(superset) branch chore/verify-release-email-parsing created (now 971dbdafa57)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a change to branch chore/verify-release-email-parsing
in repository https://gitbox.apache.org/repos/asf/superset.git


      at 971dbdafa57 address review: bail out when GPG signature still unverified after retry

This branch includes the following new commits:

     new 971dbdafa57 address review: bail out when GPG signature still unverified after retry

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: address review: bail out when GPG signature still unverified after retry

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch chore/verify-release-email-parsing
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 971dbdafa57790708b1fe3c5eb204dc44f746cf5
Author: Evan Rusackas <ev...@rusackas.com>
AuthorDate: Thu Apr 23 15:58:56 2026 -0700

    address review: bail out when GPG signature still unverified after retry
---
 RELEASING/verify_release.py | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/RELEASING/verify_release.py b/RELEASING/verify_release.py
index 9e0347bc146..b896bf2fe7e 100755
--- a/RELEASING/verify_release.py
+++ b/RELEASING/verify_release.py
@@ -100,6 +100,19 @@ def get_gpg_info(filename: str) -> tuple[Optional[str], Optional[str]]:
         )
         output = result.stderr.decode()
 
+    # If GPG still can't verify the signature (non-zero return code or
+    # "No public key" remains), bail out rather than extracting a key ID
+    # from unverified signature metadata — reporting that as "verified"
+    # would be misleading.
+    if result.returncode != 0 or "No public key" in output:
+        print("GPG signature could not be verified.")
+        if "No public key" in output:
+            print(
+                "Hint: public key is not in your keyring. Import it with:\n"
+                f"  curl -s {KEYS_URL} | gpg --import"
+            )
+        return None, None
+
     rsa_key = re.search(r"RSA key ([0-9A-F]+)", output)
     eddsa_key = re.search(r"EDDSA key ([0-9A-F]+)", output)
 
@@ -129,11 +142,6 @@ def get_gpg_info(filename: str) -> tuple[Optional[str], Optional[str]]:
         print(f"Email found: {email_result}")
     else:
         print("Warning: No email address found in GPG verification output.")
-        if "No public key" in output:
-            print(
-                "Hint: public key is not in your keyring. Import it with:\n"
-                f"  curl -s {KEYS_URL} | gpg --import"
-            )
 
     return key_result, email_result