feat/packaging: brand the v2.55.0-2 release

.github/workflows/sourcegraph.yml

@@ -28,31 +28,73 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - run: test "$(uname -m)" = x86_64
+      - name: Configure branded version
+        run: |
+          . contrib/sourcegraph/packaging/release.sh
+          echo "GIT_VERSION=$GIT_VERSION" >>"$GITHUB_ENV"
       - run: ci/install-dependencies.sh
         env:
           CUSTOM_PATH: ${{ runner.temp }}/custom
       - run: ci/run-build-and-tests.sh
+      - run: test "$(./git --version)" = "git version $GIT_VERSION"
       - if: failure() && env.FAILED_TEST_ARTIFACTS != ''
         run: ci/print-test-failures.sh
 
   darwin:
     name: Darwin ARM64 build and test
-    runs-on: macos-14
+    runs-on: macos-15
     env:
       CC: clang
-      CI_JOB_IMAGE: macos-14
+      CI_JOB_IMAGE: macos-15
       jobname: osx-clang
       TEST_OUTPUT_DIRECTORY: ${{ github.workspace }}/t
     steps:
       - uses: actions/checkout@v6
       - run: test "$(uname -m)" = arm64
+      - run: test "$(sw_vers -productVersion | cut -d. -f1)" = 15
+      - name: Configure branded version
+        run: |
+          . contrib/sourcegraph/packaging/release.sh
+          echo "GIT_VERSION=$GIT_VERSION" >>"$GITHUB_ENV"
       - run: ci/install-dependencies.sh
         env:
           CUSTOM_PATH: ${{ runner.temp }}/custom
       - run: ci/run-build-and-tests.sh
+      - run: test "$(./git --version)" = "git version $GIT_VERSION"
       - if: failure() && env.FAILED_TEST_ARTIFACTS != ''
         run: ci/print-test-failures.sh
 
+  darwin-archive:
+    name: Darwin ARM64 archive
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
+      - run: test "$(uname -m)" = arm64
+      - run: test "$(sw_vers -productVersion | cut -d. -f1)" = 15
+      - name: Install build dependencies
+        run: |
+          brew install gnu-tar
+          command -v rustc
+          command -v cargo
+          command -v gtar
+      - name: Build archive from exact recipe head
+        run: ./contrib/sourcegraph/packaging/build-darwin.sh artifacts
+      - name: Validate archive
+        run: |
+          ./contrib/sourcegraph/packaging/validate-darwin-archive.sh \
+            artifacts/git-sourcegraph-v2.55.0-2-darwin-arm64.tar.gz
+      - uses: actions/upload-artifact@v6
+        with:
+          name: git-sourcegraph-v2.55.0-2-darwin-arm64
+          path: |
+            artifacts/git-sourcegraph-v2.55.0-2-darwin-arm64.tar.gz
+            artifacts/git-sourcegraph-v2.55.0-2-darwin-arm64.tar.gz.sha256
+          if-no-files-found: error
+          retention-days: 7
+
   fork-policy:
     name: Fork and packaging policy
     runs-on: ubuntu-24.04
@@ -73,8 +115,10 @@ jobs:
             do
               sh -n "$script"
             done
-            grep -Fx 'SOURCE_TAG=v2.55.0' contrib/sourcegraph/packaging/build-linux.sh
-            grep -Fx 'SOURCE_COMMIT=e9019fcafe0040228b8631c30f97ae1adb61bcdc' contrib/sourcegraph/packaging/build-linux.sh
-            grep -Fx 'RELEASE_VERSION=v2.55.0-1' contrib/sourcegraph/packaging/build-linux.sh
+            . contrib/sourcegraph/packaging/release.sh
+            test "$SOURCE_TAG" = v2.55.0
+            test "$SOURCE_COMMIT" = e9019fcafe0040228b8631c30f97ae1adb61bcdc
+            test "$RELEASE_VERSION" = v2.55.0-2
+            test "$GIT_VERSION" = 2.55.0.sourcegraph.2
             grep -F 'FROM debian:12@sha256:' contrib/sourcegraph/packaging/Dockerfile.linux
           }

