kettle-dev 1.0.5 → 1.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aaab564b37e2892996a6f419cb71a48aa2f7e0ac5536379f0f7de36710922060
-  data.tar.gz: 878eced8cbf467f399689ba5a93d93f8ffecea1eca451f7b1752c4c41b87ad9e
+  metadata.gz: 757457767d7c4dce99cfbb226f4c8a2a0f94b9a9aadd601b55f21c48a53cda30
+  data.tar.gz: e06421edd27c37161d6438f47809828914b2abd6c1b09722d0f7154eaacf078c
 SHA512:
-  metadata.gz: 01c054122983c1c36bc0ec39c42a35732b9fb6225706e0034d6209923f0ac3704f874c23e7900617dc044a6b0245315bdbc8da72534a86f0eed87cd5156f94f3
-  data.tar.gz: a52bc544f7243a1b727e956cef403601689f3331c5cb3376a4b9135eb0c2ca3353f3e048709e2f153cae847a74eab55c5c21f7d432cb621e2416120314e8c560
+  metadata.gz: 16c04f9745823ca90d1c22e0e471942fc81469fc8022cb6bdf3c064eee5c1f656d077e54ea283906f117d31f0101daf3057f18d7ef472c4373bbe1441c4b4672
+  data.tar.gz: 4a6ca6d6fe40cd1c694d73b6527e62d4dc44f97fe72a9b41a796f920b8a1c42a78e2c49f2040dae22d5c277b545b356a592f1ee54c1e28fca4ff6173a4ed1c78

data/CHANGELOG.md

@@ -12,6 +12,23 @@ and this project adheres to [Semantic Versioning v2](https://semver.org/spec/v2.
 ### Fixed
 ### Security
 
+## [1.0.7] - 2025-08-24
+- TAG: [v1.0.7][1.0.7t]
+- COVERAGE: 100.00% -- 130/130 lines in 7 files
+- BRANCH COVERAGE:  96.00% -- 48/50 branches in 7 files
+- 95.35% documented
+### Fixed
+- Reproducible builds, with consistent checksums, by *not* using SOURCE_DATE_EPOCH.
+  - Since bundler v2.7.0 builds are reproducible by default.
+
+## [1.0.6] - 2025-08-24
+- TAG: [v1.0.6][1.0.6t]
+- COVERAGE: 100.00% -- 130/130 lines in 7 files
+- BRANCH COVERAGE:  96.00% -- 48/50 branches in 7 files
+- 95.35% documented
+### Fixed
+- kettle-release: ensure SOURCE_DATE_EPOCH is applied within the same shell for both build and release by prefixing the commands with the env var (e.g., `SOURCE_DATE_EPOCH=$epoch bundle exec rake build` and `... rake release`); prevents losing the variable across shell boundaries and improves reproducible checksums.
+
 ## [1.0.5] - 2025-08-24
 - TAG: [v1.0.5][1.0.5t]
 - COVERAGE: 100.00% -- 130/130 lines in 7 files
@@ -91,7 +108,11 @@ and this project adheres to [Semantic Versioning v2](https://semver.org/spec/v2.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://gitlab.com/kettle-rb/kettle-dev/-/compare/v1.0.5...HEAD
+[Unreleased]: https://gitlab.com/kettle-rb/kettle-dev/-/compare/v1.0.7...HEAD
+[1.0.7]: https://gitlab.com/kettle-rb/kettle-dev/-/compare/v1.0.6...v1.0.7
+[1.0.7t]: https://gitlab.com/kettle-rb/kettle-dev/-/tags/v1.0.7
+[1.0.6]: https://gitlab.com/kettle-rb/kettle-dev/-/compare/v1.0.5...v1.0.6
+[1.0.6t]: https://gitlab.com/kettle-rb/kettle-dev/-/tags/v1.0.6
 [1.0.5]: https://gitlab.com/kettle-rb/kettle-dev/-/compare/v1.0.4...v1.0.5
 [1.0.5t]: https://gitlab.com/kettle-rb/kettle-dev/-/tags/v1.0.5
 [1.0.4]: https://gitlab.com/kettle-rb/kettle-dev/-/compare/v1.0.3...v1.0.4

