You are viewing a plain text version of this content. The canonical link for it is here.

Posted to jira@kafka.apache.org by "dino2895 (Jira)" <ji...@apache.org> on 2026/10/04 13:48:00 UTC

[jira] [Assigned] (KAFKA-21208) Auto-check the signing key and verify the asc files before publishing

     [ https://issues.apache.org/jira/browse/KAFKA-21208?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

dino2895 reassigned KAFKA-21208:
--------------------------------

    Assignee: dino2895  (was: Chia-Ping Tsai)

> Auto-check the signing key and verify the asc files before publishing
> ---------------------------------------------------------------------
>
>                 Key: KAFKA-21208
>                 URL: https://issues.apache.org/jira/browse/KAFKA-21208
>             Project: Kafka
>          Issue Type: Improvement
>            Reporter: Chia-Ping Tsai
>            Assignee: dino2895
>            Priority: Minor
>
> see [https://lists.apache.org/thread.html/8jhfc95ltgfg6zfd24ott64c0nojty0w]
> Our release flow does not check the signing key before publishing, so it is easy to use the subkey which can't be used to sign. We can add following improvements.
>  
>  # verify_gpg_key should check the input key must be signing-capable
>  # run gpg verification (we can leverage signMavenJavaPublication to generate the asc files) automatically before command "./gradlew publish" 



--
This message was sent by Atlassian Jira
(v8.20.10#820010)