Repository navigation
Relicense to GPL-3.0-only, release workflow, code signing prepared - #1
Merged
Merged
Conversation
…dation License: from now on DupFinder is under the GNU GPL, version 3 only, like the other burnersen tools. Versions up to 1.0.1 stay under the PolyForm Noncommercial License they were released with. The PolyForm license is not an OSI license, so SignPath Foundation could not sign DupFinder. Release workflow (new): DupFinder.exe is now built on GitHub from a tag vX.Y.Z equal to appVersion, with name and version in the file properties (winres/winres.json), and published as the release asset. The release text is .github/release-notes/vX.Y.Z.md or the annotated tag message. A CI workflow checks gofmt, go vet and the build on Windows. Code signing is prepared in the release workflow but only runs once the repository has the variable SIGNPATH_ORGANIZATION_ID and the secret SIGNPATH_API_TOKEN; without them the exe is released unsigned. - Dry run: by hand (tick "dry run") and for pull requests that change the release workflow, winres/ or .signpath/. - CODE_SIGNING.md: code signing policy with roles, privacy policy and uninstalling, linked from the README and from every release text. - .signpath/: artifact configuration, file check, setup and removal. - .gitattributes keeps Go sources LF, so gofmt passes on Windows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GvUq7HnA5ggbuHBogzS2rV
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
License
DupFinder moves from the PolyForm Noncommercial License to GPL-3.0-only, like the other burnersen tools. PolyForm is not an OSI license, so SignPath Foundation could not sign DupFinder under it. Versions up to 1.0.1 stay under the license they were released with.
LICENSE.mdis replaced byLICENSE, every source header now carriesSPDX-License-Identifier: GPL-3.0-only, and the README explains the license the same way the other tools' READMEs do.Release and CI on GitHub (new)
vX.Y.Zequal toappVersion, or "Run workflow" with an existing tag. It runsgo vet, writes name and version into the file properties (winres/winres.json), buildsDupFinder.exewith a current stable Go and publishes it. The release text comes from.github/release-notes/vX.Y.Z.mdor the annotated tag message..gitattributeskeeps Go files LF so gofmt passes on Windows.Code signing (off until set up)
Signing step in the release workflow, but it only runs once the variable
SIGNPATH_ORGANIZATION_IDand the secretSIGNPATH_API_TOKENare set. Includes a dry run (by hand, and automatically for PRs that touch the release workflow),CODE_SIGNING.md(roles, privacy policy, uninstalling) and.signpath/(artifact configuration, file check, setup and removal instructions).Note
The next release should be a new version (e.g. 1.1.0), so the first GPL version is clearly separate from 1.0.1.
Generated by Claude Code