Python release-tool #10114

phoerious · 2023-12-19T22:43:08Z

Work-in-progress PR for rewriting out release-tool in Python and merging the Bash and PS1 versions.

Type of change

✅ New feature (change that adds functionality)

codecov · 2023-12-19T23:07:34Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.35%. Comparing base (6f59444) to head (419de58).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop   #10114   +/-   ##
========================================
  Coverage    64.35%   64.35%           
========================================
  Files          378      378           
  Lines        39719    39719           
========================================
  Hits         25561    25561           
  Misses       14158    14158

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Fix argparse handling when no subcommand given Implement check command Implement i18n command Add Ctrl+F TOC Implement merge command Implement source tarball creation Implement macOS builds Implement Linux builds Support building for multiple platforms Disable test building Debug-log executed commands Allow cross-compilation without Docker when using vcpkg Implement macOS codesigning and notarization Remove obsolete globals Check xcode setup Implement GPG signing Re-enable Git branch checkout Show key selection for merge commit signing Check for git and merge basic and tool checks Remove redundant checkout message Update headline formatting

Fixes #11980

* Move pre-build installer signing to cmake to streamline the operation and avoid signing hundreds of unnecessary files. * Enable building both amd64 and arm64 builds with visual studio

* Incorporate shell=True directly into _run when on windows and modifying path/env * Fix _get_bin_path to resolve the build_dir to absolute path * Fix _git_branches_related to ignore non-zero return code * Fix double naming of transifex resource

droidmonkey · 2025-10-13T23:36:16Z

@phoerious this is ready for prime time. I tested all functions except for merge on windows. Made several improvements and fixes. Will test merge soon.

Copilot

Pull Request Overview

This PR introduces a comprehensive Python rewrite of the KeePassXC release tool, replacing the existing Bash and PowerShell versions with a unified Python implementation. The new tool consolidates functionality for checking, merging, building, signing, and internationalization tasks while adding improved cross-platform support.

Python-based unified release tool replacing separate Bash and PowerShell scripts
Enhanced Windows build system with integrated code signing capabilities
Updated Transifex configuration for modern API endpoints

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
release-tool.py	New comprehensive Python release tool with all functionality from previous scripts
release-tool.ps1	Removed PowerShell version (replaced by Python tool)
release-tool	Removed Bash version (replaced by Python tool)
share/linux/appimage-apprun.sh	New AppImage launcher script for Linux distributions
src/CMakeLists.txt	Updated Windows packaging to use new post-install script
cmake/WindowsPostInstall.cmake.in	New Windows post-install script template for signing and portable zip creation
cmake/MakePortableZip.cmake	Removed old portable zip creation script
.tx/config	Updated Transifex configuration for new API endpoints

Copilot · 2025-10-13T23:37:15Z

release-tool.py

+            raise Error('No secret keys found!')
+
+        if not user_choice and len(keys) == 1:
+            logger.info('Using secret key %s %s.', keys[0][0]. keys[0][2])


Missing comma operator between tuple elements. Should be keys[0][0], keys[0][2] instead of keys[0][0]. keys[0][2].

Suggested change

logger.info('Using secret key %s %s.', keys[0][0]. keys[0][2])

logger.info('Using secret key %s %s.', keys[0][0], keys[0][2])

Copilot · 2025-10-13T23:37:15Z

release-tool.py

+        changelog = 'Release ' + changelog.group(1)
+
+        tag_name = tag_name or version
+        logger.info('Creating "%s%" tag...', tag_name)


Incorrect string formatting with mismatched quotes. Should be 'Creating \"%s\" tag...' or use a different quote style to avoid the %s% pattern.

Suggested change

logger.info('Creating "%s%" tag...', tag_name)

logger.info('Creating "%s" tag...', tag_name)

Copilot · 2025-10-13T23:37:16Z

release-tool.py

+    yes_no = input().strip().lower()
+    if default_no:
+        return yes_no == 'y'
+    return yes_no == 'n'


Logic error in _yes_no_prompt function. When default_no=False (meaning default is 'yes'), the function should return yes_no != 'n' to return True unless user explicitly says 'n'.

Suggested change

return yes_no == 'n'

return yes_no != 'n'

Agree, this is a logic error

release-tool.py

Copilot · 2025-10-13T23:37:16Z

release-tool.py

+            signtool_args += ['/sha1', identity]
+        signtool_args += ['/d', file.name, str(file.resolve())]
+
+        _run(signtool_args, cwd=src_dir, capture_output=False, shell=True)


Using shell=True with user-controlled input (identity parameter) poses a command injection risk. The signtool_args list should be executed directly without shell=True.

Suggested change

_run(signtool_args, cwd=src_dir, capture_output=False, shell=True)

_run(signtool_args, cwd=src_dir, capture_output=False)

This is run locally, no risk for command injection unless you do it to yourself 😅

shell should still be set to false. I don't see why this needs to be run in a shell wrapper.

Because it literally didn't work otherwise. The sign tool will invoke a pin prompt and that will fail to show with an error if not done in a shell

Ok, perhaps add a comment then.

phoerious · 2025-10-14T08:02:44Z

release-tool.py

+            inst = subprocess.check_output([vswhere, '-latest', '-products', '*',
+                                           '-requires', 'Microsoft.Component.MSBuild',
+                                           '-property', 'installationPath'], text=True).strip()


Why not use _run(...).stdout here?

