Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cosign versioning policy: make one and enforce it #2518

Open
znewman01 opened this issue Dec 6, 2022 · 3 comments
Open

Cosign versioning policy: make one and enforce it #2518

znewman01 opened this issue Dec 6, 2022 · 3 comments
Assignees
@znewman01 @ivanayov
Labels
bug Something isn't working

Comments

@znewman01
Copy link
Contributor

See Proposal: Cosign Versioning and #2365
@znewman01 znewman01 added the bug Something isn't working label Dec 6, 2022
@znewman01 znewman01 self-assigned this Dec 6, 2022
znewman01 added a commit to znewman01/cosign that referenced this issue Dec 7, 2022
@znewman01
Add versioning policy.
702f96e 
Addresses (does not fix) sigstore#2518.

This follows [Proposal: Cosign Versioning][versioning-proposal], which in turn
follows sigstore#2365.

After getting approval on this PR, I will update sigstore#2518 to include a checklist
containing the following (possibly linking to separate bugs):

- [ ] (docs) Communicate the new version policy to Cosign users.
- [ ] (process/CI) Separate CLI and API releases (with different tagging schemes).
- [ ] (process/CI) Use gorelease or similar to catch breaking API changes.
- [ ] (code) Add library support for deprecations (see also sigstore#2510)
- [ ] (testing) E2E testing for old Cosign versions (Also client libraries, once they're stable).

[versioning-proposal]: https://docs.google.com/document/d/1urWUPhtzXKWqL9CoaEw4Z35v5IDl9yrTRQ40XlYekOo/edit#

Signed-off-by: Zachary Newman <[email protected]>
@znewman01 znewman01 mentioned this issue Dec 7, 2022
Merged
5 tasks
znewman01 added a commit to znewman01/cosign that referenced this issue Dec 7, 2022
@znewman01
Add versioning policy.
07b3a9e 
Addresses (does not fix) sigstore#2518.

This follows [Proposal: Cosign Versioning][versioning-proposal], which in turn
follows sigstore#2365.

After getting approval on this PR, I will update sigstore#2518 to include a checklist
containing the following (possibly linking to separate bugs):

- [ ] (docs) Communicate the new version policy to Cosign users.
- [ ] (process/CI) Separate CLI and API releases (with different tagging schemes).
- [ ] (process/CI) Use gorelease or similar to catch breaking API changes.
- [ ] (code) Add library support for deprecations (see also sigstore#2510)
- [ ] (testing) E2E testing for old Cosign versions (Also client libraries, once they're stable).

[versioning-proposal]: https://docs.google.com/document/d/1urWUPhtzXKWqL9CoaEw4Z35v5IDl9yrTRQ40XlYekOo/edit#

Signed-off-by: Zachary Newman <[email protected]>
znewman01 added a commit to znewman01/cosign that referenced this issue Dec 7, 2022
@znewman01
Add versioning policy.
c904794 
Addresses (does not fix) sigstore#2518.

This follows [Proposal: Cosign Versioning][versioning-proposal], which in turn
follows sigstore#2365.

After getting approval on this PR, I will update sigstore#2518 to include a checklist
containing the following (possibly linking to separate bugs):

- [ ] (docs) Communicate the new version policy to Cosign users.
- [ ] (process/CI) Separate CLI and API releases (with different tagging schemes).
- [ ] (process/CI) Use gorelease or similar to catch breaking API changes.
- [ ] (code) Add library support for deprecations (see also sigstore#2510)
- [ ] (testing) E2E testing for old Cosign versions (Also client libraries, once they're stable).

[versioning-proposal]: https://docs.google.com/document/d/1urWUPhtzXKWqL9CoaEw4Z35v5IDl9yrTRQ40XlYekOo/edit#

Signed-off-by: Zachary Newman <[email protected]>
znewman01 added a commit to znewman01/cosign that referenced this issue Dec 19, 2022
@znewman01
Add versioning policy.
72e3026 
Addresses (does not fix) sigstore#2518.

This follows [Proposal: Cosign Versioning][versioning-proposal], which in turn
follows sigstore#2365.

After getting approval on this PR, I will update sigstore#2518 to include a checklist
containing the following (possibly linking to separate bugs):

- [ ] (docs) Communicate the new version policy to Cosign users.
- [ ] (process/CI) Separate CLI and API releases (with different tagging schemes).
- [ ] (process/CI) Use gorelease or similar to catch breaking API changes.
- [ ] (code) Add library support for deprecations (see also sigstore#2510)
- [ ] (testing) E2E testing for old Cosign versions (Also client libraries, once they're stable).

[versioning-proposal]: https://docs.google.com/document/d/1urWUPhtzXKWqL9CoaEw4Z35v5IDl9yrTRQ40XlYekOo/edit#

Signed-off-by: Zachary Newman <[email protected]>
znewman01 added a commit to znewman01/cosign that referenced this issue Jan 2, 2023
@znewman01
Add versioning policy.
97ef361 
Addresses (does not fix) sigstore#2518.

This follows [Proposal: Cosign Versioning][versioning-proposal], which in turn
follows sigstore#2365.

After getting approval on this PR, I will update sigstore#2518 to include a checklist
containing the following (possibly linking to separate bugs):

- [ ] (docs) Communicate the new version policy to Cosign users.
- [ ] (process/CI) Separate CLI and API releases (with different tagging schemes).
- [ ] (process/CI) Use gorelease or similar to catch breaking API changes.
- [ ] (code) Add library support for deprecations (see also sigstore#2510)
- [ ] (testing) E2E testing for old Cosign versions (Also client libraries, once they're stable).

