You are viewing a plain text version of this content. The canonical link for it is here.
Posted to geb-notifications@groovy.apache.org by "jonnybot0 (via GitHub)" <gi...@apache.org> on 2026/03/10 05:25:58 UTC
[PR] Update Release notes to use verification scripts [groovy-geb]
jonnybot0 opened a new pull request, #311:
URL: https://github.com/apache/groovy-geb/pull/311
This adds a port of the release verification scripts that @cbmarcum created for Groovy (see https://lists.apache.org/thread/684b33z83fmycgm3sl2k4lh2dn668pf7) to Geb and updates the RELEASING.md files to match their use.
I have tested out the verification script (verify.sh) against the 8.0.1 release (see https://dist.apache.org/repos/dist/release/groovy/geb/8.0.1/) with this command: `etc/bin/verify.sh release 8.0.1`. I haven't rigorously tested fail states, though I can attest that the scripts do fail for non-existent releases in dev & release.
Part of the motivation here is to demonstrate to the ASF that we have a process for verifying releases as well as reproducible builds. With that, we should be able to setup a more automated release process, similar to what Grails has.
I would love for someone to test out the changes to the RELEASING.md docs in particular. I realize you may have to do a "dry run" of some of the steps, since you won't be running against a real release, but some validation that the new steps make sense to someone who isn't me would be appreciated. :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: geb-notifications-unsubscribe@groovy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update Release notes to use verification scripts [groovy-geb]
Posted by "cbmarcum (via GitHub)" <gi...@apache.org>.
cbmarcum commented on code in PR #311:
URL: https://github.com/apache/groovy-geb/pull/311#discussion_r2935566029
##########
RELEASING.md:
##########
@@ -44,12 +44,18 @@ limitations under the License.
11. `git push` the version branch and tag to GitHub
12. `read -s APACHE_PW` and enter your password at the prompt
13. Run `./gradlew --no-build-cache publishJarsAndManual -x :integration:geb-gradle:publishPlugins -PapacheUser=jonnybot -PapachePassword="${APACHE_PW}"`
-14. Start the vote process on the groovy-dev mailing list. It will need at least 72 hours of remaining open and receive at least three affirmative votes from the Groovy PMC. See the [Apache Voting process](https://www.apache.org/foundation/voting.html) for more detail. Mention significant breaking changes if there are any.
-15. Assuming the vote passes (at least three +1 votes from the PMC), you can take the following steps to finalize the release.
-16. Email the vote thread to note that the vote has passed, with a final tally of the votes.
-17. Ask a member of the PMC to copy the artifacts from the staging directory in subversion to `groovy-release/geb/${VERSION}` and commit them to subversion, as above.
-18. Ask a member of the PMC to release the staging repository at https://repository.apache.org/#stagingRepositories
-19. Release the Gradle plugins with `./gradlew :integration:geb-gradle:publishPlugins`
+14. Verify the staged release. Run the automated verification script from the project root:
+ ```bash
+ etc/bin/verify.sh dev «version» /tmp/geb-«version»-verify
+ ```
+ This downloads the staged artifacts, verifies checksums and GPG signatures, checks for required files, and runs the RAT license audit. The individual scripts in `etc/bin/` can also be run separately — see their header comments for details.
+15. Verify the build is reproducible per [ASF Security policy](https://cwiki.apache.org/confluence/display/SECURITY/Reproducible+Builds) by running `etc/bin/test-reproducible-builds.sh` and comparing the locally-built jar checksums against the staged artifacts.
Review Comment:
Does "staged artifacts" refer to the jars staged at https://repository.apache.org/#stagingRepositories during a release vote?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: geb-notifications-unsubscribe@groovy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update Release notes to use verification scripts [groovy-geb]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #311:
URL: https://github.com/apache/groovy-geb/pull/311#discussion_r2909436725
##########
RELEASING.md:
##########
@@ -44,12 +44,18 @@ limitations under the License.
11. `git push` the version branch and tag to GitHub
12. `read -s APACHE_PW` and enter your password at the prompt
13. Run `./gradlew --no-build-cache publishJarsAndManual -x :integration:geb-gradle:publishPlugins -PapacheUser=jonnybot -PapachePassword="${APACHE_PW}"`
-14. Start the vote process on the groovy-dev mailing list. It will need at least 72 hours of remaining open and receive at least three affirmative votes from the Groovy PMC. See the [Apache Voting process](https://www.apache.org/foundation/voting.html) for more detail. Mention significant breaking changes if there are any.
-15. Assuming the vote passes (at least three +1 votes from the PMC), you can take the following steps to finalize the release.
-16. Email the vote thread to note that the vote has passed, with a final tally of the votes.
-17. Ask a member of the PMC to copy the artifacts from the staging directory in subversion to `groovy-release/geb/${VERSION}` and commit them to subversion, as above.
-18. Ask a member of the PMC to release the staging repository at https://repository.apache.org/#stagingRepositories
-19. Release the Gradle plugins with `./gradlew :integration:geb-gradle:publishPlugins`
+14. Verify the staged release. Run the automated verification script from the project root:
+ ```bash
+ etc/bin/verify.sh dev «version» /tmp/geb-«version»-verify
+ ```
+ This downloads the staged artifacts, verifies checksums and GPG signatures, checks for required files, and runs the RAT license audit. The individual scripts in `etc/bin/` can also be run separately — see their header comments for details.
+15. Verify the build is reproducible per [ASF Security policy](https://cwiki.apache.org/confluence/display/SECURITY/Reproducible+Builds) by running `etc/bin/test-reproducible-builds.sh` and comparing the locally-built jar checksums against the staged artifacts.
Review Comment:
Step 15 says to compare locally-built jar checksums against the staged artifacts, but `etc/bin/test-reproducible-builds.sh` only compares two local builds against each other and doesn’t fetch/compare staged jars. Please update the docs to match what the script actually verifies, or extend the tooling to perform the staged-vs-local comparison described here.
```suggestion
15. Verify the build is reproducible per [ASF Security policy](https://cwiki.apache.org/confluence/display/SECURITY/Reproducible+Builds) by running `etc/bin/test-reproducible-builds.sh`, which performs two local builds and compares the resulting jar checksums to confirm they are identical.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: geb-notifications-unsubscribe@groovy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update Release notes to use verification scripts [groovy-geb]
Posted by "cbmarcum (via GitHub)" <gi...@apache.org>.
cbmarcum commented on PR #311:
URL: https://github.com/apache/groovy-geb/pull/311#issuecomment-4060977427
Hi @jonnybot0 , The scripts look good to me. I like al the comments you've added.
The build and tests failed due to groovy-lang.org being down. I reran them and all is good.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: geb-notifications-unsubscribe@groovy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update Release notes to use verification scripts [groovy-geb]
Posted by "jonnybot0 (via GitHub)" <gi...@apache.org>.
jonnybot0 merged PR #311:
URL: https://github.com/apache/groovy-geb/pull/311
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: geb-notifications-unsubscribe@groovy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org