I wrote this before I understood all the functions in this file, good point

phoerious · 2025-10-14T08:04:57Z

release-tool.py

+        out = subprocess.run(f'cmd /c "{vs_cmd}" -arch={arch} -no_logo && set', capture_output=True, text=True)
+    except subprocess.CalledProcessError as e:
+        raise Error('Failed to run Visual Studio dev script: %s', e.output or str(e))


Same here. I would also separate the cmd call and the actual shell command like this:

_run(['cmd', '/c', f'"{vs_cmd}" -arch={arch} -no_logo && set']), text=True)

Also, maybe escaping spaces vs_cmd.replace(' ', r'\ ') is safer than quotes?

You should probably also call _find_vs_dev_cmd from here directly. There's only a single usage of both these functions, so no need to take vs_cmd as a parameter.

I tried so many ways to get all this to work.... out of 100 possible permutations only 2 work because windows command prompt is trash

phoerious · 2025-10-14T08:18:52Z

release-tool.py

+    for line in out.stdout.splitlines():
+        k, v = line.split('=', 1)
+        if v is not None:
+            env[k] = v


v will never be None. This will just error out if there's no =.

Maybe a better solution than Copilot's would be not to use expansion at all:

Suggested change

for line in out.stdout.splitlines():

k, v = line.split('=', 1)

if v is not None:

env[k] = v

for line in out.stdout.splitlines():

if len(kv := line.split('=', 1)) == 2:

env[kv[0]] = kv[1]

In my testing it didn't error out, only k had a value

For 'abc=' yes (but then it'll be '', not None). For 'abc' you will get a ValueError.

phoerious · 2025-10-14T08:24:57Z

release-tool.py

+        vs_cmd = _find_vs_dev_cmd()
+        vs_env = _capture_vs_env(vs_cmd, arch=platform_target)


Merge (see above)

phoerious added the build system label Dec 19, 2023

phoerious added this to the v2.8.0 milestone Dec 19, 2023

phoerious force-pushed the feature/python-release-tool branch 2 times, most recently from b460067 to c423ae6 Compare December 19, 2023 22:59

phoerious force-pushed the feature/python-release-tool branch 25 times, most recently from a56d67e to 0732119 Compare March 10, 2025 16:34

phoerious force-pushed the feature/python-release-tool branch 11 times, most recently from f52c79c to d741087 Compare March 11, 2025 17:36

droidmonkey force-pushed the feature/python-release-tool branch from 7fd7a73 to 85038ad Compare March 30, 2025 12:21

phoerious and others added 9 commits October 13, 2025 19:35

Add initial Python release-tool skeleton

60d4956

Remove explicit PATH and LD_LIBRARY_PATH from AppRun script

1f637c1

Fixes #11980

Add more ways to launch AppImage alt binaries

1193910

Remove stray #

ca5dccf

Fix errors found with pylance

6133b70

Remove legacy release tools

5b61e6c

* Fixes #12536 - use friendly description when signing msi file

356a4b1

* Move pre-build installer signing to cmake to streamline the operation and avoid signing hundreds of unnecessary files. * Enable building both amd64 and arm64 builds with visual studio

Update check and i18n

419de58

* Incorporate shell=True directly into _run when on windows and modifying path/env * Fix _get_bin_path to resolve the build_dir to absolute path * Fix _git_branches_related to ignore non-zero return code * Fix double naming of transifex resource

droidmonkey force-pushed the feature/python-release-tool branch from e728c4d to 419de58 Compare October 13, 2025 23:35

droidmonkey marked this pull request as ready for review October 13, 2025 23:36

Copilot AI review requested due to automatic review settings October 13, 2025 23:36

droidmonkey modified the milestones: v2.8.0, v2.7.11 Oct 13, 2025

droidmonkey added the high priority 🚨 label Oct 13, 2025

Copilot AI reviewed Oct 13, 2025

View reviewed changes

phoerious commented Oct 14, 2025

View reviewed changes

	logger.info('Using secret key %s %s.', keys[0][0]. keys[0][2])
	logger.info('Using secret key %s %s.', keys[0][0], keys[0][2])

	logger.info('Creating "%s%" tag...', tag_name)
	logger.info('Creating "%s" tag...', tag_name)

	_run(signtool_args, cwd=src_dir, capture_output=False, shell=True)
	_run(signtool_args, cwd=src_dir, capture_output=False)

		vs_cmd = _find_vs_dev_cmd()
		vs_env = _capture_vs_env(vs_cmd, arch=platform_target)

Uh oh!

Python release-tool #10114

Are you sure you want to change the base?

Python release-tool #10114

Uh oh!

Conversation

phoerious commented Dec 19, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Type of change

Uh oh!

codecov bot commented Dec 19, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

droidmonkey commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

phoerious Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

droidmonkey Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

phoerious Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

phoerious commented Dec 19, 2023 •

edited

Loading

codecov bot commented Dec 19, 2023 •

edited

Loading

droidmonkey commented Oct 13, 2025 •

edited

Loading

phoerious Oct 14, 2025 •

edited

Loading

droidmonkey Oct 14, 2025 •

edited

Loading

phoerious Oct 14, 2025 •

edited

Loading