SOURCEGRAPH.md

@@ -19,11 +19,11 @@ Release tags use `sourcegraph/v<upstream-version>-<revision>`, for example
 packaging, or rebuild releases on the same upstream baseline, and resets to 1
 when the upstream version changes. Tags and assets are immutable. Release
 metadata records the corresponding Git source and packaging recipe commits
-separately. Git's reported version remains the upstream numeric version
-(`2.55.0` today) for consumer parser compatibility. The release, archive, and
-`BUILD-INFO` carry the downstream identity; `git version --build-options`
-identifies the compiled source commit. Any branded Git version suffix requires
-explicit build and consumer-parser validation first.
+separately. Starting with `sourcegraph/v2.55.0-2`, the tag maps to Git output
+`2.55.0.sourcegraph.2`; in general, tag revision `N` maps to the dotted suffix
+`.sourcegraph.N`. The immutable first release is the exception: it reports
+plain `2.55.0`. `BUILD-INFO` carries the downstream identity, and
+`git version --build-options` identifies the compiled source commit.
 
 Distribution has three separate owners:
 

contrib/sourcegraph/packaging/README.md

@@ -6,13 +6,15 @@ export the exact upstream-compatible `v2.55.0` source at commit
 `e9019fcafe0040228b8631c30f97ae1adb61bcdc`, regardless of the branch from
 which the packaging script runs.
 
-The current immutable downstream release is `sourcegraph/v2.55.0-1`. A
-release consists of exactly these files:
+The next immutable downstream release is `sourcegraph/v2.55.0-2`, whose Git
+binary reports `2.55.0.sourcegraph.2`. It consists of exactly these files:
 
-* `git-sourcegraph-v2.55.0-1-linux-amd64.tar.gz`
-* `git-sourcegraph-v2.55.0-1-linux-amd64.tar.gz.sha256`
-* `git-sourcegraph-v2.55.0-1-darwin-arm64.tar.gz`
-* `git-sourcegraph-v2.55.0-1-darwin-arm64.tar.gz.sha256`
+* `git-sourcegraph-v2.55.0-2-linux-amd64.tar.gz`
+* `git-sourcegraph-v2.55.0-2-linux-amd64.tar.gz.sha256`
+* `git-sourcegraph-v2.55.0-2-darwin-arm64.tar.gz`
+* `git-sourcegraph-v2.55.0-2-darwin-arm64.tar.gz.sha256`
+
+The existing `sourcegraph/v2.55.0-1` tag and assets remain immutable.
 
 Each archive has one `git-sourcegraph/` root. Stripping that directory exposes
 `bin/`, `libexec/`, `share/`, optional `lib/`, and `BUILD-INFO`. The latter
@@ -21,11 +23,12 @@ versions, recipe commit, and the identity embedded in Git. The source commit is
 what was compiled; the recipe commit identifies the packaging implementation.
 Consumers should verify the checksum sidecar before extracting.
 
-The source constants in both entry-point scripts move together. They currently
-pin upstream `v2.55.0` because this experiment has no behavior patches. When a
-future Sourcegraph behavior patch lands, update the source ref and commit to the
-exact downstream revision containing that patch; never leave the builder
-exporting an older upstream commit.
+`release.sh` is the source of truth for upstream version, release revision, Git
+version, and source identity. It currently pins upstream `v2.55.0` because this
+experiment has no behavior patches. When a future Sourcegraph behavior patch
+lands, update the source ref and commit to the exact downstream revision
+containing that patch; never leave the builder exporting an older upstream
+commit.
 
