(roller) branch fix-release-signing-script created (now 30623d0a7)

[sn...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

snoopdave pushed a change to branch fix-release-signing-script
in repository https://gitbox.apache.org/repos/asf/roller.git


      at 30623d0a7 Fix release signing script argument handling and checksums

This branch includes the following new commits:

     new 30623d0a7 Fix release signing script argument handling and checksums

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(roller) 01/01: Fix release signing script argument handling and checksums

[sn...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

snoopdave pushed a commit to branch fix-release-signing-script
in repository https://gitbox.apache.org/repos/asf/roller.git

commit 30623d0a79d73ecf4f22635206153fbc5715d0d0
Author: David M. Johnson <sn...@apache.org>
AuthorDate: Sat Sep 5 16:39:55 2026 -0400

    Fix release signing script argument handling and checksums
    
    The release-candidate guard read
    
        if [ rcstring != "" ]; then
    
    which compares the literal word "rcstring" against the empty string and is
    therefore always true. Final releases took the rename branch too, where it
    became a no-op rename of each archive onto itself.
    
    The version and RC suffix were also hardcoded to the previous release, so
    the script had to be edited before every use.
    
    Take both as arguments, rename only when there is a suffix to add, and skip
    an archive that has already been renamed so a re-run after a failure is not
    confusing.
    
    Two other changes:
    
    - Require the signing key to be named through ROLLER_SIGNING_KEY, and refuse
      a key that is not RSA or is under 4096 bits. Older keys may still be in a
      release manager's keyring and would otherwise be picked by default.
    - Write checksums with shasum(1) rather than "gpg --print-md", so downloaders
      can verify with "shasum -c", and emit SHA-512 alongside SHA-256.
    
    Claude-Session: https://claude.ai/code/session_019R1jdtwkaYEeA6L9DXEtEi
---
 assembly-release/sign-release.sh | 93 +++++++++++++++++++++++++++++++---------
 1 file changed, 73 insertions(+), 20 deletions(-)

diff --git a/assembly-release/sign-release.sh b/assembly-release/sign-release.sh
index c8a16738c..54c946a86 100755
--- a/assembly-release/sign-release.sh
+++ b/assembly-release/sign-release.sh
@@ -1,31 +1,84 @@
 #!/usr/bin/env bash
+#
+# Sign and checksum the Roller release archives produced by "mvn package".
+#
+#   ROLLER_SIGNING_KEY=<keyid> ./sign-release.sh <version> [rc-suffix]
+#
+#   ./sign-release.sh 6.1.6           # final release
+#   ./sign-release.sh 6.1.6 -rc1      # release candidate
+#
+# For a release candidate the archives are renamed to carry the suffix before
+# they are signed, so the signatures match the names that are voted on.
 
-export rcstring="-rc2"
-export vstring="6.1.5"
+set -euo pipefail
 
-# for rc releases we rename the release files
-if [ rcstring != "" ]; then
-    mv target/apache-roller-${vstring}-source.tar.gz target/apache-roller-${vstring}${rcstring}-source.tar.gz
-    mv target/apache-roller-${vstring}-source.zip    target/apache-roller-${vstring}${rcstring}-source.zip
-    mv target/apache-roller-${vstring}-binary.tar.gz target/apache-roller-${vstring}${rcstring}-binary.tar.gz
-    mv target/apache-roller-${vstring}-binary.zip    target/apache-roller-${vstring}${rcstring}-binary.zip
+vstring="${1:-}"
+rcstring="${2:-}"
+
+if [ -z "$vstring" ]; then
+    echo "usage: ROLLER_SIGNING_KEY=<keyid> $0 <version> [rc-suffix]" >&2
+    echo "   eg: ROLLER_SIGNING_KEY=ABCD1234 $0 6.1.6 -rc1" >&2
+    exit 2
+fi
+
+key="${ROLLER_SIGNING_KEY:-}"
+if [ -z "$key" ]; then
+    echo "ROLLER_SIGNING_KEY is not set." >&2
+    echo "Name the signing key explicitly: older, non-compliant keys may still" >&2
+    echo "be in the keyring and gpg would otherwise pick one of them." >&2
+    exit 2
+fi
+
+# Refuse to sign with a key that does not meet current ASF policy, which
+# requires RSA and forbids new DSA keys:
+# https://infra.apache.org/release-signing.html
+if ! keyline=$(gpg --with-colons --list-keys "$key" 2>/dev/null | grep -m1 '^pub:'); then
+    echo "no key matching '$key' in the keyring" >&2
+    exit 1
+fi
+algo=$(echo "$keyline" | cut -d: -f4)
+bits=$(echo "$keyline" | cut -d: -f3)
+if [ "$algo" != "1" ]; then
+    echo "key $key is not RSA (public key algorithm $algo); ASF policy forbids" >&2
+    echo "new DSA keys for code signing" >&2
+    exit 1
+fi
+if [ "$bits" -lt 4096 ]; then
+    echo "key $key is only $bits bits; ASF policy asks for at least 4096" >&2
+    exit 1
 fi
 
-gpg --armor --detach-sig target/apache-roller-${vstring}${rcstring}-binary.tar.gz
-gpg --armor --detach-sig target/apache-roller-${vstring}${rcstring}-binary.zip
-gpg --armor --detach-sig target/apache-roller-${vstring}${rcstring}-source.tar.gz
-gpg --armor --detach-sig target/apache-roller-${vstring}${rcstring}-source.zip
+cd "$(dirname "$0")"
 
-gpg --print-md sha256 target/apache-roller-${vstring}${rcstring}-binary.tar.gz > \
-target/apache-roller-${vstring}${rcstring}-binary.tar.gz.sha256
+for kind in source binary; do
+    for ext in tar.gz zip; do
+        built="target/apache-roller-${vstring}-${kind}.${ext}"
+        final="target/apache-roller-${vstring}${rcstring}-${kind}.${ext}"
 
-gpg --print-md sha256 target/apache-roller-${vstring}${rcstring}-binary.zip > \
-target/apache-roller-${vstring}${rcstring}-binary.zip.sha256
+        if [ ! -f "$built" ] && [ ! -f "$final" ]; then
+            echo "missing $built — run 'mvn package' first" >&2
+            exit 1
+        fi
 
-gpg --print-md sha256 target/apache-roller-${vstring}${rcstring}-source.tar.gz > \
-target/apache-roller-${vstring}${rcstring}-source.tar.gz.sha256
+        # Only rename when there is a suffix to add and the rename has not
+        # already happened. The previous version of this script tested
+        # [ rcstring != "" ], which compares the literal word against the empty
+        # string and is therefore always true, so it also "renamed" final
+        # releases onto themselves.
+        if [ -n "$rcstring" ] && [ "$built" != "$final" ] && [ -f "$built" ]; then
+            mv "$built" "$final"
+        fi
 
-gpg --print-md sha256 target/apache-roller-${vstring}${rcstring}-source.zip > \
-target/apache-roller-${vstring}${rcstring}-source.zip.sha256
+        gpg --local-user "$key" --armor --detach-sig --yes "$final"
 
+        # shasum(1) format, which downloaders can feed straight back to
+        # "shasum -c". SHA-512 and SHA-256 are what current policy asks for;
+        # MD5 and SHA-1 must not be published.
+        base=$(basename "$final")
+        ( cd target && shasum -a 512 "$base" > "$base.sha512" )
+        ( cd target && shasum -a 256 "$base" > "$base.sha256" )
+    done
+done
 
+echo "Signed apache-roller-${vstring}${rcstring} with key $key:"
+ls -1 "target/apache-roller-${vstring}${rcstring}-"*