[versioning-proposal]: https://docs.google.com/document/d/1urWUPhtzXKWqL9CoaEw4Z35v5IDl9yrTRQ40XlYekOo/edit#

Signed-off-by: Zachary Newman <[email protected]>
znewman01 added a commit to znewman01/cosign that referenced this issue Jan 14, 2023
@znewman01
Add versioning policy.
154e727 
Addresses (does not fix) sigstore#2518.

This follows [Proposal: Cosign Versioning][versioning-proposal], which in turn
follows sigstore#2365.

After getting approval on this PR, I will update sigstore#2518 to include a checklist
containing the following (possibly linking to separate bugs):

- [ ] (docs) Communicate the new version policy to Cosign users.
- [ ] (process/CI) Separate CLI and API releases (with different tagging schemes).
- [ ] (process/CI) Use gorelease or similar to catch breaking API changes.
- [ ] (code) Add library support for deprecations (see also sigstore#2510)
- [ ] (testing) E2E testing for old Cosign versions (Also client libraries, once they're stable).

[versioning-proposal]: https://docs.google.com/document/d/1urWUPhtzXKWqL9CoaEw4Z35v5IDl9yrTRQ40XlYekOo/edit#

Signed-off-by: Zachary Newman <[email protected]>
znewman01 added a commit that referenced this issue Jan 17, 2023
@znewman01
Add versioning policy. (#2519)
6dc6ad2 
* Add versioning policy.

Addresses (does not fix) #2518.

This follows [Proposal: Cosign Versioning][versioning-proposal], which in turn
follows #2365.

After getting approval on this PR, I will update #2518 to include a checklist
containing the following (possibly linking to separate bugs):

- [ ] (docs) Communicate the new version policy to Cosign users.
- [ ] (process/CI) Separate CLI and API releases (with different tagging schemes).
- [ ] (process/CI) Use gorelease or similar to catch breaking API changes.
- [ ] (code) Add library support for deprecations (see also #2510)
- [ ] (testing) E2E testing for old Cosign versions (Also client libraries, once they're stable).

[versioning-proposal]: https://docs.google.com/document/d/1urWUPhtzXKWqL9CoaEw4Z35v5IDl9yrTRQ40XlYekOo/edit#

Signed-off-by: Zachary Newman <[email protected]>

* Reword private-by-default for Sigstore API

Signed-off-by: Zachary Newman <[email protected]>

* Minor rewordings

Signed-off-by: Zachary Newman <[email protected]>

* Another minor rewording

Signed-off-by: Zachary Newman <[email protected]>

Signed-off-by: Zachary Newman <[email protected]>
@znewman01
Copy link
Contributor Author

In order to enforce a versioning policy, we need to do the following:

  • (docs) Communicate the new version policy to Cosign users.
  • (process/CI) Separate CLI and API releases (with different tagging schemes).
  • (process/CI) Use gorelease or similar to catch breaking API changes.
  • (code) Add library support for deprecations (see also Inappropriate printing to STDOUT #2510)
  • (testing) E2E testing for old Cosign versions (Also client libraries, once they're stable).

@ivanayov
Copy link
Contributor

ivanayov commented Mar 6, 2023

Can I work on library support for deprecations?

@znewman01
Copy link
Contributor Author

That would be great @ivanayov !

I'd recommend approaching it as follows:

  • add a Deprecated function somewhere in internal that takes parameters for deprecated date, GH issue, feature description, and recommended alternative that outputs a message (via ui.Warn) like

    is deprecated and will be removed in a Cosign release shortly after . Instead, please .

    See for details.

    This should be pretty easy and can be done ASAP.

  • add a new linter to golangci-lint (reference) that checks that all calls to Deprecate have a proper date and GitHub issue and a GitHub actions workflow that pings the GitHub issue when the date is coming back

dmitris pushed a commit to dmitris/cosign that referenced this issue Mar 24, 2023
@znewman01 @dmitris
Add versioning policy. (sigstore#2519)
dcf6607 
* Add versioning policy.

Addresses (does not fix) sigstore#2518.

This follows [Proposal: Cosign Versioning][versioning-proposal], which in turn
follows sigstore#2365.

After getting approval on this PR, I will update sigstore#2518 to include a checklist
containing the following (possibly linking to separate bugs):

- [ ] (docs) Communicate the new version policy to Cosign users.
- [ ] (process/CI) Separate CLI and API releases (with different tagging schemes).
- [ ] (process/CI) Use gorelease or similar to catch breaking API changes.
- [ ] (code) Add library support for deprecations (see also sigstore#2510)
- [ ] (testing) E2E testing for old Cosign versions (Also client libraries, once they're stable).

[versioning-proposal]: https://docs.google.com/document/d/1urWUPhtzXKWqL9CoaEw4Z35v5IDl9yrTRQ40XlYekOo/edit#

Signed-off-by: Zachary Newman <[email protected]>

* Reword private-by-default for Sigstore API

Signed-off-by: Zachary Newman <[email protected]>

* Minor rewordings

Signed-off-by: Zachary Newman <[email protected]>

* Another minor rewording

Signed-off-by: Zachary Newman <[email protected]>

Signed-off-by: Zachary Newman <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@znewman01 znewman01

@ivanayov ivanayov

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@znewman01 @ivanayov