Merge branch 'proposessl' into 'main'

Improve the bless version replica proposal format to include instructions on OS verification.

See merge request dfinity-lab/core/release!565

rs/cli/README.md

@@ -15,6 +15,9 @@ Features include:
 cargo install --git ssh://[email protected]/dfinity-lab/core/release release_cli
 ```
 
+Make sure you have `libssl.so.1.1` on your system (Ubuntu 22.04 and later
+will not carry it).  See below under *Troubleshooting* to get that going.
+
 ## Usage
 
 ```shell
@@ -39,6 +42,11 @@ Once downloaded and extracted, you can install it by running
 make
 make test
 sudo make install
+# The following adds the libraries to your system
+# path, where Cargo will look for them.
 sudo ln -s /usr/local/lib/libssl.so.1.1  /usr/lib/libssl.so.1.1
 sudo ln -s /usr/local/lib/libcrypto.so.1.1 /usr/lib/libcrypto.so.1.1
+# If you would rather not modify anything under /usr,
+# you can instead set the LD_LIBRARY_PATH= variable
+# to /usr/local in your ~/.bashrc.
 ```

rs/cli/src/ic_admin.rs

@@ -358,7 +358,33 @@ impl Cli {
         let template = format!(
             r#"Elect new replica binary revision [{version}](https://github.com/dfinity/ic/tree/{rc_branch_name})
         
-# Release Notes:"#
+# Release Notes:
+
+[comment]: <> Remove this block of text from the proposal.
+[comment]: <> Then, add the replica binary release notes as bullet points here.
+[comment]: <> Any [commit ID] within square brackets will auto-link to the specific changeset.
+
+# IC-OS Verification
+
+To build and verify the IC-OS disk image, run:
+
+```
+# From https://github.com/dfinity/ic#verifying-releases
+# This process requires Mac/Linux/WSL2, Git and Podman on your machine.
+git clone https://github.com/dfinity/ic
+cd ic
+git fetch origin
+git checkout {version}
+if ! ./gitlab-ci/container/build-ic.sh -i ; then
+    echo "IC-OS build failed.  Verification unsuccessful." >&2
+else
+    wget -c https://download.dfinity.systems/ic/{version}/guest-os/update-img/update-img.tar.gz
+    sha256sum artifact/icos/update-img.tar.gz update-img.tar.gz
+fi
+# The process should not say "IC-OS build failed." and
+# the two SHA256 sums output by the last command must match.
+```
+"#
         );
         let edited = edit::edit(template)?
             .trim()
@@ -382,14 +408,20 @@ impl Cli {
                 }
             })
             .join("\n");
-        Ok((
-            edited,
-            ProposeCommand::BlessReplicaVersionFlexible {
-                version: version.to_string(),
-                update_url,
-                stringified_hash,
-            },
-        ))
+        if edited.contains(&String::from("Remove this block of text from the proposal.")) {
+            Err(anyhow::anyhow!(
+                "The edited proposal text has not been edited to add release notes."
+            ))
+        } else {
+            Ok((
+                edited,
+                ProposeCommand::BlessReplicaVersionFlexible {
+                    version: version.to_string(),
+                    update_url,
+                    stringified_hash,
+                },
+            ))
+        }
     }
 
     pub(crate) async fn get_replica_versions_to_retire(