diff --git a/docs/releases/3.1.0-verification.json b/docs/releases/3.1.0-verification.json new file mode 100644 index 0000000..0a5293e --- /dev/null +++ b/docs/releases/3.1.0-verification.json @@ -0,0 +1,228 @@ +{ + "Version": "3.1.0", + "Commit": "d018501e8a9c4fbc54b9ff9fd583d6331667c782", + "CheckedAtUtc": "2026-10-26T07:20:27.4553541+00:00", + "ReleaseUrl": "https://github.com/CSJ608/TemplateFrame/releases/tag/v3.1.0", + "Assets": [ + { + "name": "TemplateFrame.3.1.0.nupkg", + "size": 137581, + "digest": "sha256:affa8326f73cbf2e3d5ce3e33d0c1fe8ea59c978542f5509da888f7778aaafd5" + }, + { + "name": "TemplateFrame.3.1.0.snupkg", + "size": 43979, + "digest": "sha256:56ee9a9c340f26a2a3b3e4c3e401b7d28948110632389141eb016a630e1aea73" + }, + { + "name": "TemplateFrame.Excel.3.1.0.nupkg", + "size": 198641, + "digest": "sha256:6ca97e099c5ee6cfbd3f8fe1184691272d441c311c8df12718cb0f122f229f00" + }, + { + "name": "TemplateFrame.Excel.3.1.0.snupkg", + "size": 67428, + "digest": "sha256:08c1f129769da47004f85bd5db5e8725fefb7edde4481a15bf61848d84a6fb4c" + }, + { + "name": "TemplateFrame.Excel.Simple.3.1.0.nupkg", + "size": 166088, + "digest": "sha256:7f8b9f06e0176dde4145d09e8cb4569450ac2417349bf93cec81ba5db2d02cee" + }, + { + "name": "TemplateFrame.Excel.Simple.3.1.0.snupkg", + "size": 60704, + "digest": "sha256:4ef09882955c0f874aeab8823a78739fee0cd0c07bb63f06de2a85800b458421" + }, + { + "name": "TemplateFrame.Word.3.1.0.nupkg", + "size": 119451, + "digest": "sha256:b631e4e137d7ff2b0b5fa9b25bfe521aed261196d32eafb46f7ee27331229f03" + }, + { + "name": "TemplateFrame.Word.3.1.0.snupkg", + "size": 39799, + "digest": "sha256:aaaefd96f79eb500d6b7ac73edd1231edd0525d6153cf55a45f8c3a776b1aa2f" + } + ], + "Packages": [ + { + "Package": "TemplateFrame", + "Version": "3.1.0", + "EntriesCompared": 15, + "RepositoryCommit": "d018501e8a9c4fbc54b9ff9fd583d6331667c782", + "Result": "Passed" + }, + { + "Package": "TemplateFrame.Word", + "Version": "3.1.0", + "EntriesCompared": 15, + "RepositoryCommit": "d018501e8a9c4fbc54b9ff9fd583d6331667c782", + "Result": "Passed" + }, + { + "Package": "TemplateFrame.Excel", + "Version": "3.1.0", + "EntriesCompared": 15, + "RepositoryCommit": "d018501e8a9c4fbc54b9ff9fd583d6331667c782", + "Result": "Passed" + }, + { + "Package": "TemplateFrame.Excel.Simple", + "Version": "3.1.0", + "EntriesCompared": 15, + "RepositoryCommit": "d018501e8a9c4fbc54b9ff9fd583d6331667c782", + "Result": "Passed" + } + ], + "SymbolDistinctSuccessCount": 12, + "Symbols": [ + { + "Package": "TemplateFrame", + "Framework": "net462", + "Status": 200, + "SHA256": "2B73D8FAF6B23762C2D3B306AE947EEA565AACEADC9B1EDD4F58FC7E09EA43DB", + "Result": "Passed", + "EvidenceFile": "symbols-004c0db274934fb19fd9f4bfedebfc82.json", + "RecordedAtUtc": "2026-10-26T07:15:21.4517973Z" + }, + { + "Package": "TemplateFrame", + "Framework": "net8.0", + "Status": 