Skip to content

docs(release): record complete 3.0.0 publication verification #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
CSJ608 merged 1 commit into from
Oct 23, 2026
Merged

docs(release): record complete 3.0.0 publication verification #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/ROADMAP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@

## 当前状态入口

- **3.0.0（2026-10-22，主包已发布）**：PR #4、双平台 CI、合并后 CI 与 tag 发布门禁均通过，四个 NuGet 主包及 GitHub Release 八个资产已独立核验；符号服务器补传单独收尾。默认预算的迁移要求见[迁移指南](MIGRATION-3.0.md)，发布提交与实存证据见[发布记录](releases/3.0.0.md)。
- **3.0.0（2026-10-22 已发布，10-23 完成符号验收）**：PR #4、双平台 CI、合并后 CI 与 tag 发布门禁均通过，四个 NuGet 主包、GitHub Release 八个资产和 NuGet 符号服务器全部 12 个 PDB 均已独立核验。默认预算的迁移要求见[迁移指南](MIGRATION-3.0.md)，发布提交与实存证据见[发布记录](releases/3.0.0.md)。

- **2026-10-22 安全维护（实现验收快照，已本地提交）**：输入资源限额、依赖与工具链升级、CI 审计配置已落到工作区；Windows 本地 Release 构建零警告/零错误，`net8.0 / net472 / net10.0` 共 1,457 项测试通过。当前工作分支为 `codex/security-upgrade-20261022`，产品实现提交为 `1b46cbd`，已完成独立静态审阅；该实现验收阶段尚未执行远端 CI，也未发布，打包验证版本为 2.4.1；后续 3.0.0 发版状态见上条。范围、验证及限制见[升级实施记录](reviews/2026-10-22-upgrade-completion.md)，资源配置与开发环境见[安全说明](SECURITY.md)。开发机的系统级 .NET／VS 更新已另行完成并再次通过本地验证，见[系统更新记录](reviews/2026-10-22-system-update.md)；远端正式验收与发布仍未执行。
- **2.4.1**：文档、注释和包描述修订见 [CHANGELOG](../CHANGELOG.md#241---2026-09-08)；D1、D2 已验收，发布验证及结果以[评审台账](reviews/2026-09-07-review.md)中的 2.4.1 记录为准。
Expand Down
6 changes: 5 additions & 1 deletion docs/releases/3.0.0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,10 @@

## 符号服务器收尾

初始发布日志仅记录四个 nupkg 上传，snupkg 虽已附在 GitHub Release，但尚未证明 NuGet 符号服务器可下载；独立正确协议抽样返回 404。工作流补充显式 V3 符号推送及只对既有 Release 生效的 symbols 手动恢复入口，补传应使用本次已发布的同一批 snupkg，不移动 tag、不重建或替换主包。补传运行与完整 12 个 PDB 的下载验收将在完成后追加记录。
初始发布日志仅记录四个 nupkg 上传；snupkg 虽已附在 GitHub Release，但独立符号服务器抽样仍返回 404。[PR #7](https://github.com/CSJ608/TemplateFrame/pull/7) 修复了显式 V3 符号推送并提供仅 main 可触发的恢复入口；合并提交为 `2c71002485302732eae5032744e74da5da773cc6`，PR CI [39746024081](https://github.com/CSJ608/TemplateFrame/actions/runs/39746024081) 与合并后 CI [39746379195](https://github.com/CSJ608/TemplateFrame/actions/runs/39746379195) 均通过。

2026-10-22，符号专用工作流 [39746867271](https://github.com/CSJ608/TemplateFrame/actions/runs/39746867271) 成功完成：下载并校验既有 Release 的四个原始 snupkg，通过同一 release.yml 的 OIDC 身份补传到 NuGet 符号端点。常规 test/release jobs 按事件条件跳过，没有重新构建、重推主包或移动 `v3.0.0`。

2026-10-23，独立验收全部 **12 个 Portable PDB**：DLL CodeView GUID 与 PDB GUID 对应、PE 内嵌 PdbChecksum 与标准化 PDB 校验和相符；按官方符号 key 和 `SymbolChecksum` 请求头从 NuGet 符号服务器下载，12 项均为 HTTP 200，完整文件 SHA256 与 GitHub snupkg 中的原始 PDB 完全一致，失败项为零。结果见 [symbols-3.0.0-verification.json](../reviews/security-2026-10-22/symbols-3.0.0-verification.json)，协议依据见 [symbol-protocol-reference.json](../reviews/security-2026-10-22/symbol-protocol-reference.json)。至此主包、Release 资产和 NuGet 符号均已验收。

活动内容净化、真实 Office/WPS 打印验证、性能长测、其他服务器/容器的宿主升级仍是文档中明确列出的应用侧或后续事项，不作为本次库包已完成这些能力的声明。
18 changes: 18 additions & 0 deletions docs/reviews/security-2026-10-22/symbol-protocol-reference.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
{
"repository": "dotnet/symstore",
"commit": "d66992e7c2f32288fbf1acf08cdea43098025c7c",
"retrieved_at_utc": "2026-10-22T15:59:45.5061245+08:00",
"key_algorithm": "filename.ToLowerInvariant()/guid.ToString(\"N\")+FFFFFFFF/filename.ToLowerInvariant()",
"checksum_header": "SymbolChecksum: AlgorithmName:lowercaseHex(PE PdbChecksum bytes)",
"sources": [
"https://github.com/dotnet/symstore/blob/d66992e7c2f32288fbf1acf08cdea43098025c7c/src/Microsoft.SymbolStore/KeyGenerators/PortablePDBFileKeyGenerator.cs",
"https://github.com/dotnet/symstore/blob/d66992e7c2f32288fbf1acf08cdea43098025c7c/src/Microsoft.SymbolStore/KeyGenerators/KeyGenerator.cs",
"https://github.com/dotnet/symstore/blob/d66992e7c2f32288fbf1acf08cdea43098025c7c/src/Microsoft.SymbolStore/KeyGenerators/PEFileKeyGenerator.cs",
"https://github.com/dotnet/symstore/blob/d66992e7c2f32288fbf1acf08cdea43098025c7c/src/Microsoft.SymbolStore/SymbolStores/HttpSymbolStore.cs",
"https://github.com/dotnet/symstore/blob/d66992e7c2f32288fbf1acf08cdea43098025c7c/src/Microsoft.FileFormats/PE/PEStructures.cs",
"https://github.com/dotnet/symstore/blob/d66992e7c2f32288fbf1acf08cdea43098025c7c/src/Microsoft.FileFormats/PE/PEFile.cs",
"https://github.com/dotnet/symstore/blob/d66992e7c2f32288fbf1acf08cdea43098025c7c/src/Microsoft.SymbolStore/ChecksumValidator.cs"
],
"nuget_documentation": "https://learn.microsoft.com/en-us/nuget/create-packages/symbol-packages-snupkg",
"checksum_validation": "SHA256 over Portable PDB bytes with the 20-byte #Pdb stream content ID zeroed, per dotnet/symstore ChecksumValidator; whole-file SHA256 is separately used for release/download payload equivalence."
}
Loading
Loading