(hudi-rs) 02/05: fix(release): reject an expired signing key in the src release verification (#753)

[yi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

yihua pushed a commit to branch release/0.5.x
in repository https://gitbox.apache.org/repos/asf/hudi-rs.git

commit 7c65257571c9198ddc2e77b5be6f71fa0c5ab974
Author: Y Ethan Guo <et...@gmail.com>
AuthorDate: Fri Sep 4 23:00:49 2026 -0700

    fix(release): reject an expired signing key in the src release verification (#753)
    
    (cherry picked from commit ddb727482694b25f5003db2a66b9dedd4a48cbae)
---
 release/verify_src_release.sh | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/release/verify_src_release.sh b/release/verify_src_release.sh
index ab6e7959..ff408f3c 100755
--- a/release/verify_src_release.sh
+++ b/release/verify_src_release.sh
@@ -70,7 +70,15 @@ echo "<<< OK"
 echo ">>> Verifying signature..."
 curl -s "https://dist.apache.org/repos/dist/$repo/hudi/KEYS" >"$work_dir/KEYS"
 gpg -q --import "$work_dir/KEYS"
-gpg --verify "$pub_key" "$src"
+# gpg exits 0 for a good signature made by an expired or revoked key, reporting
+# EXPKEYSIG/REVKEYSIG instead of GOODSIG. ASF requires GOODSIG, so match on the
+# status output rather than the exit code.
+# human-readable output goes to stderr and stays visible; status goes to the file
+gpg --verify --status-fd 1 "$pub_key" "$src" >"$work_dir/gpg_status"
+if ! grep -q '^\[GNUPG:\] GOODSIG ' "$work_dir/gpg_status"; then
+  echo "ERROR: signature is not a GOODSIG (expired or revoked signing key)."
+  exit 1
+fi
 echo "<<< OK"
 
 echo "Un-tarring the source release artifact"
@@ -100,7 +108,7 @@ fi
 echo "<<< OK"
 
 echo ">>> Verifying licenses..."
-docker run -it --rm -v $(pwd):/github/workspace apache/skywalking-eyes header check
+docker run -i --rm -v $(pwd):/github/workspace apache/skywalking-eyes header check
 echo "<<< OK"
 
 echo ">>> Verifying no binary files..."