doing-a-release.rst 3.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100
  1. Doing a release
  2. ===============
  3. Doing a release of ``cryptography`` requires a few steps.
  4. Security Releases
  5. -----------------
  6. In addition to the other steps described below, for a release which fixes a
  7. security vulnerability, you should also include the following steps:
  8. * Request a `CVE from MITRE`_. Once you have received the CVE, it should be
  9. included in the :doc:`changelog`. Ideally you should request the CVE before
  10. starting the release process so that the CVE is available at the time of the
  11. release.
  12. * Ensure that the :doc:`changelog` entry credits whoever reported the issue.
  13. * The release should be announced on the `oss-security`_ mailing list, in
  14. addition to the regular announcement lists.
  15. Verifying OpenSSL version
  16. -------------------------
  17. The release process creates wheels bundling OpenSSL for Windows, macOS, and
  18. Linux. Check that the Windows, macOS, and Linux builders (both
  19. ``pyca/cryptography-manylinux1`` and ``pyca/cryptography-manylinux2010``) have
  20. the latest OpenSSL. If anything is out of date follow the instructions for
  21. upgrading OpenSSL.
  22. Upgrading OpenSSL
  23. -----------------
  24. Use the `upgrading OpenSSL issue template`_.
  25. Bumping the version number
  26. --------------------------
  27. The next step in doing a release is bumping the version number in the
  28. software.
  29. * Update the version number in ``src/cryptography/__about__.py``.
  30. * Update the version number in ``vectors/cryptography_vectors/__about__.py``.
  31. * Set the release date in the :doc:`/changelog`.
  32. * Do a commit indicating this.
  33. * Send a pull request with this.
  34. * Wait for it to be merged.
  35. Performing the release
  36. ----------------------
  37. The commit that merged the version number bump is now the official release
  38. commit for this release. You will need to have ``gpg`` installed and a ``gpg``
  39. key in order to do a release. Once this has happened:
  40. * Run ``python release.py {version}``.
  41. The release should now be available on PyPI and a tag should be available in
  42. the repository.
  43. Verifying the release
  44. ---------------------
  45. You should verify that ``pip install cryptography`` works correctly:
  46. .. code-block:: pycon
  47. >>> import cryptography
  48. >>> cryptography.__version__
  49. '...'
  50. >>> import cryptography_vectors
  51. >>> cryptography_vectors.__version__
  52. '...'
  53. Verify that this is the version you just released.
  54. For the Windows wheels check the builds for the ``cryptography-wheel-builder``
  55. job and verify that the final output for each build shows it loaded and linked
  56. the expected OpenSSL version.
  57. Post-release tasks
  58. ------------------
  59. * Update the version number to the next major (e.g. ``0.5.dev1``) in
  60. ``src/cryptography/__about__.py`` and
  61. ``vectors/cryptography_vectors/__about__.py``.
  62. * Close the `milestone`_ for the previous release on GitHub.
  63. * Add new :doc:`/changelog` entry with next version and note that it is under
  64. active development
  65. * Send a pull request with these items
  66. * Check for any outstanding code undergoing a deprecation cycle by looking in
  67. ``cryptography.utils`` for ``DeprecatedIn**`` definitions. If any exist open
  68. a ticket to increment them for the next release.
  69. * Send an email to the `mailing list`_ and `python-announce`_ announcing the
  70. release.
  71. .. _`CVE from MITRE`: https://cveform.mitre.org/
  72. .. _`oss-security`: https://www.openwall.com/lists/oss-security/
  73. .. _`upgrading OpenSSL issue template`: https://github.com/pyca/cryptography/issues/new?template=openssl-release.md
  74. .. _`milestone`: https://github.com/pyca/cryptography/milestones
  75. .. _`mailing list`: https://mail.python.org/mailman/listinfo/cryptography-dev
  76. .. _`python-announce`: https://mail.python.org/mailman/listinfo/python-announce-list