You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hudi.apache.org by "yihua (via GitHub)" <gi...@apache.org> on 2026/09/05 03:32:53 UTC
[PR] fix(release): reject an expired signing key in the src release verification [hudi-rs]
yihua opened a new pull request, #753:
URL: https://github.com/apache/hudi-rs/pull/753
## Description
closes #752
`gpg --verify` exits 0 for a good signature made by an expired or revoked key, emitting `EXPKEYSIG`/`REVKEYSIG` instead of `GOODSIG`, so the bare call under `errexit` accepted a release whose signing key was no longer valid. ASF's release-signing guidance requires `GOODSIG`, so this matches on `--status-fd` output rather than the exit code.
The license check also ran its container with `docker run -it`. Without a TTY that fails immediately, and under `errexit` that skipped both the license check and the binary-file check after it. The `-t` is not needed for a non-interactive container.
## How are the changes test-covered
- [x] N/A
- [ ] Automated tests (unit and/or integration tests)
- [x] Manual tests
- [x] Details are described below
The signature regression was reproduced with a throwaway key created and used to sign under `--faked-system-time`, expiring before the present, so the signature was made while the key was valid:
| check | result |
| --- | --- |
| `gpg --verify` exit code | `0`, the old check passes |
| status line emitted | `[GNUPG:] EXPKEYSIG ...` |
| this change's check | rejects, exits 1 |
The whole script was then run against the real `0.5.0-rc.1` artifacts in the dev repo. It reports `GOODSIG` and passes, and now reaches the license check (533 files, 0 invalid) and the binary-file check, both of which the `-it` failure previously skipped.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(release): reject an expired signing key in the src release verification [hudi-rs]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #753:
URL: https://github.com/apache/hudi-rs/pull/753#issuecomment-5549178681
## [Codecov](https://app.codecov.io/gh/apache/hudi-rs/pull/753?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 79.49%. Comparing base ([`593ed83`](https://app.codecov.io/gh/apache/hudi-rs/commit/593ed83a82010c6e42bdc6e1843629a16b9361a9?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`5f7fdd4`](https://app.codecov.io/gh/apache/hudi-rs/commit/5f7fdd486f74099cfd55b9810a0b19da2dcbfe22?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## main #753 +/- ##
=======================================
Coverage 79.49% 79.49%
=======================================
Files 126 126
Lines 12369 12369
=======================================
Hits 9833 9833
Misses 2536 2536
```
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/hudi-rs/pull/753?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(release): reject an expired signing key in the src release verification [hudi-rs]
Posted by "yihua (via GitHub)" <gi...@apache.org>.
yihua merged PR #753:
URL: https://github.com/apache/hudi-rs/pull/753
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org