data/CONTRIBUTING.md

@@ -117,7 +117,8 @@ Run `kettle-release`.
 6. Run `export GIT_TRUNK_BRANCH_NAME="$(git remote show origin | grep 'HEAD branch' | cut -d ' ' -f5)" && echo $GIT_TRUNK_BRANCH_NAME`
 7. Run `git checkout $GIT_TRUNK_BRANCH_NAME`
 8. Run `git pull origin $GIT_TRUNK_BRANCH_NAME` to ensure latest trunk code
-9. Set `SOURCE_DATE_EPOCH` so `rake build` and `rake release` use same timestamp, and generate same checksums
+9. Optional for older Bundler (< 2.7.0): Set `SOURCE_DATE_EPOCH` so `rake build` and `rake release` use the same timestamp and generate the same checksums
+    - If your Bundler is >= 2.7.0, you can skip this; builds are reproducible by default.
     - Run `export SOURCE_DATE_EPOCH=$EPOCHSECONDS && echo $SOURCE_DATE_EPOCH`
     - If the echo above has no output, then it didn't work.
     - Note: `zsh/datetime` module is needed, if running `zsh`.

data/README.md

@@ -641,7 +641,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]:https://gitmoji.dev
 [📌gitmoji-img]:https://img.shields.io/badge/gitmoji_commits-%20😜%20😍-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.069-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.130-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/checksums/kettle-dev-1.0.7.gem.sha256

@@ -0,0 +1 @@
+f5a4e19daf87b88e9f61c4bfec481ea915f5f734cf665dbcbd34be6979718c89

data/checksums/kettle-dev-1.0.7.gem.sha512

@@ -0,0 +1 @@
+7b99485e9d4411f2766d7cf53121923e26284f455146a7ba281982634cc534384d91739d83113618852f8abd5093dbc465362afff62e5da041f996bed2bd3a4b

data/exe/kettle-release

@@ -6,7 +6,7 @@
 # - Ensures version/changelog updated (with confirmation)
 # - Commits and pushes a release prep commit
 # - Ensures on trunk, up-to-date
-# - Exports SOURCE_DATE_EPOCH for reproducible checksums
+# - Builds and releases using Bundler/Rake (reproducible by default in Bundler 2.7+)
 # - Runs `bundle exec rake build` (expects PEM password unless SKIP_GEM_SIGNING)
 #   - If signing not skipped and no public cert in certs/<user>.pem, aborts with guidance
 # - Runs bin/gem_checksums
@@ -49,6 +49,8 @@ module Kettle
       def run
         puts "== kettle-release =="
 
+        ensure_bundler_2_7_plus!
+
         run_cmd!("bin/setup")
         run_cmd!("bin/rake")
 
@@ -92,8 +94,6 @@ module Kettle
         checkout!(trunk)
         pull!(trunk)
 
-        export_source_date_epoch!
-
         ensure_signing_setup_or_skip!
         # Build: expect PEM password prompt unless SKIP_GEM_SIGNING
         puts "Running build (you may be prompted for the signing key password)..."
@@ -200,7 +200,7 @@ module Kettle
 
       def run_cmd!(cmd)
         puts "$ #{cmd}"
-        # Ensure current ENV (including SOURCE_DATE_EPOCH) is propagated explicitly
+        # Execute commands with the current environment
         success = system(ENV, cmd)
         abort("Command failed: #{cmd}") unless success
       end
@@ -221,6 +221,19 @@ module Kettle
         abort("Git user.name or user.email not configured.") unless ok1 && ok2 && !name.empty? && !email.empty?
       end
 
+      def ensure_bundler_2_7_plus!
+        begin
+          require "bundler"
+        rescue LoadError
+          abort("Bundler is required. Please install bundler >= 2.7.0 and try again.")
+        end
+        ver = Gem::Version.new(Bundler::VERSION)
+        min = Gem::Version.new("2.7.0")
+        if ver < min
+          abort("kettle-release requires Bundler >= 2.7.0 for reproducible builds by default. Current: #{Bundler::VERSION}. Please upgrade bundler.")
+        end
+      end
+
       def detect_version
         # Look for lib/**/version.rb and extract VERSION constant string
         candidates = Dir[File.join(@root, "lib", "**", "version.rb")]
@@ -482,12 +495,6 @@ module Kettle
         puts "Merged #{feature} into #{trunk} and pushed. The PR (if any) should auto-close."
       end
 
-      def export_source_date_epoch!
-        epoch = Time.now.to_i
-        ENV["SOURCE_DATE_EPOCH"] = epoch.to_s
-        puts "Exported SOURCE_DATE_EPOCH=#{epoch}"
-      end
-
       def ensure_signing_setup_or_skip!
         return if ENV.key?("SKIP_GEM_SIGNING")
 
