Merge pull request #368 from signalapp/jrose/release-instructions

Add release instructions (for Signal engineers)

.github/workflows/build_and_test.yml

@@ -67,8 +67,7 @@ jobs:
           - 'SignalClient.podspec'
           ignored:
           - 'LICENSE'
-          - 'README.md'
-          - 'SECURITY.md'
+          - '*.md'
           - '.github/FUNDING.yml'
           - '.github/workflows/**'
           - '.gitignore'

RELEASE.md

@@ -0,0 +1,72 @@
+# Making a libsignal-client release
+
+## 0. Make sure all CI tests are passing on the latest commit
+
+Check GitHub to see if the latest commit has all tests passing. If not, fix the tests before releasing!
+
+## 1. Update the library version
+
+The first version component should always be 0, to indicate that Signal does not promise stability between releases of the library.
+
+If the changes will require updates in Signal-Android, Signal-iOS, or Signal-Desktop, increase the second version component and reset the third to 0. Otherwise, increase the third version component.
+
+There are six files that have version numbers:
+
+- rust/bridge/jni/Cargo.toml
+- rust/bridge/ffi/Cargo.toml
+- rust/bridge/node/Cargo.toml
+- java/build.gradle
+- SignalClient.podspec
+- package.json
+
+Once you've done this, run the following commands (with the appropriate version number):
+
+```
+bin/verify_crate_versions.py # make sure you updated correctly
+cargo check --workspace # make sure Cargo.lock is updated
+```
+
+## 2. Record the code size for the Java library
+
+On GitHub, under the Java tests for the most recent commit, copy the code size computed in the "java/check_code_size.py" step into a new entry in java/code_size.json.
+
+## 3. Commit the version change and tag with release notes
+
+```
+git commit -am 'Bump to version v0.x.y'
+git tag -a v0.x.y
+```
+
+Take a look at a past release for examples of the format:
+
+```
+v0.8.3
+
+- Fixed several issues running signal-crypto operations on 32-bit
+  platforms.
+- Removed custom implementation of AES-GCM-SIV, AES, AES-CTR, and
+  GHash in favor of the implementations from RustCrypto. The interface
+  presented to Java, Swift, and TypeScript clients has not changed.
+- Updated several Rust dependencies.
+- Java: Exposed the tag size for Aes256GcmDecryption.
+```
+
+(You might think repeating the version number in the summary field is redundant, but GitHub shows it as a title.)
+
+## 4. Push the version bump and tag to GitHub
+
+Note that both the tag *and* the branch need to be pushed.
+
+## 5. Submit to package repositories as needed
+
+### Android: Sonatype
+
+Set the environment variables `SONATYPE_USERNAME`, `SONATYPE_PASSWORD`, `KEYRING_FILE`, `SIGNING_KEY`, and `SIGNING_KEY_PASSSWORD`, then run `make -C java publish_java` to build through Docker. (Sonatype is pretty slow; even after the build completes it might take a while for it to show up.)
+
+### Node: NPM
+
+In the signalapp/libsignal-client repository on GitHub, run the "Publish to NPM" action. Use the tag you just made as the "Git Tag" and leave the "NPM Tag" as "latest".
+
+### iOS: Let the iOS team know
+
+They build all their CocoaPods on a dedicated build server, including libsignal-client.