Keeping a Machine-Readable Record of What Every Release Shipped

Sooner or later someone asks what exactly was in a release. A customer whose security team wants to know which build of a program they’re running. An auditor working through a supply-chain questionnaire. A colleague trying to work out, a year later, whether the Windows download of version 2.3.0 had the fix in it.

The release page answers part of that: file names and sizes. It doesn’t say what was inside the archives, which platform each program was built for, or whether anyone checked. rmqa’s JSON report does, and it costs nothing to keep.

The Report

--format json prints the full result of a check: every file, its size and SHA-256, the platform it’s for, and every finding, with "ready": true or false at the end.

rmqa check dist --format json > rmqa-report.json

For a good release of the made-up tool tidy, the start of the report looks like this:

{
  "project": "tidy",
  "version": "2.3.0",
  "source": "dist",
  "files": [
    {
      "name": "tidy_darwin_amd64.tar.gz",
      "platform": "darwin/amd64",
      "present": true,
      "expected": true,
      "size": 689388,
      "sha256": "25a068727690f82b060cc44a8ad1578597355f80f4cffd97b195a1f2bf12325c",
      "findings": [
        {
          "code": "run-skipped",
          "severity": "info",
          "file": "tidy_darwin_amd64.tar.gz",
          "path": "tidy",
          "message": "not run: it's for darwin/amd64 and this machine is linux/amd64"
        }
      ]
    },
    {
      "name": "tidy_darwin_arm64.tar.gz",
  ...

and it ends with the summary:

  ],
  "errors": 0,
  "warnings": 0,
  "ready": true
}

The run-skipped notes are honest bookkeeping: they say which programs were checked by reading them and which were also run.

Keeping It

Write the report outside the release folder, so it doesn’t become part of the release it describes, and keep it wherever your team keeps records. In GitHub Actions, a workflow artifact with a long retention is the simplest choice:

- name: Check the release
  run: rmqa check dist --format json > rmqa-report.json

- uses: actions/upload-artifact@v4
  if: always()
  with:
    name: rmqa-report-${{ github.ref_name }}
    path: rmqa-report.json
    retention-days: 90

if: always() keeps the report of a failed check too, which is often the more useful one. For records that must outlive the workflow, copy the file to an object store or a compliance archive in the same job. The point is that the record is made by the step that approved the release, at the moment it was approved, and that it lists the SHA-256 of every file so anyone can match a download against it later.

What It Is and Isn’t

The report is a record of what rmqa saw: the files, their hashes, their platforms, and that the checks passed. It isn’t a signature, and it doesn’t prove who built the files or how. For that, sign the release and record provenance with the tools made for it. The rmqa report sits beside them and answers the plainer question, which is usually the first one asked: what did we ship?