kettle-dev 1.0.6 → 1.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b3b269c7a7a4d0d12e5aa6364bcd7e95290258da6262ae463940d7db44be6bd9
-  data.tar.gz: 89567fe63abc8bb1ca5ad2438b39865fa15a34bf0e4a7705faca5501802cc178
+  metadata.gz: 757457767d7c4dce99cfbb226f4c8a2a0f94b9a9aadd601b55f21c48a53cda30
+  data.tar.gz: e06421edd27c37161d6438f47809828914b2abd6c1b09722d0f7154eaacf078c
 SHA512:
-  metadata.gz: c2dd6b2114143f8fbe0a09d34f70a33c6e58a37edf6c23f48b1775cc7bd0bd8a1f12c1001dda6e3efdbedd746db34d73745f99bf8018ea0ae478d13787e3e037
-  data.tar.gz: 07aa24311c9e6174a5007aca0814d16c2854ce06023eabbadbbd8bf546ae8340b3c24f050e862a47549905b9d7a6773d4fcab02067cb6d70dcb55cf9b389d82f
+  metadata.gz: 16c04f9745823ca90d1c22e0e471942fc81469fc8022cb6bdf3c064eee5c1f656d077e54ea283906f117d31f0101daf3057f18d7ef472c4373bbe1441c4b4672
+  data.tar.gz: 4a6ca6d6fe40cd1c694d73b6527e62d4dc44f97fe72a9b41a796f920b8a1c42a78e2c49f2040dae22d5c277b545b356a592f1ee54c1e28fca4ff6173a4ed1c78

data/CHANGELOG.md

@@ -12,6 +12,15 @@ and this project adheres to [Semantic Versioning v2](https://semver.org/spec/v2.
 ### Fixed
 ### Security
 
+## [1.0.7] - 2025-08-24
+- TAG: [v1.0.7][1.0.7t]
+- COVERAGE: 100.00% -- 130/130 lines in 7 files
+- BRANCH COVERAGE:  96.00% -- 48/50 branches in 7 files
+- 95.35% documented
+### Fixed
+- Reproducible builds, with consistent checksums, by *not* using SOURCE_DATE_EPOCH.
+  - Since bundler v2.7.0 builds are reproducible by default.
+
 ## [1.0.6] - 2025-08-24
 - TAG: [v1.0.6][1.0.6t]
 - COVERAGE: 100.00% -- 130/130 lines in 7 files
@@ -99,7 +108,9 @@ and this project adheres to [Semantic Versioning v2](https://semver.org/spec/v2.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://gitlab.com/kettle-rb/kettle-dev/-/compare/v1.0.6...HEAD
+[Unreleased]: https://gitlab.com/kettle-rb/kettle-dev/-/compare/v1.0.7...HEAD
+[1.0.7]: https://gitlab.com/kettle-rb/kettle-dev/-/compare/v1.0.6...v1.0.7
+[1.0.7t]: https://gitlab.com/kettle-rb/kettle-dev/-/tags/v1.0.7
 [1.0.6]: https://gitlab.com/kettle-rb/kettle-dev/-/compare/v1.0.5...v1.0.6
 [1.0.6t]: https://gitlab.com/kettle-rb/kettle-dev/-/tags/v1.0.6
 [1.0.5]: https://gitlab.com/kettle-rb/kettle-dev/-/compare/v1.0.4...v1.0.5

data/CONTRIBUTING.md

@@ -117,7 +117,8 @@ Run `kettle-release`.
 6. Run `export GIT_TRUNK_BRANCH_NAME="$(git remote show origin | grep 'HEAD branch' | cut -d ' ' -f5)" && echo $GIT_TRUNK_BRANCH_NAME`
 7. Run `git checkout $GIT_TRUNK_BRANCH_NAME`
 8. Run `git pull origin $GIT_TRUNK_BRANCH_NAME` to ensure latest trunk code
-9. Set `SOURCE_DATE_EPOCH` so `rake build` and `rake release` use same timestamp, and generate same checksums
+9. Optional for older Bundler (< 2.7.0): Set `SOURCE_DATE_EPOCH` so `rake build` and `rake release` use the same timestamp and generate the same checksums
+    - If your Bundler is >= 2.7.0, you can skip this; builds are reproducible by default.
     - Run `export SOURCE_DATE_EPOCH=$EPOCHSECONDS && echo $SOURCE_DATE_EPOCH`
     - If the echo above has no output, then it didn't work.
     - Note: `zsh/datetime` module is needed, if running `zsh`.