200, + "SHA256": "71BA1D76021A1B81FFAC5D7FCD31ED5C6407D68AFBA915FBEF802A7D0BF12AAE", + "Result": "Passed", + "EvidenceFile": "symbols-3236f60c2e8e4136a541df57477d9113.json", + "RecordedAtUtc": "2026-10-26T07:16:54.5170079Z" + }, + { + "Package": "TemplateFrame", + "Framework": "netstandard2.0", + "Status": 200, + "SHA256": "F20BF8C68A16CDE34CB6ADE76B45984EE03ECE88CA9CD0EF1993E8754DBB17F7", + "Result": "Passed", + "EvidenceFile": "symbols-3236f60c2e8e4136a541df57477d9113.json", + "RecordedAtUtc": "2026-10-26T07:16:54.5170079Z" + }, + { + "Package": "TemplateFrame.Excel", + "Framework": "net462", + "Status": 200, + "SHA256": "EA46E39A1AD3CF64C36CC16025F82E9ED48A5AA2E320C1E0CEF7B99257A40703", + "Result": "Passed", + "EvidenceFile": "symbols-3236f60c2e8e4136a541df57477d9113.json", + "RecordedAtUtc": "2026-10-26T07:16:54.5170079Z" + }, + { + "Package": "TemplateFrame.Excel", + "Framework": "net8.0", + "Status": 200, + "SHA256": "32D089E64E7EF015BBD039427153D2A888E4B4014C28834C5D40BB4F6DBE0EC5", + "Result": "Passed", + "EvidenceFile": "symbols-68894f9cbfbd4050bf194dbe8d9695fb.json", + "RecordedAtUtc": "2026-10-26T07:19:34.3172760Z" + }, + { + "Package": "TemplateFrame.Excel", + "Framework": "netstandard2.0", + "Status": 200, + "SHA256": "440CB97BCDE5A46CAD6D5030526608CE722DF83812E91A7471B5091730B98F16", + "Result": "Passed", + "EvidenceFile": "symbols-004c0db274934fb19fd9f4bfedebfc82.json", + "RecordedAtUtc": "2026-10-26T07:15:21.4517973Z" + }, + { + "Package": "TemplateFrame.Excel.Simple", + "Framework": "net462", + "Status": 200, + "SHA256": "8D5C3E832A80252113DA96EA4D797B3992B595E0C747027C9A6C29468E23841F", + "Result": "Passed", + "EvidenceFile": "symbols-68894f9cbfbd4050bf194dbe8d9695fb.json", + "RecordedAtUtc": "2026-10-26T07:19:34.3172760Z" + }, + { + "Package": "TemplateFrame.Excel.Simple", + "Framework": "net8.0", + "Status": 200, + "SHA256": "22054733B81B7BD90E9C93DCE38AC9244CB34888BB1D30E356671C74F2441074", + "Result": "Passed", + "EvidenceFile": "symbols-3236f60c2e8e4136a541df57477d9113.json", + "RecordedAtUtc": "2026-10-26T07:16:54.5170079Z" + }, + { + "Package": "TemplateFrame.Excel.Simple", + "Framework": "netstandard2.0", + "Status": 200, + "SHA256": "AA6D74A3E3792DE5367DADE836A28E0C13236893E1C49840AAD244C9717856A2", + "Result": "Passed", + "EvidenceFile": "symbols-3236f60c2e8e4136a541df57477d9113.json", + "RecordedAtUtc": "2026-10-26T07:16:54.5170079Z" + }, + { + "Package": "TemplateFrame.Word", + "Framework": "net462", + "Status": 200, + "SHA256": "0043A8CA5A699D5FAF14F5C05E3B424F2C0C092903957F5FA1E2C87D3B992BE2", + "Result": "Passed", + "EvidenceFile": "symbols-68894f9cbfbd4050bf194dbe8d9695fb.json", + "RecordedAtUtc": "2026-10-26T07:19:34.3172760Z" + }, + { + "Package": "TemplateFrame.Word", + "Framework": "net8.0", + "Status": 