amd64.tar.gz.asc -> https://example.org/golang/build/1234.10/go.1234.10.linux-amd64.tar.gz.asc
testing/go1.17.src.tar.gz -> https://example.org/golang/build/1234.10/go.1234.10.src.tar.gz
testing/go1.17.src.tar.gz.sha256 -> https://example.org/golang/build/1234.10/go.1234.10.src.tar.gz.sha256
testing/go1.17.src.tar.gz.sig -> https://example.org/golang/build/1234.10/go.1234.10.src.tar.gz.sig
testing/go1.17.src.tar.gz.asc -> https://example.org/golang/build/1234.10/go.1234.10.src.tar.gz.asc
testing/go1.17.assets.json -> https://example.org/golang/build/1234.10/assets.json
testing/go1.17.7.linux-amd64.tar.gz -> https://example.org/golang/build/1234.10/go.1234.10.linux-amd64.tar.gz
testing/go1.17.7.linux-amd64.tar.gz.sha256 -> https://example.org/golang/build/1234.10/go.1234.10.linux-amd64.tar.gz.sha256
testing/go1.17.7.linux-amd64.tar.gz.sig -> https://example.org/golang/build/1234.10/go.1234.10.linux-amd64.tar.gz.sig
testing/go1.17.7.linux-amd64.tar.gz.asc -> https://example.org/golang/build/1234.10/go.1234.10.linux-amd64.tar.gz.asc
testing/go1.17.7.src.tar.gz -> https://example.org/golang/build/1234.10/go.1234.10.src.tar.gz
testing/go1.17.7.src.tar.gz.sha256 -> https://example.org/golang/build/1234.10/go.1234.10.src.tar.gz.sha256
testing/go1.17.7.src.tar.gz.sig -> https://example.org/golang/build/1234.10/go.1234.10.src.tar.gz.sig
testing/go1.17.7.src.tar.gz.asc -> https://example.org/golang/build/1234.10/go.1234.10.src.tar.gz.asc
testing/go1.17.7.assets.json -> https://example.org/golang/build/1234.10/assets.json
testing/go1.17.7-1.linux-amd64.tar.gz -> https://example.org/golang/build/1234.10/go.1234.10.linux-amd64.tar.gz
testing/go1.17.7-1.linux-amd64.tar.gz.sha256 -> https://example.org/golang/build/1234.10/go.1234.10.linux-amd64.tar.gz.sha256
testing/go1.17.7-1.linux-amd64.tar.gz.sig -> https://example.org/golang/build/1234.10/go.1234.10.linux-amd64.tar.gz.sig
testing/go1.17.7-1.linux-amd64.tar.gz.asc -> https://example.org/golang/build/1234.10/go.1234.10.linux-amd64.tar.gz.asc
testing/go1.17.7-1.src.tar.gz -> https://example.org/golang/build/1234.10/go.1234.10.src.tar.gz
testing/go1.17.7-1.src.tar.gz.sha256 -> https://example.org/golang/build/1234.10/go.1234.10.src.tar.gz.sha256
testing/go1.17.7-1.src.tar.gz.sig -> https://example.org/golang/build/1234.10/go.1234.10.src.tar.gz.sig
testing/go1.17.7-1.src.tar.gz.asc -> https://example.org/golang/build/1234.10/go.1234.10.src.tar.gz.asc
testing/go1.17.7-1.assets.json -> https://example.org/golang/build/1234.10/assets.json
Loading
Loading