Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Blog and documentation for performing "3rd Party Reproducible Verification Builds" #2949

Merged
merged 63 commits into from
Aug 9, 2024

Conversation

andrew-m-leonard
Copy link
Contributor

@andrew-m-leonard andrew-m-leonard commented Jul 11, 2024

Fixes #2938

This PR delivers a new blog "Eclipse Temurin Reproducible Verification Builds for Secure Supply Chain Validation"
and 3 new documents describing how to perform 3rd Party Reproducible Verification Builds :

  • Temurin Reproducible Verification Build on Linux x86-64
  • Temurin Reproducible Verification Build on Linux aarch64
  • Temurin Reproducible Verification Build on Windows x64

A high-level "blog" will be created that references these 3 documents, describing the process and why you might want to perform a verification build.

Checklist

  • npm test passes
  • documentation is changed or added (if applicable)
  • permission has been obtained to add new logo (if applicable)
  • contribution guidelines followed here

@andrew-m-leonard andrew-m-leonard self-assigned this Jul 11, 2024
Copy link

netlify bot commented Jul 11, 2024

Deploy Preview for eclipsefdn-adoptium ready!

Name Link
🔨 Latest commit 07763f9
🔍 Latest deploy log https://app.netlify.com/sites/eclipsefdn-adoptium/deploys/66b62d7595449b00086bbef7
😎 Deploy Preview https://deploy-preview-2949--eclipsefdn-adoptium.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@andrew-m-leonard andrew-m-leonard marked this pull request as draft July 11, 2024 14:21
Copy link

codecov bot commented Jul 11, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 99.47%. Comparing base (d757dc9) to head (ac5f742).
Report is 3 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #2949   +/-   ##
=======================================
  Coverage   99.47%   99.47%           
=======================================
  Files          90       90           
  Lines        4931     4932    +1     
  Branches      614      614           
=======================================
+ Hits         4905     4906    +1     
  Misses         26       26           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@sxa sxa self-requested a review July 25, 2024 13:55
Signed-off-by: Andrew Leonard <[email protected]>
Signed-off-by: Andrew Leonard <[email protected]>
Signed-off-by: Andrew Leonard <[email protected]>
Signed-off-by: Andrew Leonard <[email protected]>
Signed-off-by: Andrew Leonard <[email protected]>
Signed-off-by: Andrew Leonard <[email protected]>
Signed-off-by: Andrew Leonard <[email protected]>
@andrew-m-leonard andrew-m-leonard changed the title Additional documentation for performing "3rd Party Reproducible Verification Builds" Blog and documentation for performing "3rd Party Reproducible Verification Builds" Aug 1, 2024
@andrew-m-leonard
Copy link
Contributor Author

A couple of initial thoughts before I go into the detail of the content (I'll have a go at testing the windows instructions shortly as I read it!)

1. We should probably make this easier to find. I don't think we've got any way of navigating to these new pieces of documentation via the web site.

2. The URL on the windows one has `x64` in it but the linux one has `x86-64` - A bit of a nit but I think we should standardise on one other other (probably x64 since that's what we call it on the download page)
   Convenience links for me (and other reviewers):


* https://deploy-preview-2949--eclipsefdn-adoptium.netlify.app/docs/reproducible-builds/reproduce-windows-x64/

* https://deploy-preview-2949--eclipsefdn-adoptium.netlify.app/docs/reproducible-builds/reproduce-linux-x86-64/

* https://deploy-preview-2949--eclipsefdn-adoptium.netlify.app/docs/reproducible-builds/reproduce-linux-aarch64/

* https://deploy-preview-2949--eclipsefdn-adoptium.netlify.app/blog/2024/08/adoptium-reproducible-verification-builds/

@sxa thank you for your reviews. Yes, I thought I had achieved this to place them under the main Docs tiles, but I needed to update the index docs.tsx. Hopefully that looks better now under the "Secure Software" tile: https://deploy-preview-2949--eclipsefdn-adoptium.netlify.app/en-GB/docs/

@sxa
Copy link
Member

sxa commented Aug 8, 2024

A couple of initial thoughts before I go into the detail of the content (I'll have a go at testing the windows instructions shortly as I read it!)

1. We should probably make this easier to find. I don't think we've got any way of navigating to these new pieces of documentation via the web site.

2. The URL on the windows one has `x64` in it but the linux one has `x86-64` - A bit of a nit but I think we should standardise on one other other (probably x64 since that's what we call it on the download page)
   Convenience links for me (and other reviewers):


* https://deploy-preview-2949--eclipsefdn-adoptium.netlify.app/docs/reproducible-builds/reproduce-windows-x64/
* https://deploy-preview-2949--eclipsefdn-adoptium.netlify.app/docs/reproducible-builds/reproduce-linux-x86-64/
* https://deploy-preview-2949--eclipsefdn-adoptium.netlify.app/docs/reproducible-builds/reproduce-linux-aarch64/
* https://deploy-preview-2949--eclipsefdn-adoptium.netlify.app/blog/2024/08/adoptium-reproducible-verification-builds/

@sxa thank you for your reviews. Yes, I thought I had achieved this to place them under the main Docs tiles, but I needed to update the index docs.tsx. Hopefully that looks better now under the "Secure Software" tile: https://deploy-preview-2949--eclipsefdn-adoptium.netlify.app/en-GB/docs/

Yep that's much better (Although the links aren't currently pointing to the right place by the look of it - the entries on https://deploy-preview-2949--eclipsefdn-adoptium.netlify.app/en-GB/docs/reproducible-verification-builds/ are giving 404s) ... Although the direct preview links that I mentioned last night aren't working either now so perhaps the page names have moved and need to be fixed now :-)

@andrew-m-leonard andrew-m-leonard requested review from jiekang and sxa August 8, 2024 12:58
@jiekang
Copy link
Contributor

jiekang commented Aug 8, 2024

Thanks Andrew for putting all this together! I'll try to do a final review round in my afternoon today. It would be great to see this published some time tomorrow (Friday, August 9, 2024).

Copy link
Contributor

@smlambert smlambert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well done @andrew-m-leonard !

@andrew-m-leonard andrew-m-leonard merged commit 0440c07 into adoptium:main Aug 9, 2024
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Blog on performing a secure 3rd party Temurin jdk-21+ reproducible verification build
4 participants