Keeping Env Files and Private Keys Out of Release Archives

Sun, 25 Oct 2026 00:00:00 +0000

Packing scripts are often written as “take this folder and archive it”. That’s fine until the folder holds more than it should. A developer runs the release script locally once, with a .env file sitting in the build folder because the integration tests needed it. A signing step drops its key file next to the program it just signed. A Mac adds .DS_Store files to every folder it opens.

Once a release is public, a secret inside it is public too, and deleting the release doesn’t take it back: mirrors, caches and package managers may already have copies. The only safe time to catch it is before publishing.

rmqa 0.1 Checks a Software Release Before You Publish It

Sun, 25 Oct 2026 00:00:00 +0000

A release is a handful of files. An archive for Linux on Intel, one for Linux on ARM, two for macOS, a zip for Windows, a checksums file. Every one of them was produced by a pipeline that went green, and yet the set can still be wrong in ways nobody looks for: the ARM archive holds the Intel build, the Intel Mac archive still has last week’s program inside, the license is missing from the zip.

Releases on rmqa.com

Keeping Env Files and Private Keys Out of Release Archives

rmqa 0.1 Checks a Software Release Before You Publish It