Skip to content

Document StoreKit2 RC1 provenance #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Kapusch merged 1 commit into from
Jul 16, 2026
Merged

Document StoreKit2 RC1 provenance #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 18 additions & 1 deletion Docs/Release.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,22 @@ an immutable full commit SHA or an existing tag. The workflow resolves the input
commit, and requires it to be an ancestor of `origin/master`. A deleted release branch name is not
durable provenance; its retained commit or tag is.

## Historical `1.0.0-rc.1` provenance

The already-published `Kapusch.StoreKit2.iOS` `1.0.0-rc.1` package predates this workflow and has two
immutable historical records that do not point to the same commit:

- the package nuspec records repository commit `f453c9da75a99e3d2ea45de9b78314afd332ebda` and branch
`refs/heads/release/1.0.0`;
- the annotated `v1.0.0-rc.1` tag object `fcef88b6b576c3349c6bc39c02a38150ee9df735` targets commit
`27cc3daaa47a45f80399736880bef4df9f6d025e`;
- the immutable NuGet downloaded from the official V3 flat container has SHA-256
`3597ea716e0bcdbcca6942e66bd5348589d9422affab0992eda7814c1f3311cb`.

Both commits are reachable from `master`. Preserve the mismatch: do not move the tag and do not
republish `1.0.0-rc.1`. For this legacy version, the nuspec commit is the package build provenance;
the existing tag is a separate retained source milestone.

## Required validation

Run these commands on macOS with Xcode 26.3 selected before release work is merged:
Expand Down Expand Up @@ -92,4 +108,5 @@ git rev-list --count origin/master..origin/release/1.0.0
```

Only then may `release/1.0.0` be deleted remotely and locally. Branch deletion must not delete or
retarget any historical tag; tags remain the permanent package provenance record.
retarget any historical tag. Tags remain permanent source records, while published package metadata
and recorded hashes remain the authoritative package build provenance.
Loading