 ## Linux AMD64
 
@@ -34,7 +37,7 @@ Install Docker, then run:
 ```console
 ./contrib/sourcegraph/packaging/build-linux.sh
 ./contrib/sourcegraph/packaging/validate-linux-archive.sh \
-  artifacts/git-sourcegraph-v2.55.0-1-linux-amd64.tar.gz
+  artifacts/git-sourcegraph-v2.55.0-2-linux-amd64.tar.gz
 ```
 
 The builder image starts from Debian 12 at a pinned multi-platform image
@@ -50,19 +53,26 @@ PCRE2, user config, `/etc/gitconfig`, HTTPS, and all ELF dependencies.
 
 ## macOS ARM64
 
-The Mac artifact must be built and validated on a supported Apple Silicon Mac.
-Install Xcode command-line tools, Rust, and GNU tar, then run:
+The Mac artifact supports the latest released macOS major (26) and the
+previous major (15) on Apple Silicon. Build and validate it on either supported
+major. Install Xcode command-line tools, Rust, and GNU tar, then run:
 
 ```console
 xcode-select --install # if the tools are not already installed
 brew install rust gnu-tar
 ./contrib/sourcegraph/packaging/build-darwin.sh
+./contrib/sourcegraph/packaging/validate-darwin-archive.sh \
+  artifacts/git-sourcegraph-v2.55.0-2-darwin-arm64.tar.gz
 ```
 
+The `Darwin ARM64 archive` job runs the same commands on GitHub's macOS 15
+ARM64 runner and uploads the archive and checksum as a temporary workflow
+artifact. It does not create tags, releases, or release assets.
+
 The script discards inherited Nix SDK, compiler, and library search settings;
-uses an Apple Xcode SDK; and targets macOS 14 by default. If `xcode-select`
-points outside the normal Apple developer directories, the script uses
-`/Applications/Xcode.app` when available and otherwise stops before building.
+uses an Apple Xcode SDK; and currently targets macOS 15 by default. If
+`xcode-select` points outside the normal Apple developer directories, the
+script uses `/Applications/Xcode.app` when available and otherwise stops before building.
 Override Xcode with `SOURCEGRAPH_GIT_DEVELOPER_DIR` or the deployment floor with
 `SOURCEGRAPH_GIT_DEPLOYMENT_TARGET` only when deliberately preparing a
 different artifact. It downloads checksum-pinned PCRE2 10.48 source and builds
@@ -73,24 +83,24 @@ the build machine. Git still includes its English fallthrough messages.
 
 The full install includes `git-credential-osxkeychain`, rejects non-system
 Mach-O dependencies (including `/opt/homebrew` and build paths), verifies
-arm64 and the macOS 14 deployment floor, strips ephemeral source/staging paths,
+arm64 and the configured deployment floor, strips ephemeral source/staging paths,
 and then ad-hoc signs unsigned installed binaries. Ad-hoc signatures are not
 Apple notarization and do not establish publisher identity.
 
-Before an experimental service release, unpack the archive into two different
+Before release, unpack the archive into two different
 directories and run `bin/git version --build-options`, `bin/git init`, a PCRE2
 `git grep -P`, an HTTPS clone/fetch, and the team's normal SSH, GPG signing, and
 Git LFS workflows. Inspect every Mach-O file with `otool -L` and
-`codesign --verify --verbose`. Publish the checksummed archives only as an
-opt-in prerelease under an immutable downstream tag; sign that tag separately
-when signing infrastructure is available. Creating the tag or GitHub release
-is intentionally outside these scripts.
-
-Validation on macOS 26.6.2 exercised those core workflows, but the locked
-noninteractive login keychain prevented a `credential-osxkeychain` store/get/
-erase round trip. The macOS 14 deployment floor was inspected in Mach-O load
-commands, not run on macOS 14. Complete both checks before describing this as a
-fully supported everyday Git replacement.
+`codesign --verify --verbose`. Publish the checksummed archives under an
+immutable downstream tag; sign that tag separately when signing infrastructure
+is available. Creating the tag or GitHub release is intentionally outside
+these scripts.
+
+Sourcegraph gitserver clears `credential.helper`, so an interactive
+`credential-osxkeychain` round trip is not a service-release gate. The helper
+remains included for other uses; validate it separately before broad engineer
+adoption. A deployment target below the two supported majors is conservative
+binary metadata, not a promise of runtime support for that older macOS release.
 
