From d9a09905105960c2173c1ad8e20382874ce4ea57 Mon Sep 17 00:00:00 2001
From: ScottW514 <s.e.wiederhold@gmail.com>
Date: Wed, 2 Sep 2026 08:08:20 -0400
Subject: [PATCH] release: the first release is 0.0.1, and a beta cannot be
 numbered 0.1.0

FORGEFIRM_RELEASE said 0.1.0, the first non-beta number by the settled
rule, so the first cut was either refused as 0.0.1 or shipped as a
non-beta. The recipe now says 0.0.1, and release.sh refuses a version at
or above 0.1.0 while the README carries the beta banner.
---
 .../recipes-forgefirm/images/forgefirm-image.bb       |  2 +-
 scripts/release.sh                                    | 11 +++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/meta-forgefirm/recipes-forgefirm/images/forgefirm-image.bb b/meta-forgefirm/recipes-forgefirm/images/forgefirm-image.bb
index 05df79f..8377b35 100644
--- a/meta-forgefirm/recipes-forgefirm/images/forgefirm-image.bb
+++ b/meta-forgefirm/recipes-forgefirm/images/forgefirm-image.bb
@@ -69,7 +69,7 @@ IMAGE_ROOTFS_MAXSIZE = "204800"
 # Release images carry the release version; the dev image overrides the
 # string with the build timestamp (the same DATETIME as the artifact
 # name) plus a dev tag.
-FORGEFIRM_RELEASE ?= "0.1.0"
+FORGEFIRM_RELEASE ?= "0.0.1"
 FORGEFIRM_VERSION_STRING ?= "v${FORGEFIRM_RELEASE}"
 
 write_forgefirm_version() {
diff --git a/scripts/release.sh b/scripts/release.sh
index bea6db8..736500f 100644
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -123,6 +123,17 @@ BB_REL=$(sed -n 's/^FORGEFIRM_RELEASE ?= "\(.*\)"/\1/p' "$IMAGE_BB")
 [ "$BB_REL" = "$VERSION" ] \
   || die "FORGEFIRM_RELEASE in forgefirm-image.bb is '$BB_REL', not '$VERSION'"
 
+# The beta rule: every release below 0.1.0 is a beta, and 0.1.0 is the
+# first release that is not. While the README carries the beta banner, a
+# version at or above 0.1.0 is a mistake, not a release.
+if grep -q 'ForgeFIRM is in beta' "$REPO/README.md"; then
+  MAJOR=${VERSION%%.*}; REST=${VERSION#*.}; MINOR=${REST%%.*}
+  case "$MAJOR.$MINOR" in
+    0.0) ;;
+    *) die "version $VERSION is not a beta number, and the README says ForgeFIRM is in beta (0.0.x only)" ;;
+  esac
+fi
+
 # The installer must embed the pubkey matching the signing key, or every
 # install will refuse the published archive.
 INST_HEX=$(sed -n "s/^PUBKEY='\(.*\)'$/\1/p" "$INSTALLER" | tr -d '\\x')