Shows the running build's commit and binary hash in the footer #86
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/footer-build-hash"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The footer version line now names the build serving the page: the source commit it was built from (short form, linked to the commit in the public repo) and the SHA-256 of the running binary, truncated for display with the full hash in the title attribute. Anyone can compare that hash against the one the signed release publishes for the raw binary.
The identity is read once at startup (build info vcs.revision, and the executable file hashed once) and served from memory; nothing is read per request. Either half is left out when it cannot be known, so an unstamped build renders the version line alone.
Release workflow: no change needed. The Forgejo release build already publishes the raw binary's SHA-256, in the signed latest-.json manifests next to the binaries, so the displayed hash already has a published value to check against.
Build stamping, for the record: the release build runs plain go build from a full checkout with VCS stamping left on, so the commit shows. It does not pass -trimpath, so builds are not yet byte-reproducible across different build directories.
Tests: TestVersionFileAndFooter pins the line with a known identity and with none; TestBriefingFontPreloadAndFooter pins the line's ends, with the identity middle pinned by the version test.