You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@arrow.apache.org by "kou (via GitHub)" <gi...@apache.org> on 2025/02/07 00:57:09 UTC
[I] [Release] Add support for verifying .{asc,sha256,512} for .jar related files in `dev/release/verify_rc.sh` [arrow-java]
kou opened a new issue, #593:
URL: https://github.com/apache/arrow-java/issues/593
### Describe the enhancement requested
We should:
* Download binary artifacts from GitHub Release
* Verify signature by `gpg --verify XXX.asc XXX`
* Verify checksum by `sha256 -c XXX.sha256` and `sha512 -c XXX.sha512`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Release] Add support for verifying .{asc,sha256,512} for .jar related files in `dev/release/verify_rc.sh` [arrow-java]
Posted by "yyossy5 (via GitHub)" <gi...@apache.org>.
yyossy5 commented on issue #593:
URL: https://github.com/apache/arrow-java/issues/593#issuecomment-2803561855
Thank you @kou , I'll check this when I have a moment.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Release] Add support for verifying .{asc,sha256,512} for .jar related files in `dev/release/verify_rc.sh` [arrow-java]
Posted by "kou (via GitHub)" <gi...@apache.org>.
kou commented on issue #593:
URL: https://github.com/apache/arrow-java/issues/593#issuecomment-2803538530
@yyossy5 You may be interested in this.
We need to vote before we publish an "official" release based on the Apache Software Foundation policy: https://infra.apache.org/release-publishing.html#voting
We have a verification script to help the process: https://github.com/apache/arrow-java/blob/main/dev/release/verify_rc.sh
But it's not completed. This issue focus on https://github.com/apache/arrow-java/blob/4b4d92851c8ecba1876a8f452279122e88e5ff8e/dev/release/verify_rc.sh#L142
We want to add auto verification for `.asc`/`.sha256`/`.sha512` in this issue as the first step. We'll run unit tests against built `.jar` in follow-up tasks.
We'll be able to run the code by `VERIFY_DEFAULT=0 VERIFY_BINARY=1 dev/release/verify_rc.sh 18.2.0 5`.
See also: https://github.com/apache/arrow-java/blob/main/dev/release/README.md#verify
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Release] Add support for verifying .{asc,sha256,512} for .jar related files in `dev/release/verify_rc.sh` [arrow-java]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on issue #593:
URL: https://github.com/apache/arrow-java/issues/593#issuecomment-2662661408
@kou for staging, it's fine, we can use GitHub Release location. As we also push to dist.apache.org (`release` location, not `dev` after release), it's OK.
@kou so you are right, GitHub Release is good enough for verification.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Release] Add support for verifying .{asc,sha256,512} for .jar related files in `dev/release/verify_rc.sh` [arrow-java]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on issue #593:
URL: https://github.com/apache/arrow-java/issues/593#issuecomment-2653979928
From an ASF standpoint, the most important is to verify the source distribution from dist.apache.org.
So, maybe we can verify artifacts from GitHub Release, but also from dist.apache.org.
Do you want me to give it a shoot ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Release] Add support for verifying .{asc,sha256,512} for .jar related files in `dev/release/verify_rc.sh` [arrow-java]
Posted by "kou (via GitHub)" <gi...@apache.org>.
kou commented on issue #593:
URL: https://github.com/apache/arrow-java/issues/593#issuecomment-2655212592
Oh, really!?
https://www.apache.org/legal/release-policy.html#host-rc uses "SHOULD":
> Projects should use the [/dev tree of the dist repository](https://dist.apache.org/repos/dist/dev) or the staging features of repository.apache.org to host release candidates posted for developer testing/voting (prior to being, potentially, formally blessed as a GA release).
So, I thought that we can use other ASF approved locations such as Artifactory https://apache.jfrog.io/ and GitHub Release.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org