Tools in python - #248
Open
quarckster wants to merge 19 commits into
Open
Conversation
Replaces stage-release.sh, the release-aux/*-fn.sh helpers and the twelve fixup-*.pl scripts. Verified against the shell across 230 state and transition combinations; the 14 that differ are shell bugs, now tested. Assisted-by: Claude:claude-opus-5
Replaces the OpenSSL-Query REST backend with a urllib client, and fixes several latent bugs: --commit blanked other commits' messages, --web was silently ignored, and a blank message looped forever. Assisted-by: Claude:claude-opus-5
stagerelease and reviewtools become subpackages, so the cross-package call is a relative import rather than sys.path surgery at runtime. Assisted-by: Claude:claude-opus-5
addrev --list already filtered by the commit group but nothing enforced it, including for a name that happened to be the commit author. stage-release validates up front now, before the copyright commit and make update. Assisted-by: Claude:claude-opus-5
The rule set is pinned because ruff's default varies between releases. Notable fixes: a bare `except Exception: pass`, and an assert used for type narrowing that vanishes under python -O. Assisted-by: Claude:claude-opus-5
Every seam this code exists to be testable through was typed as the concrete class it injects, so a fake was a type error. Six protocols replace them, which then caught three test doubles that had drifted. Assisted-by: Claude:claude-opus-5
PATH and symlinks work; a copy cannot find ../lib. It now says so instead of raising ModuleNotFoundError. Assisted-by: Claude:claude-opus-5
One zipapp per entry point, or one busybox-style archive dispatching on argv[0]. Each is ~60 KiB, needs only a Python 3.10 interpreter, and is named like the script it replaces so it drops over an existing install. Assisted-by: Claude:claude-opus-5
Verified on the latest patch of 3.10 through 3.14, plus a 5x5 build/run matrix for the archives and the 3.9 refusal path. Assisted-by: Claude:claude-opus-5
Assisted-by: Claude:claude-opus-5
They described a manual process that is now pipeline-driven, and contradicted each other about it. Names no internal hosts. Assisted-by: Claude:claude-opus-5
review-tools/README.md is rewritten: it documented a deleted script and omitted four that exist. Also drops review-tools/gitlabutil. Assisted-by: Claude:claude-opus-5
Removes the web policy entry, ghmerge's --web selector and the two tests that covered it. Assisted-by: Claude:claude-opus-5
Follows upstream: Merge-date: and Merged-from: replace MergeDate: and the prose "(Merged from ...)" line, and the trailer block is placed by git interpret-trailers --if-exists addIfDifferent rather than by hand. cherry-checker recognises the new trailer when extracting PR numbers. Assisted-by: Claude:claude-opus-5
t8m
reviewed
Aug 25, 2026
Removes gitaddrev: the message is computed in process now, so there is no msg-filter subprocess and no PYTHONPATH plumbing. Rewritten tags still follow, keeping their tagger and message. Assisted-by: Claude:claude-opus-5
A reviewer named on the command line who authored one of the commits cannot be credited on it, which the bare "Too few reviewers" did not explain. Assisted-by: Claude:claude-opus-5
The tag pass cost one subprocess for every tag in the repository -- 443 in an openssl clone -- to move at most one. 500 tags: 590ms of fixed overhead, now 5ms. Assisted-by: Claude:claude-opus-5
Member
Author
|
Here is some addrev benchmarking with two authors and two reviewers. Perl
Python
|
Member
|
Nice |
t8m
approved these changes
Aug 26, 2026
t8m
left a comment
t8m
left a comment
Member
There was a problem hiding this comment.
Not that I thoroughly reviewed, but in general this looks like a beneficial change to me.
Member
Author
I understand that there is a lot of to review and I guess the best you can do is really to try it out. |
andrewkdinh
requested changes
Aug 26, 2026
|
|
||
| The key lifecycle itself — generating the primary and subkey, issuing and | ||
| rotating the certificate, issuing revocation certificates — is documented | ||
| separately in [`openpgp-tools/README.md`](openpgp-tools/README.md), which is |
| | --- | --- | | ||
| | [`release-tools/`](release-tools/README.md) | staging an OpenSSL release | | ||
| | [`review-tools/`](review-tools/README.md) | reviewing and merging pull requests | | ||
| | [`openpgp-tools/`](openpgp-tools/README.md) | the release signing key's lifecycle | |
Ordering by commit date, git log's default, can emit a commit before its own parent when two lines of history have skewed dates; the replay then re-parents onto the original, leaving the shared parent forked. filter-branch used --topo-order for this. Assisted-by: Claude:claude-opus-5
t8m
approved these changes
Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The tooling was split across bash, Perl and Python and had almost no tests — the logic lived in shell functions passing eighteen globals, and
stage-release.shcalled./Configureandmakefrom the middle of its own control flow, so testing the branch decisions meant building OpenSSL. One language now, and 491 tests covering release staging end to end.stage-release.sh, therelease-aux/*-fn.shhelpers and the twelvefixup-*.plscripts:stage-release+lib/openssl_tools/stagerelease/addrev,cherry-checker: thin entry points overlib/openssl_tools/reviewtools/OpenSSL::QueryREST backend: aurllibclient; nothing here needs the Perl module any moreghmerge,pick-to-branch,opensslbuild,opensslpullandghlinkstay as they arePython 3.10+, standard library only. Verified against the shell across 230 state/transition combinations: all 216 OpenSSL 3.0+ cases match byte for byte, and the 14 pre-3.0 differences are shell bugs that are now tested. Clean under
ruffandmypyon 3.10 through 3.14.Also fixes some latent bugs — notably
gitaddrev --commit=<id>blanking the message of every other commit in the range, and reviewers never being checked for commit access.Supersedes #240; the OpenPGP key-lifecycle tooling from it is a separate PR.