200, + "SHA256": "7572454242CD96DE7B9F31A344EA78D01A282838800090B0DBE59DAB44839339", + "Result": "Passed", + "EvidenceFile": "symbols-3236f60c2e8e4136a541df57477d9113.json", + "RecordedAtUtc": "2026-10-26T07:16:54.5170079Z" + }, + { + "Package": "TemplateFrame.Word", + "Framework": "netstandard2.0", + "Status": 200, + "SHA256": "A7859198FD4557F5CC35E24A2BCC9A66A84D011961454CACDFE7BA4D62076E51", + "Result": "Passed", + "EvidenceFile": "symbols-3236f60c2e8e4136a541df57477d9113.json", + "RecordedAtUtc": "2026-10-26T07:16:54.5170079Z" + } + ], + "SymbolAttempts": [ + { + "File": "symbols-573ad30fdc8e4211b098bbb178951470.json", + "RecordedAtUtc": "2026-10-26T07:07:13.5930282Z", + "Passed": 0, + "NotVerified": 12 + }, + { + "File": "symbols-e3aff3ab173144f183dfcff479404fd3.json", + "RecordedAtUtc": "2026-10-26T07:13:42.1769418Z", + "Passed": 4, + "NotVerified": 8 + }, + { + "File": "symbols-004c0db274934fb19fd9f4bfedebfc82.json", + "RecordedAtUtc": "2026-10-26T07:15:21.4517973Z", + "Passed": 4, + "NotVerified": 8 + }, + { + "File": "symbols-3236f60c2e8e4136a541df57477d9113.json", + "RecordedAtUtc": "2026-10-26T07:16:54.5170079Z", + "Passed": 7, + "NotVerified": 5 + }, + { + "File": "symbols-656fba5e58a44370b20a615828b30b56.json", + "RecordedAtUtc": "2026-10-26T07:18:08.3053186Z", + "Passed": 0, + "NotVerified": 3 + }, + { + "File": "symbols-68894f9cbfbd4050bf194dbe8d9695fb.json", + "RecordedAtUtc": "2026-10-26T07:19:34.3172760Z", + "Passed": 3, + "NotVerified": 0 + } + ], + "Limitations": "Symbols verified across retries, not a claim of simultaneous or uninterrupted availability. Earlier 404 and 200/404 fluctuations retained in local raw records. NuGet payload comparison excludes repository signature only; 60 other entries matched GitHub byte-for-byte." +} diff --git a/docs/releases/3.1.0.md b/docs/releases/3.1.0.md new file mode 100644 index 0000000..9e38da6 --- /dev/null +++ b/docs/releases/3.1.0.md @@ -0,0 +1,36 @@ +# TemplateFrame 3.1.0 发布记录 + +四包统一版本 **3.1.0**，发布提交 `d018501e8a9c4fbc54b9ff9fd583d6331667c782`，正式 tag `v3.1.0`。用户确认完整发布范围、已知 SST 文本边界和 NuGet + GitHub Release 目标后执行；没有继续性能开发或调整默认资源限额。 + +主要内容与使用边界见 [CHANGELOG](../../CHANGELOG.md#310---2026-10-26)。新增显式流式导入/导出，保留原入口；SST 实体 CRLF 在新流式路径转为 LF 的差异已披露，未修复，不宣称新旧路径文本逐字等价。 + +## 发布链路 + +| 证据 | 结果 | +|---|---| +| 发布 PR | [#9](https://github.com/CSJ608/TemplateFrame/pull/9)，head `aee932036acd0da89c5c701be8df686e0a4693ef` | +| PR CI | [40282610589](https://github.com/CSJ608/TemplateFrame/actions/runs/40282610589)，Windows / Ubuntu 均成功 | +| 合并后 CI | [40282936493](https://github.com/CSJ608/TemplateFrame/actions/runs/40282936493)，Windows / Ubuntu 均成功 | +| 正式发布 | [40283322176](https://github.com/CSJ608/TemplateFrame/actions/runs/40283322176)，Windows test → Ubuntu release 成功 | +| OIDC 与推送 | 登录成功；V3 主包 4 次、符号包 4 次 `Your package was pushed`，没有用跳过重复代替上传 | +| GitHub Release | [v3.1.0](https://github.com/CSJ608/TemplateFrame/releases/tag/v3.1.0)，2026-10-26 15:05:46（Asia/Shanghai），非草稿/非预发布，八个资产齐全 | + +遵守 main 的 PR 与双平台检查保护，未使用 admin bypass、force push 或移动已有 tag。