 ## License notices
 

contrib/sourcegraph/packaging/build-darwin.sh

@@ -1,9 +1,6 @@
 #!/bin/sh
 set -eu
 
-SOURCE_TAG=v2.55.0
-SOURCE_COMMIT=e9019fcafe0040228b8631c30f97ae1adb61bcdc
-RELEASE_VERSION=v2.55.0-1
 PCRE2_VERSION=10.48
 PCRE2_SHA256=b6c68fdf6f3ac31388b50aa89ff0fc49c00c987c16e7b5146491d12003f2c8ed
 
@@ -13,6 +10,7 @@ test "$(uname -s)" = Darwin && test "$(uname -m)" = arm64 || {
 }
 
 root=$(git rev-parse --show-toplevel)
+. "$root/contrib/sourcegraph/packaging/release.sh"
 output=${1:-"$root/artifacts"}
 RECIPE_COMMIT=$(git -C "$root" rev-parse HEAD)
 actual=$(git -C "$root" rev-parse "$SOURCE_TAG^{commit}")
@@ -57,7 +55,7 @@ fi
 export DEVELOPER_DIR
 SDKROOT=$(/usr/bin/xcrun --sdk macosx --show-sdk-path)
 export SDKROOT
-MACOSX_DEPLOYMENT_TARGET=${SOURCEGRAPH_GIT_DEPLOYMENT_TARGET:-14.0}
+MACOSX_DEPLOYMENT_TARGET=${SOURCEGRAPH_GIT_DEPLOYMENT_TARGET:-15.0}
 export MACOSX_DEPLOYMENT_TARGET
 CC=$(/usr/bin/xcrun --find clang)
 AR=$(/usr/bin/xcrun --find ar)
@@ -93,8 +91,7 @@ pcre_prefix="$work/pcre2-install"
 (
 	cd "$work"
 	SOURCE_DATE_EPOCH=$(git -C "$root" show -s --format=%ct "$SOURCE_COMMIT") \
-	SOURCE_COMMIT="$SOURCE_COMMIT" SOURCE_TAG="$SOURCE_TAG" \
-	RECIPE_COMMIT="$RECIPE_COMMIT" RELEASE_VERSION="$RELEASE_VERSION" \
+	RECIPE_COMMIT="$RECIPE_COMMIT" \
 	PCRE2_PREFIX="$pcre_prefix" \
 	PCRE2_LICENSE="$work/pcre2-$PCRE2_VERSION/LICENCE.md" \
 	SOURCE_BUILD_ROOT="$work" \

contrib/sourcegraph/packaging/build-from-source.sh

@@ -1,12 +1,12 @@
 #!/bin/sh
 set -eu
 
+script_dir=$(CDPATH= cd "$(dirname "$0")" && pwd)
+. "$script_dir/release.sh"
+
 platform=${1:?usage: build-from-source.sh PLATFORM [OUTPUT]}
 output=${2:-/out}
-: "${SOURCE_COMMIT:?SOURCE_COMMIT is required}"
-: "${SOURCE_TAG:?SOURCE_TAG is required}"
 : "${RECIPE_COMMIT:?RECIPE_COMMIT is required}"
-: "${RELEASE_VERSION:?RELEASE_VERSION is required}"
 : "${SOURCE_DATE_EPOCH:?SOURCE_DATE_EPOCH is required}"
 
 stage=$(mktemp -d)
@@ -44,12 +44,16 @@ mkdir -p "$prefix" "$output"
 make clean
 # shellcheck disable=SC2086
 make -j"$(getconf _NPROCESSORS_ONLN)" $make_options \
-	prefix=/ sysconfdir=/etc GIT_VERSION=2.55.0 \
+	prefix=/ sysconfdir=/etc GIT_VERSION="$GIT_VERSION" \
 	GIT_BUILT_FROM_COMMIT="$SOURCE_COMMIT" all
 # shellcheck disable=SC2086
-make $make_options prefix=/ sysconfdir=/etc GIT_VERSION=2.55.0 \
+make $make_options prefix=/ sysconfdir=/etc GIT_VERSION="$GIT_VERSION" \
 	GIT_BUILT_FROM_COMMIT="$SOURCE_COMMIT" DESTDIR="$prefix" install
 
