docs/doing-a-release.rst


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100

Doing a release
===============

Doing a release of ``cryptography`` requires a few steps.

Security Releases
-----------------

In addition to the other steps described below, for a release which fixes a
security vulnerability, you should also include the following steps:

* Request a `CVE from MITRE`_. Once you have received the CVE, it should be
  included in the :doc:`changelog`. Ideally you should request the CVE before
  starting the release process so that the CVE is available at the time of the
  release.
* Ensure that the :doc:`changelog` entry credits whoever reported the issue.
* The release should be announced on the `oss-security`_ mailing list, in
  addition to the regular announcement lists.

Verifying OpenSSL version
-------------------------

The release process creates wheels bundling OpenSSL for Windows, macOS, and
Linux. Check that the Windows and macOS Azure Pipelines builders have the latest
version of OpenSSL installed and verify that the latest version is present in
the ``pyca/cryptography-manylinux1`` docker containers. If anything is out
of date follow the instructions for upgrading OpenSSL.

Upgrading OpenSSL
-----------------

Use the `upgrading OpenSSL issue template`_.

Bumping the version number
--------------------------

The next step in doing a release is bumping the version number in the
software.

* Update the version number in ``src/cryptography/__about__.py``.
* Update the version number in ``vectors/cryptography_vectors/__about__.py``.
* Set the release date in the :doc:`/changelog`.
* Do a commit indicating this.
* Send a pull request with this.
* Wait for it to be merged.

Performing the release
----------------------

The commit that merged the version number bump is now the official release
commit for this release. You will need to have ``gpg`` installed and a ``gpg``
key in order to do a release. Once this has happened:

* Run ``python release.py {version}``.

The release should now be available on PyPI and a tag should be available in
the repository.

Verifying the release