@@ -527,8 +534,8 @@ module Kettle
               sha256sum: #{actual}
               file: #{checks_path}
               file: #{expected}
-            Ensure SOURCE_DATE_EPOCH is set consistently and that the artifact used by release is identical to the one checksummed.
-            You can retry: export SOURCE_DATE_EPOCH=$EPOCHSECONDS; bundle exec rake build && bin/gem_checksums && bundle exec rake release
+            The artifact being released must match the checksummed artifact exactly.
+            Retry locally: bundle exec rake build && bin/gem_checksums && bundle exec rake release
           MSG
         else
           puts "Checksum OK #{stage}: #{File.basename(gem_path)}"
@@ -573,7 +580,7 @@ if ARGV.include?("-h") || ARGV.include?("--help")
       - Commits a release prep change
       - Ensures trunk is up-to-date, pushes branch, and monitors CI (GitHub/GitLab)
       - Merges feature into trunk upon CI success
-      - Exports SOURCE_DATE_EPOCH, builds, records checksums, and releases
+      - Builds, records checksums, and releases (requires Bundler >= 2.7.0)
 
     Environment:
       SKIP_GEM_SIGNING=true        # skip gem signing during build/release

data/lib/kettle/dev/version.rb

@@ -6,7 +6,7 @@ module Kettle
     module Version
       # The gem version.
       # @return [String]
-      VERSION = "1.0.5"
+      VERSION = "1.0.7"
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 1.0.5
+  version: 1.0.7
 platform: ruby
 authors:
 - Peter H. Boling
@@ -203,10 +203,8 @@ extra_rdoc_files:
 - REEK
 - RUBOCOP.md
 - SECURITY.md
-- checksums/kettle-dev-1.0.4.gem.sha256
-- checksums/kettle-dev-1.0.4.gem.sha512
-- checksums/kettle-dev-1.0.5.gem.sha256
-- checksums/kettle-dev-1.0.5.gem.sha512
+- checksums/kettle-dev-1.0.7.gem.sha256
+- checksums/kettle-dev-1.0.7.gem.sha512
 files:
 - ".devcontainer/devcontainer.json"
 - ".envrc"
@@ -258,10 +256,8 @@ files:
 - RUBOCOP.md
 - Rakefile
 - SECURITY.md
-- checksums/kettle-dev-1.0.4.gem.sha256
-- checksums/kettle-dev-1.0.4.gem.sha512
-- checksums/kettle-dev-1.0.5.gem.sha256
-- checksums/kettle-dev-1.0.5.gem.sha512
+- checksums/kettle-dev-1.0.7.gem.sha256
+- checksums/kettle-dev-1.0.7.gem.sha512
 - exe/kettle-commit-msg
 - exe/kettle-readme-backers
 - exe/kettle-release
@@ -294,10 +290,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com/
-  source_code_uri: https://github.com/galtzo-floss/kettle-dev/tree/v1.0.5
-  changelog_uri: https://github.com/galtzo-floss/kettle-dev/blob/v1.0.5/CHANGELOG.md
+  source_code_uri: https://github.com/galtzo-floss/kettle-dev/tree/v1.0.7
+  changelog_uri: https://github.com/galtzo-floss/kettle-dev/blob/v1.0.7/CHANGELOG.md
   bug_tracker_uri: https://github.com/galtzo-floss/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/1.0.5
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/1.0.7
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/galtzo-floss/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev

data/checksums/kettle-dev-1.0.4.gem.sha256

@@ -1 +0,0 @@
-772ba761ef205f134e3a096fbfde418b3d699093482ff345bd755f8f596f9de7

data/checksums/kettle-dev-1.0.4.gem.sha512

@@ -1 +0,0 @@
-5e791a2feaa44cfcede4c5e933f2d44725dd6c84d5b44511d8e26147a1540ed3455508fd9c2e1ed8d07093009863b2db38ff9532939404aed7f047091c495e36

data/checksums/kettle-dev-1.0.5.gem.sha256

@@ -1 +0,0 @@
-60434bcaca59d509c76b746ca2707c4203c6e78fe1af64073c3e871a55ad72aa

data/checksums/kettle-dev-1.0.5.gem.sha512

@@ -1 +0,0 @@
-e818b9baeced996daebc4565812ff015ba552788220ff34773d2c5d7e3ff7e9a1adca4ae16379dd9551824c7e5a8bef877c66a14faa6795d3982b1faa0d35f07