+test "$($prefix/bin/git --version)" = "git version $GIT_VERSION"
+$prefix/bin/git version --build-options |
+	grep -F "built from commit: $SOURCE_COMMIT"
+
 mkdir "$prefix/LICENSES"
 cp COPYING "$prefix/LICENSES/Git-COPYING"
 
@@ -63,7 +67,7 @@ then
 	cp "$pcre2_license" "$prefix/LICENSES/PCRE2-LICENCE"
 	# The keychain helper is intentionally included in the full Mac install.
 	# shellcheck disable=SC2086
-	make $make_options prefix=/ sysconfdir=/etc GIT_VERSION=2.55.0 \
+	make $make_options prefix=/ sysconfdir=/etc GIT_VERSION="$GIT_VERSION" \
 		GIT_BUILT_FROM_COMMIT="$SOURCE_COMMIT" DESTDIR="$prefix" \
 		install-git-credential-osxkeychain
 	contrib/sourcegraph/packaging/verify-darwin-dependencies.sh "$prefix"
@@ -73,6 +77,8 @@ fi
 
 {
 	echo "release_version=$RELEASE_VERSION"
+	echo "upstream_version=$UPSTREAM_VERSION"
+	echo "release_revision=$RELEASE_REVISION"
 	echo "source_tag=$SOURCE_TAG"
 	echo "source_commit=$SOURCE_COMMIT"
 	echo "recipe_commit=$RECIPE_COMMIT"

contrib/sourcegraph/packaging/build-linux.sh

@@ -1,12 +1,9 @@
 #!/bin/sh
 set -eu
 
-SOURCE_TAG=v2.55.0
-SOURCE_COMMIT=e9019fcafe0040228b8631c30f97ae1adb61bcdc
-RELEASE_VERSION=v2.55.0-1
-IMAGE=git-sourcegraph-linux-builder:v2.55.0-1
-
 root=$(git rev-parse --show-toplevel)
+. "$root/contrib/sourcegraph/packaging/release.sh"
+IMAGE=git-sourcegraph-linux-builder:$RELEASE_VERSION
 output=${1:-"$root/artifacts"}
 RECIPE_COMMIT=$(git -C "$root" rev-parse HEAD)
 actual=$(git -C "$root" rev-parse "$SOURCE_TAG^{commit}")
@@ -37,10 +34,7 @@ docker run --rm \
 	--user "$(id -u):$(id -g)" \
 	-e HOME=/tmp \
 	-e SOURCE_DATE_EPOCH="$(git -C "$root" show -s --format=%ct "$SOURCE_COMMIT")" \
-	-e SOURCE_COMMIT="$SOURCE_COMMIT" \
-	-e SOURCE_TAG="$SOURCE_TAG" \
 	-e RECIPE_COMMIT="$RECIPE_COMMIT" \
-	-e RELEASE_VERSION="$RELEASE_VERSION" \
 	-v "$work:/src" \
 	-v "$output:/out" \
 	"$IMAGE"

contrib/sourcegraph/packaging/release.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+UPSTREAM_VERSION=2.55.0
+RELEASE_REVISION=2
+SOURCE_TAG=v$UPSTREAM_VERSION
+SOURCE_COMMIT=e9019fcafe0040228b8631c30f97ae1adb61bcdc
+RELEASE_VERSION=v$UPSTREAM_VERSION-$RELEASE_REVISION
+GIT_VERSION=$UPSTREAM_VERSION.sourcegraph.$RELEASE_REVISION