kubernetes-sigs / release-utils

release-utils

Tiny utilities for use by the Release Engineering subproject and kubernetes/release.

Hopefully they can be useful to you too!

release-utils's Issues

Create a SECURITY_CONTACTS file.

As per the email sent to kubernetes-dev[1], please create a SECURITY_CONTACTS
file.

The template for the file can be found in the kubernetes-template repository[2].
A description for the file is in the steering-committee docs[3], you might need
to search that page for "Security Contacts".

Please feel free to ping me on the PR when you make it, otherwise I will see when
you close this issue. :)

Thanks so much, let me know if you have any questions.

(This issue was generated from a tool, apologies for any weirdness.)

[1] https://groups.google.com/forum/#!topic/kubernetes-dev/codeiIoQ6QE
[2] https://github.com/kubernetes/kubernetes-template-project/blob/master/SECURITY_CONTACTS
[3] https://github.com/kubernetes/community/blob/master/committee-steering/governance/sig-governance-template-short.md

Create a SECURITY_CONTACTS file.

As per the email sent to kubernetes-dev[1], please create a SECURITY_CONTACTS
file.

The template for the file can be found in the kubernetes-template repository[2].
A description for the file is in the steering-committee docs[3], you might need
to search that page for "Security Contacts".

Please feel free to ping me on the PR when you make it, otherwise I will see when
you close this issue. :)

Thanks so much, let me know if you have any questions.

(This issue was generated from a tool, apologies for any weirdness.)

[1] https://groups.google.com/forum/#!topic/kubernetes-dev/codeiIoQ6QE
[2] https://github.com/kubernetes/kubernetes-template-project/blob/master/SECURITY_CONTACTS
[3] https://github.com/kubernetes/community/blob/master/committee-steering/governance/sig-governance-template-short.md

Buildinfo is not always available

I package for nixpkgs and in our builds we don't have .git either because we fetch the release source tar.gz which doesn't have .git or we do a git clone and then delete the .git dir because it's not reproducible.

I believe debian also handles things in a similar way since someone working on debian posted a script that should be able to clean up the .git dir

NixOS/nixpkgs#100498 (comment) (cc: @Nihlus)

We could apply the script to the .git dir and keep it but just being able to set the ldflags is probably still desirable, especially since there are some cases of people complaining about buildinfo breaking reproducibility and people wanting to strip it

golang/go#52372

And after https://go-review.googlesource.com/c/go/+/414794/ -trimpath will allow for removing it

Investigate moving some of these utilities into k8s.io/utils

ref: https://kubernetes.slack.com/archives/CJH2GBF7Y/p1615238311084800
cc: @thockin @kubernetes-sigs/release-engineering

Create an importable `version` `cobra.Command`

I feel like we write a version package/version for multiple projects. Could we abstract/de-dupe?

Consider writing this as a package in sigs.k8s.io/release-utils that can be an importable cobra.Command.

See https://github.com/kubernetes/enhancements/tree/master/pkg/kepctl/commands for an example, as well @n3wscott's comments in kubernetes/enhancements#2387 (review) for more background.

Originally posted by @justaugustus in kubernetes-sigs/bom#27 (review)