data/README.md

@@ -641,7 +641,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]:https://gitmoji.dev
 [📌gitmoji-img]:https://img.shields.io/badge/gitmoji_commits-%20😜%20😍-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.069-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.130-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/checksums/kettle-dev-1.0.7.gem.sha256

@@ -0,0 +1 @@
+f5a4e19daf87b88e9f61c4bfec481ea915f5f734cf665dbcbd34be6979718c89

data/checksums/kettle-dev-1.0.7.gem.sha512

@@ -0,0 +1 @@
+7b99485e9d4411f2766d7cf53121923e26284f455146a7ba281982634cc534384d91739d83113618852f8abd5093dbc465362afff62e5da041f996bed2bd3a4b

data/exe/kettle-release

@@ -6,7 +6,7 @@
 # - Ensures version/changelog updated (with confirmation)
 # - Commits and pushes a release prep commit
 # - Ensures on trunk, up-to-date
-# - Exports SOURCE_DATE_EPOCH for reproducible checksums
+# - Builds and releases using Bundler/Rake (reproducible by default in Bundler 2.7+)
 # - Runs `bundle exec rake build` (expects PEM password unless SKIP_GEM_SIGNING)
 #   - If signing not skipped and no public cert in certs/<user>.pem, aborts with guidance
 # - Runs bin/gem_checksums
@@ -49,6 +49,8 @@ module Kettle
       def run
         puts "== kettle-release =="
 
+        ensure_bundler_2_7_plus!
+
         run_cmd!("bin/setup")
         run_cmd!("bin/rake")
 
@@ -92,12 +94,10 @@ module Kettle
         checkout!(trunk)
         pull!(trunk)
 
-        epoch = export_source_date_epoch!
-
         ensure_signing_setup_or_skip!
         # Build: expect PEM password prompt unless SKIP_GEM_SIGNING
         puts "Running build (you may be prompted for the signing key password)..."
-        run_cmd!("SOURCE_DATE_EPOCH=#{epoch} bundle exec rake build")
+        run_cmd!("bundle exec rake build")
 
         # Checksums (commits, but does not push)
         run_cmd!("bin/gem_checksums")
@@ -105,7 +105,7 @@ module Kettle
 
         # Release: expect PEM password + RubyGems MFA OTP
         puts "Running release (you may be prompted for signing key password and RubyGems MFA OTP)..."
-        run_cmd!("SOURCE_DATE_EPOCH=#{epoch} bundle exec rake release")
+        run_cmd!("bundle exec rake release")
         # Some release tasks rebuild the gem; re-validate to ensure reproducibility
         validate_checksums!(version, stage: "after release")
 
@@ -200,7 +200,7 @@ module Kettle
 
       def run_cmd!(cmd)
         puts "$ #{cmd}"
-        # Ensure current ENV (including SOURCE_DATE_EPOCH) is propagated explicitly
+        # Execute commands with the current environment
         success = system(ENV, cmd)
         abort("Command failed: #{cmd}") unless success
       end
@@ -221,6 +221,19 @@ module Kettle
         abort("Git user.name or user.email not configured.") unless ok1 && ok2 && !name.empty? && !email.empty?
       end
 
+      def ensure_bundler_2_7_plus!
+        begin
+          require "bundler"
+        rescue LoadError
+          abort("Bundler is required. Please install bundler >= 2.7.0 and try again.")
+        end
+        ver = Gem::Version.new(Bundler::VERSION)
+        min = Gem::Version.new("2.7.0")
+        if ver < min
+          abort("kettle-release requires Bundler >= 2.7.0 for reproducible builds by default. Current: #{Bundler::VERSION}. Please upgrade bundler.")
+        end
+      end
+
       def detect_version
         # Look for lib/**/version.rb and extract VERSION constant string
         candidates = Dir[File.join(@root, "lib", "**", "version.rb")]
@@ -482,13 +495,6 @@ module Kettle
         puts "Merged #{feature} into #{trunk} and pushed. The PR (if any) should auto-close."
       end
 
