fix(release): attribute desktop candidates to the operator - #6831
Merged
Conversation
The desktop release tooling hardcoded Wes's personal identity into every release candidate commit: prepare-desktop-release.sh committed with a `git -c user.name='Wes'` override and the validator required exactly that author plus a matching Signed-off-by. That leaked from one contributor's setup, so a candidate cut by anyone else was falsely attributed to and signed off by Wes. Commit the candidate with the operator's own configured identity and validate the sign-off structurally: the author must be non-empty and the body must carry a Signed-off-by trailer matching that author (honest DCO), alongside the existing automation Co-authored-by trailer. Release authorization is bound via the PR API in verify-desktop-release-merge.sh, not the author field, so this does not weaken the trust model. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
The prior sign-off check used an unanchored `f"Signed-off-by: {author}"
in body` substring test, which accepted a prose line merely containing
the trailer text and a real trailer with trailing garbage. The empty
author guard was also ineffective: `%an <%ae>` renders `" <>"` for an
empty raw author, which is truthy.
Read the author name and email separately (rejecting either empty), and
require exactly one Signed-off-by line matching the author with a
both-ends-anchored multiline regex. Tests add prose-embedded, trailing-
garbage, and duplicate-trailer rejection cases alongside the existing
author mismatch case.
Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
wpfleger96
pushed a commit
that referenced
this pull request
Aug 25, 2026
…-history * origin/main: feat(desktop): add KLIPY GIF search to composers (#5554) fix(desktop): respect automatic mention preference after send (#6837) fix(release): attribute desktop candidates to the operator (#6831) fix(ci): check out source in docker.yml merge job (#6833) chore(release): release Buzz Desktop version 0.5.19 (#6828) Remove public relay signing key fallback (#6729) docs(nest): make commit attribution policy-neutral (#6707) fix(desktop-messages): preserve inline agent mentions with persistent addressing (#6793) Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The desktop release tooling hardcoded one contributor's personal identity into every release candidate commit.
scripts/prepare-desktop-release.shcommitted the candidate with agit -c user.name='Wes' -c user.email='wesbillman@users.noreply.github.com'override, andscripts/desktop_release.pyvalidaterequired the candidate author to be exactlyWes <wesbillman@users.noreply.github.com>plus a matchingSigned-off-bytrailer. That leaked from Wes's working setup into the validation contract in #3568, so a release cut by any other operator was falsely attributed to and signed off by Wes (as happened on #6828).Change
prepare-desktop-release.sh: drop the-cidentity overrides sogit commit -suses the operator's own configured identity to author and sign off the candidate. The automationCo-authored-bytrailer is unchanged.desktop_release.pyvalidate: replace the exact-Wes checks with structural ones — the commit author must be non-empty, the body must contain aSigned-off-bytrailer whose name and email match the commit author (honest DCO), and the existing automationCo-authored-byregex check stays. Failure messages remain specific.test-desktop-release-candidate.sh: the fixture candidate now commits under the harness's own identity, and a new negative case rewrites the author to a mismatched identity and asserts the validator rejects it.Release authorization is bound to the merged PR via the GitHub API in
scripts/verify-desktop-release-merge.sh, never the commit author field, so this does not weaken the trust model.RELEASING.mdand.github/workflows/desktop-release-candidate.ymlreference no author identity and need no change.Verified locally:
scripts/test-desktop-release-candidate.shpasses, including the new sign-off/author-mismatch rejection.