Prepare 0.4.0

[complexspaces]

I had to find a small "nit" to fix in the README so there was a diff to open a PR checklist against 😆.

Proposed release notes

I saw this on rustls/rustls#2156 but I think we use GitHub's autogeneration for this here? The big things to mention are porting to windows-sys, the addition of new_with_extra_roots everywhere but Android (for now), and the improved deployment documentation.

Post-merge steps

• Generate Android Maven artifacts locally N/A
• Create and push Git tag
• cargo publish for each required crate, based on release steps
• Create companion GitHub release

[cpu]

I saw this on rustls/rustls#2156 but I think we use GitHub's autogeneration for this here?

FWIW we use the auto-gen on Rustls as well and the "proposed release notes" are for the human-curated headlines at the top of the release before the generated changelog/commits.

[cpu]

The big things to mention are porting to windows-sys, the addition of new_with_extra_roots everywhere but Android (for now), and the improved deployment documentation.

WDYT about text like:

• improved support for "extra" roots - the ability to specify additional root certificates beyond the platform's own roots has been extended to all supported platforms with the exception of Android (TBD). This can be used for additive configuration, for example to support all system roots and additionally some internal, or company specific, roots. The existing Linux/UNIX verifier's new_with_extra_roots() fn now accepts impl IntoIterator<Item = pki_types::TrustAnchor<'static>> in place of Vec<pki_types::CertificateDer<'static>> to better harmonize with the other platforms.
• replace winapi with windows-sys - the latter is a 1st party Microsoft crate with better on-going support.
• improved documentation - the README has been updated to better describe the differences between this crate and other available options.

The main things I was hoping to see are calling out the breaking API change before/after for the "other" verifier new_with_roots() fn and to perhaps expand on why winapi was replaced.

[cpu]

README diff looks good to me :-)

[djc]

Maybe worth calling out the additivity angle with regards to the extra roots API?

[complexspaces]

@cpu I think your changes look good with one exception:

...now accepts Vec<pki_types::CertificateDer<'static>> in place of impl IntoIterator<Item = pki_types::TrustAnchor<'static>> to better harmonize with the other platforms.

This is the opposite now with #145 merged into main. Everything uses the impl IntoIterator<_> approach instead.

[cpu]

This is the opposite now with #145 merged into main

Oops 🤦 Thanks for catching that. I updated the text in my comment.

Maybe worth calling out the additivity angle with regards to the extra roots API?

I also made an edit to try and add some language for this. WDYT?

[complexspaces]

I think the new edits look good 👍

[djc]

Maybe worth calling out the additivity angle with regards to the extra roots API?

I also made an edit to try and add some language for this. WDYT?

Maybe "often used" -> "can be used"? Otherwise LGTM!

[complexspaces]

I want to rebase this one on main once #150 merges.

[cpu]

#150 is merged. Can I do anything to help get this release out the door?

[complexspaces]

Its appreciated, but the reminder is plenty, thanks! I just had a quick backlog on another crate to get through but I'll get this out the door today shortly :)

[complexspaces]

0.4.0 is now released and on live on crates.io. 🎉

I added an extra line to the headline release notes drafted above for the extension config and method deprecation.

[complexspaces]

@cpu One thing I'd like to work on with you before the next release is improving the release steps documentation. There seems to be some conflict between them and the post-merge steps. For example, the order of this PR step and the cargo publish are mismatched, as is the time to create a Git tag.

[cpu]

0.4.0 is now released and on live on crates.io. 🎉

Nice, thank you!

One thing I'd like to work on with you before the next release is improving the release steps documentation.

SGTM. Maybe I can start a draft PR and we can collab there?

[complexspaces]

SGTM. Maybe I can start a draft PR and we can collab there?

Sounds like a plan to me 👍. No rush though since we probably have a bit before the next release.