Sign release builds

[rubo]

Changes

• Implemented release build signing as a replacement for the signatures of downloads.nethermind.io
• Updated release notes template
• Refactored and removed redundant scripts

Types of changes

What types of changes does your code introduce?

• Bugfix (a non-breaking change that fixes an issue)
• New feature (a non-breaking change that adds functionality)
• Breaking change (a change that causes existing functionality not to work as expected)
• Optimization
• Refactoring
• Documentation update
• Build-related changes
• Other: Description

Testing

Requires testing

• Yes
• No

If yes, did you write tests?

• Yes
• No

Notes on testing

Tested manually

Documentation

Requires documentation update

• Yes
• No

NethermindEth/docs#323

Requires explanation in Release Notes

• Yes
• No

[EvilJordan]

So, part of what I think this change involved was changing the target_commitish from the hash to release/1.35.8.

That's nice and all, but now I can't deterministically create the browser_download_url since it still uses the hash.

I realize I'm probably a minority and this isn't that important, but it seems odd that the actual download file name still contains the hash if it's not being used elsewhere. Here's the relevant part of the new release JSON snippet:

curl --silent "https://api.github.com/repos/NethermindEth/nethermind/releases/latest"
{
  "url": "https://api.github.com/repos/NethermindEth/nethermind/releases/271752666",
  "assets_url": "https://api.github.com/repos/NethermindEth/nethermind/releases/271752666/assets",
  "upload_url": "https://uploads.github.com/repos/NethermindEth/nethermind/releases/271752666/assets%7B?name,label}",
  "html_url": "https://github.com/NethermindEth/nethermind/releases/tag/1.35.8",
  "id": 271752666,
  "author": {
    "login": "core-repository-dispatch-app[bot]",
    "id": 173070810,
    "node_id": "BOT_kgDOClDZ2g",
    "avatar_url": "https://avatars.githubusercontent.com/u/43478154?v=4",
    "gravatar_id": "",
    "url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D",
    "html_url": "https://github.com/apps/core-repository-dispatch-app",
    "followers_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/followers",
    "following_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/following%7B/other_user%7D",
    "gists_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/gists%7B/gist_id%7D",
    "starred_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/starred%7B/owner%7D%7B/repo%7D",
    "subscriptions_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/subscriptions",
    "organizations_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/orgs",
    "repos_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/repos",
    "events_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/events%7B/privacy%7D",
    "received_events_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/received_events",
    "type": "Bot",
    "user_view_type": "public",
    "site_admin": false
  },
  "node_id": "RE_kwDOBggaLc4QMp3a",
  "tag_name": "1.35.8",
  "target_commitish": "release/1.35.8",
  "name": "v1.35.8",
  "draft": false,
  "immutable": false,
  "prerelease": false,
  "created_at": "2025-12-18T13:24:18Z",
  "updated_at": "2025-12-19T16:09:58Z",
  "published_at": "2025-12-19T13:29:20Z",
  "assets": [
    {
      "url": "https://api.github.com/repos/NethermindEth/nethermind/releases/assets/330650969",
      "id": 330650969,
      "node_id": "RA_kwDOBggaLc4TtVVZ",
      "name": "nethermind-1.35.8-c066aee2-linux-arm64.zip",
      "label": "",
      "uploader": {
        "login": "core-repository-dispatch-app[bot]",
        "id": 173070810,
        "node_id": "BOT_kgDOClDZ2g",
        "avatar_url": "https://avatars.githubusercontent.com/u/43478154?v=4",
        "gravatar_id": "",
        "url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D",
        "html_url": "https://github.com/apps/core-repository-dispatch-app",
        "followers_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/followers",
        "following_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/following%7B/other_user%7D",
        "gists_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/gists%7B/gist_id%7D",
        "starred_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/starred%7B/owner%7D%7B/repo%7D",
        "subscriptions_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/subscriptions",
        "organizations_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/orgs",
        "repos_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/repos",
        "events_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/events%7B/privacy%7D",
        "received_events_url": "https://api.github.com/users/core-repository-dispatch-app%5Bbot%5D/received_events",
        "type": "Bot",
        "user_view_type": "public",
        "site_admin": false
      },
      "content_type": "application/zip",
      "state": "uploaded",
      "size": 104287050,
      "digest": "sha256:0136a1611411768138aa8b37e94aef5c03d44108953eb797db22cc6cf30729b7",
      "download_count": 18,
      "created_at": "2025-12-19T13:21:13Z",
      "updated_at": "2025-12-19T13:21:17Z",
      "browser_download_url": "https://github.com/NethermindEth/nethermind/releases/download/1.35.8/nethermind-1.35.8-c066aee2-linux-arm64.zip"
    },

[EvilJordan]

Eh, it's fine. I can easily program around it. Just an odd choice to me!

[rubo]

Eh, it's fine. I can easily program around it. Just an odd choice to me!

Well, the Nethermind download URLs have always included the partial commit hash, and this PR changes nothing in that regard. Also, some of our users depend on that scheme, and changing things may break their setups. Anyway, we're happy you found an easy workaround.

[EvilJordan]

changing things may break their setups

But this broke the setup because target_commitish used to include the hash?

[rubo]

changing things may break their setups

But this broke the setup because target_commitish used to include the hash?

Ah, are you talking about GitHub API and its target_commitish field? If so, we can restore it for our subsequent releases.

[EvilJordan]

Ah, are you talking about GitHub API and its target_commitish field? If so, we can restore it for our subsequent releases.

Yes! Apologies for not being more specific.

The update script calls the API at: https://api.github.com/repos/NethermindEth/nethermind/releases/latest and parses the JSON for the latest version. I've since changed it to a "dumber" version that is doing string matching on the flavor I need, but I prefer the commitish hash since that feels safer to me! It's not a big deal, though!