diff --git a/CHANGELOG.md b/CHANGELOG.md index f4150c7..6d5e927 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,9 +1,13 @@ Change Log ========== -Upcoming Version 1.0.3 +Version 1.0.4 ------------------------------------ -- Kotlin 1.7.0 +- Fixed Maven publishing error in 1.0.3 release + +Version 1.0.3 +------------------------------------ +- Kotlin 1.7.10 - Internal changes to support multiplatform in the future (consumers using Maven instead of Gradle may need to suffix -jvm to the artifact name) - Snapshot builds are available prior to final release diff --git a/README.md b/README.md index 67e8ff6..608d905 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,6 @@ # kotlin-bip39 [![license](https://img.shields.io/github/license/zcash/kotlin-bip39.svg?maxAge=2592000&style=plastic)](https://github.com/zcash/kotlin-bip39/blob/master/LICENSE) -[![@gmale](https://img.shields.io/badge/contact-android@z.cash-5AA9E7.svg?style=plastic)](https://github.com/gmale) -![Bintray](https://img.shields.io/maven-central/v/cash.z.ecc.android/kotlin-bip39?color=success&style=plastic) +![maven](https://img.shields.io/maven-central/v/cash.z.ecc.android/kotlin-bip39?color=success&style=plastic) ## Introduction @@ -26,7 +25,7 @@ Plus, it uses a permissive MIT license and no dependencies beyond Kotlin's stdli ## Getting Started ### Gradle -Add dependencies (see bintray badge, above, for latest version number such as `1.0.1`): +Add dependencies (see Maven badge above for latest version number): ```groovy dependencies { diff --git a/docs/Build integrity.md b/docs/Build integrity.md new file mode 100644 index 0000000..72a3cea --- /dev/null +++ b/docs/Build integrity.md @@ -0,0 +1,17 @@ +# Build Integrity +Multiple tools can be put in place to enhance build integrity and reduce the risk of supply chain issues. These tools include: + * Policy — We minimize third party dependencies, especially when they are not provided by Google and JetBrains. We also try to minimize the number of Gradle plugins. + * Checklists — Our [pull request checklist](../.github/pull_request_template.md) specifies only running code from contributors after reviewing the changes first. Our [dependency update checklist](../.github/ISSUE_TEMPLATE/dependency.md) specifies verifying lock file changes during dependency updates. + * Fixed dependency versions — For our dependency declarations, we use exact dependency versions in gradle.properties instead of version ranges. + * GitHub Actions versions use SHA instead of tags + * Dependency locking + * Gradle buildscript (e.g. plugins) dependencies are locked + * Dependency hash or signature verification + * Gradle — The SHA256 for Gradle is stored in [gradle/wrapper/gradle-wrapper.properties](../gradle/wrapper/gradle-wrapper.properties) which is verified when Gradle is downloaded for the first time + * Gradle Wrapper — The SHA256 for the Gradle Wrapper is verified on the continuous integration server + * Dependencies — Verification is NOT currently enabled for buildscript or compile dependencies + +# Dependency locking +## Buildscript +To update build script dependency locks: +`./gradlew dependencies --write-locks` diff --git a/docs/PUBLISHING.md b/docs/PUBLISHING.md index b4258ae..d1313a0 100644 --- a/docs/PUBLISHING.md +++ b/docs/PUBLISHING.md @@ -67,12 +67,12 @@ See [ci.md](ci.md), which describes the continuous integration workflow for depl ## Every time 1. Update the [build number](https://github.com/zcash/kotlin-bip39/blob/main/gradle.properties) and the [CHANGELOG](https://github.com/zcash/kotlin-bip39/blob/main/CHANGELOG.md). For release builds, suffix the Gradle invocations below with `-PIS_SNAPSHOT=false`. -3. Build locally +2. Build locally * This will install the files in your local maven repo at `~/.m2/repository/cash/z/ecc/android/` ```zsh ./gradlew publishKotlinMultiplatformPublicationToMavenLocalRepository --no-parallel ``` -4. Publish via the following command: +3. Publish via the following command: 1. Snapshot: `./gradlew publishKotlinMultiplatformPublicationToMavenCentralRepository -PIS_SNAPSHOT=true` 2. Release 1. `./gradlew publishKotlinMultiplatformPublicationToMavenCentralRepository -PIS_SNAPSHOT=false` diff --git a/gradle.properties b/gradle.properties index a1df6a0..2d3ffca 100644 --- a/gradle.properties +++ b/gradle.properties @@ -28,4 +28,4 @@ ZCASH_ASCII_GPG_KEY= # Configures whether release is an unstable snapshot, therefore published to the ZCASH_MAVEN_PUBLISH_SNAPSHOT_URL IS_SNAPSHOT=true -LIBRARY_VERSION=1.0.3 +LIBRARY_VERSION=1.0.4