Re: [PATCH] docs/devel: Document the tarball publishing/release process

[Peter Maydell <peter.maydell@linaro.org>]

On Thu, 15 Jun 2023 at 05:54, Michael Roth <michael.roth@amd.com> wrote:
>
> This hopefully contains most of the information one would need to
> generate/publish QEMU tarballs and make the related announcements. The
> main goal is to quickly get others up to speed on the process so we can
> have multiple people able to handle releases at any point in time.
>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: Peter Maydell <peter.maydell@linaro.org>
> Cc: Michael Tokarev <mjt@tls.msk.ru>
> Signed-off-by: Michael Roth <michael.roth@amd.com>

Thanks for writing this up, and apologies for not having
got around to reading it for so long.

I should probably move the other parts of the process
currently documented at https://wiki.qemu.org/Merges
into a docs/devel file at some point.

> +Overview
> +--------
> +
> +Once an official release is tagged in the QEMU git tree by the current
> +upstream maintainer (for major releases), or current stable maintainer
> +(for stable releases), additional work is needed to generate/publish a
> +source tarball for consumption by distros, vendors, and end-users who
> +may not use git sources directly. A person involved in producing these
> +tarballs is referred to herein as a "release maintainer" (not to be
> +confused with the upstream/stable maintainers who are responsible for
> +managing/tagging the git trees from which the tarballs are generated).
> +
> +This documents provides an overview of this release process and is

"document"

> +mainly intended as a reference for current/prospective release maintainers
> +and other individuals involved in the release management process, but it
> +may also be useful to consumers of these source tarballs.

> +     # Sign the resulting tarballs
> +     gpg -b qemu-8.0.0.tar.bz2
> +     gpg -b qemu-8.0.0.tar.xz

Am I right that you currently use your personal GPG key for
release signing? We should probably think about what would
we would need to do if we wanted to change who does this
release process. But I don't know anywhere enough about gpg
to make sensible suggestions...

thanks
-- PMM