Skip to content

docs: document release integrity for 2.0.0 #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Nico77600 wants to merge 1 commit into from
Closed

docs: document release integrity for 2.0.0 #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,14 @@ The `package` folder of the repository holds exactly the files needed to run, wi

Both guides also exist as a single HTML file with a light and a dark theme (`package/docs/ExchangeMailboxMigration-UserGuide.html`, `package/docs/ExchangeMailboxMigration-Guide.html`): download them and open them locally, or use the copies in the release zip.

## Release integrity

The public repository protects `main` with pull requests, the required Windows PowerShell 5.1 validation, and no deletion or non-fast-forward updates. Published `v*` tags are also protected against updates and deletion.

The workflow [.github/workflows/attest-release.yml](.github/workflows/attest-release.yml) creates a GitHub artifact attestation for the exact ZIP assets of a published release. It can be run manually from `main` with an explicit tag for an existing release. This attestation binds the distributed ZIP bytes to this repository and workflow; it is not an Authenticode signature and does not replace source review or the existing tests.

`v2.0.0` and its ZIP are already published and immutable. This version is not replaced or retagged. A future release containing Authenticode-signed runtime scripts must use a new version and a new `v*` tag.

## Tests

```powershell
Expand Down
8 changes: 8 additions & 0 deletions package/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,14 @@ notepad .\config\ExchangeMailboxMigration.config.psd1 # Databases: source a
- [User guide](docs/ExchangeMailboxMigration-UserGuide.md) - the path step by step, also `docs/ExchangeMailboxMigration-UserGuide.html`, a single file to open locally
- [Developer guide](docs/ExchangeMailboxMigration-Guide.md) - everything else, also `docs/ExchangeMailboxMigration-Guide.html`, a single file to open locally

## Release integrity

Download releases only from the official project page. The `main` branch is protected by pull requests and the required Windows PowerShell 5.1 validation, and published `v*` tags cannot be changed or deleted.

The project publishes GitHub artifact attestations for release ZIP assets with [the attestation workflow](https://github.com/Nico77600/ExchangeMailboxMigration/blob/main/.github/workflows/attest-release.yml). An attestation binds the exact distributed ZIP bytes to this repository and workflow; it is not an Authenticode signature.

The `v2.0.0` tag and ZIP are already published and immutable. A future ZIP with Authenticode-signed runtime scripts must use a new version rather than replacing this release.

Project page, releases and change log: https://github.com/Nico77600/ExchangeMailboxMigration

License: [MIT](LICENSE).
Expand Down
Loading