-      def export_source_date_epoch!
-        epoch = Time.now.to_i
-        ENV["SOURCE_DATE_EPOCH"] = epoch.to_s
-        puts "Exported SOURCE_DATE_EPOCH=#{epoch}"
-        epoch
-      end
-
       def ensure_signing_setup_or_skip!
         return if ENV.key?("SKIP_GEM_SIGNING")
 
@@ -528,8 +534,8 @@ module Kettle
               sha256sum: #{actual}
               file: #{checks_path}
               file: #{expected}
-            Ensure SOURCE_DATE_EPOCH is set consistently and that the artifact used by release is identical to the one checksummed.
-            You can retry: export SOURCE_DATE_EPOCH=$EPOCHSECONDS; bundle exec rake build && bin/gem_checksums && bundle exec rake release
+            The artifact being released must match the checksummed artifact exactly.
+            Retry locally: bundle exec rake build && bin/gem_checksums && bundle exec rake release
           MSG
         else
           puts "Checksum OK #{stage}: #{File.basename(gem_path)}"
@@ -574,7 +580,7 @@ if ARGV.include?("-h") || ARGV.include?("--help")
       - Commits a release prep change
       - Ensures trunk is up-to-date, pushes branch, and monitors CI (GitHub/GitLab)
       - Merges feature into trunk upon CI success
-      - Exports SOURCE_DATE_EPOCH, builds, records checksums, and releases
+      - Builds, records checksums, and releases (requires Bundler >= 2.7.0)
 
     Environment:
       SKIP_GEM_SIGNING=true        # skip gem signing during build/release

data/lib/kettle/dev/version.rb

@@ -6,7 +6,7 @@ module Kettle
     module Version
       # The gem version.
       # @return [String]
-      VERSION = "1.0.6"
+      VERSION = "1.0.7"
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 1.0.6
+  version: 1.0.7
 platform: ruby
 authors:
 - Peter H. Boling
@@ -203,8 +203,8 @@ extra_rdoc_files:
 - REEK
 - RUBOCOP.md
 - SECURITY.md
-- checksums/kettle-dev-1.0.6.gem.sha256
-- checksums/kettle-dev-1.0.6.gem.sha512
+- checksums/kettle-dev-1.0.7.gem.sha256
+- checksums/kettle-dev-1.0.7.gem.sha512
 files:
 - ".devcontainer/devcontainer.json"
 - ".envrc"
@@ -256,8 +256,8 @@ files:
 - RUBOCOP.md
 - Rakefile
 - SECURITY.md
-- checksums/kettle-dev-1.0.6.gem.sha256
-- checksums/kettle-dev-1.0.6.gem.sha512
+- checksums/kettle-dev-1.0.7.gem.sha256
+- checksums/kettle-dev-1.0.7.gem.sha512
 - exe/kettle-commit-msg
 - exe/kettle-readme-backers
 - exe/kettle-release
@@ -290,10 +290,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com/
-  source_code_uri: https://github.com/galtzo-floss/kettle-dev/tree/v1.0.6
-  changelog_uri: https://github.com/galtzo-floss/kettle-dev/blob/v1.0.6/CHANGELOG.md
+  source_code_uri: https://github.com/galtzo-floss/kettle-dev/tree/v1.0.7
+  changelog_uri: https://github.com/galtzo-floss/kettle-dev/blob/v1.0.7/CHANGELOG.md
   bug_tracker_uri: https://github.com/galtzo-floss/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/1.0.6
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/1.0.7
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/galtzo-floss/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev

data/checksums/kettle-dev-1.0.6.gem.sha256

@@ -1 +0,0 @@
-57458ade85e8ec3c36087f4ffd6f07b2efa3e139a6787017387772014b6fc620

data/checksums/kettle-dev-1.0.6.gem.sha512

@@ -1 +0,0 @@
-668add6ecffd144af422608ea3b072b5feecc82a93fc387d356d25fac02367ab73edf44e3c72bb17c8f8b1bbe153d1d01673d44df9d84b46ab83761b85e2665f