合并树与已验证 PR head 完全一致。原先本地成果均保留在合并历史中。 + +Release 正文来自 CHANGELOG 的 3.1.0 段；发布后仅将三处仓库内文档链接改为 `blob/v3.1.0` 的绝对链接，未改变说明内容、资产或 tag。 + +## 本地与制品验证 + +- 3.1.0 下 restore、完整 format、Release build 通过，零警告/错误；net472/net8/net10 共 2,381 次测试通过，零失败。 +- 17 项目、59 个依赖版本 OSV 审计无发现，已知漏洞阳性对照通过。NuGet 元数据过期警告保留，不放宽门禁；准备阶段两次网络失败及恢复后成功已记录在[准备清单](next-preparation-2026-10-26.md)。 +- 本地 4 nupkg + 4 snupkg 检查通过；正式包取自发布工作流，没有上传本地验证包。 +- GitHub 八资产逐个核验 API 提供的 SHA-256 与大小；四主包的 ID/版本、三组依赖、DLL/XML/en 卫星资源、README/icon 和条目白名单均通过，四符号包含三目标 Portable PDB。README 与 Windows 工作区比较仅规范化 CRLF/LF，icon 按原始哈希比较。 +- 主包公开索引与符号服务器在刚上传后尚未就绪；初次主包索引无 3.1.0，12 个新符号请求为 404。3.0.0 符号阳性对照返回 200 且完整哈希匹配。这些初次结果保留，不视为上传失败，也不冒充分发验证通过。 + +## 分发验收完成 + +四个 NuGet V3 版本索引均已包含 3.1.0，四主包实际下载成功。每包 15 个非签名 ZIP 条目、共 60 项 SHA-256 均与 GitHub 对应制品相同；NuGet 仓库签名不纳入整包等价比较。四包 nuspec 的 RepositoryCommit 均为 `d018501e8a9c4fbc54b9ff9fd583d6331667c782`。 + +四包 × 三目标共 12 个 Portable PDB 均已从 NuGet 符号服务下载成功，完整文件 SHA-256 与对应 GitHub snupkg 条目一致。请求按 DLL CodeView GUID 构造 key，并携带 PE PdbChecksum 的 SymbolChecksum 头，沿用 [3.0.0 已核验协议](../reviews/security-2026-10-22/symbol-protocol-reference.json)。验收跨多次重试完成，不是一次请求全部成功，也不承诺持续可用；传播期曾出现同一文件 200/404 波动，失败结果和最终成功证据均保留，未重推包或移动 tag。 + +摘要及每个 PDB 的成功哈希见 [验证记录](3.1.0-verification.json)。本机下载、验证脚本、各轮完整符号结果、TRX 与审计证据保存在 `artifacts/release-check-3.1.0/`，不覆盖或删除历史实验。至此正式 Release、四个主包和十二个符号文件均已完成验收。 diff --git a/docs/releases/next-preparation-2026-10-26.md b/docs/releases/next-preparation-2026-10-26.md index 8ad51fe..536dd21 100644 --- a/docs/releases/next-preparation-2026-10-26.md +++ b/docs/releases/next-preparation-2026-10-26.md @@ -48,13 +48,15 @@ ## 发布门槛 - [x] 用户确认版本、完整范围、已知文本差异以及发布目标，并解除本次发布禁止 push。 -- [ ] 确认后同步四包 Version、CHANGELOG 正式段与拟用 tag；确认 tag/包版本尚未使用。 -- [ ] 最终内容 Release 构建、三框架测试、完整 format 与依赖审计；探针如改动须独立构建/format。 -- [ ] 最终版本本地四包 pack：4 nupkg + 4 snupkg；检查 ID/版本/依赖、三目标 DLL/XML/en 资源、README/icon、PDB，无测试/日志混入。 -- [ ] 审阅最终提交，授权后才 push；确认该提交 Windows/Linux CI 成功。 -- [ ] 发布者确认 Trusted Publisher 与 NUGET_USER 配置可用（不能从代码断言平台授权正常）。 -- [ ] 单独授权 tag 推送：现有 `release.yml` 会在 Windows 测试后，自动向 nuget.org 推送四主包及四符号包，再创建 GitHub Release。若只要 GitHub 或仅本地包，不能推 tag 沿用此流程。 -- [ ] 发布后核对 Actions 提交、Release 八资产、NuGet 四包及符号处理结果。 +- [x] 同步四包 Version、CHANGELOG 正式段与 tag；发布前确认版本未占用。 +- [x] 最终内容 Release 构建、三框架测试、完整 format 与依赖审计；本轮探针未改动。 +- [x] 最终版本本地四包 pack：4 nupkg + 4 snupkg；ID/版本/依赖、三目标 DLL/XML/en 资源、README/icon、PDB 与条目白名单通过。 +- [x] 授权后 push；PR 与合并提交 Windows/Linux CI 均成功。 +- [x] NUGET_USER 非空，Trusted Publisher 通过正式工作流 OIDC 登录及上传实证可用，未导出凭据。 +- [x] 用户确认完整发布目标后推送 tag；现有工作流完成四主包、四符号包与 GitHub Release 发布。 +- [x] Actions 提交、Release 八资产、NuGet 四包及 12 个符号文件完成核验，传播期失败与重试保留。 + +最终状态与证据见 [3.1.0 发布记录](3.1.0.md)。下方本地检查及准备阶段描述保留当时状态，不代表发布仍待执行。 ## 本轮本地检查结果