Issue 31 changelog

MANIFEST.in

@@ -1,6 +1,7 @@
 include LICENSE
 include README.md
 include securedrop_proxy/VERSION
+include changelog.md
 include config-example.yaml
 include qubes/securedrop.Proxy
 include build-requirements.txt

README.md

@@ -48,11 +48,12 @@ the updated dependency to our pip mirror (you can request this in the PR).
 
 **Note:** These are the release guidelines for pre-production alpha releases. Production release tags must be signed with the SecureDrop release key.
 
- 1. Update versions: `./update_version.sh $new_version_number`.
+1. Update versions: `./update_version.sh $new_version_number` and add a new entry in the changelog.
 2. Commit the changes with commit message `securedrop-proxy $new_version_number` and make a PR.
 3. You should confirm via a manual debian package build and manual testing in Qubes that there are no regressions (this is limited pre-release QA).
 4. Once your PR is approved, you can add a tag and push: `git tag $new_version_number`.
 
+
 #### configuration
 
 The proxy script must be run with the path to its configuration file

changelog.md

@@ -0,0 +1,28 @@
+# Changelog
+
+## 0.1.4
+
+  * Update urllib3 to version 1.24.3 or later due to CVE-2019-11324 (#35)
+  * Remove pipenv in favor of pip-tools (#33)
+
+## 0.1.3
+
+  * Updated PyYAML to 5.1 and safe loading of YAML files
+    #24 and #25
+
+## 0.1.2
+
+  * Update requirements: Remove dev requirements (#20), update wheel hashes
+    (#21)
+
+## 0.1.1-1
+
+  * Resolves venv paths in generated scripts (via dh-virtualenv)
+
+## 0.1.1
+
+  * Update requests to 2.20.0
+
+## 0.1.0
+
+  * Initial release. (Closes: #XXX)