You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iceberg.apache.org by ze...@apache.org on 2026/10/19 15:01:39 UTC
(terraform-provider-iceberg) branch main updated: fix: upload SHA256SUMS signature in RC workflow (#141)
This is an automated email from the ASF dual-hosted git repository.
zeroshade pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/terraform-provider-iceberg.git
The following commit(s) were added to refs/heads/main by this push:
new 57a78fd fix: upload SHA256SUMS signature in RC workflow (#141)
57a78fd is described below
commit 57a78fdf2d3b936fd94e6731ca7d89487cd81b7e
Author: Kevin Liu <ke...@users.noreply.github.com>
AuthorDate: Mon Oct 19 08:01:34 2026 -0700
fix: upload SHA256SUMS signature in RC workflow (#141)
Upload SHA256SUMS signature in RC workflow
GoReleaser signs SHA256SUMS in CI since #133, but the .sig was not
included in the uploaded artifacts, so it never reached the prerelease.
Also update comments and docs to reflect CI signing.
Co-authored-by: Copilot App <22...@users.noreply.github.com>
---
.github/workflows/tf-release.yml | 8 ++++----
.goreleaser.yml | 4 +---
dev/release/release_rc.sh | 7 ++++---
docs/releasing.md | 26 +++++++++++++++-----------
4 files changed, 24 insertions(+), 21 deletions(-)
diff --git a/.github/workflows/tf-release.yml b/.github/workflows/tf-release.yml
index 5ba6452..3828352 100644
--- a/.github/workflows/tf-release.yml
+++ b/.github/workflows/tf-release.yml
@@ -17,8 +17,7 @@
# On a release-candidate tag (e.g. v0.7.0-rc1), builds the source tarball and
# convenience binaries and publishes them as a GitHub prerelease. The release
-# manager drives the rest from dev/release/release_rc.sh (see docs/releasing.md);
-# CI never signs.
+# manager drives the rest from dev/release/release_rc.sh (see docs/releasing.md).
name: Terraform Build Release Candidate
@@ -111,7 +110,7 @@ jobs:
uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
with:
version: '~> v2'
- # Build only; signing and publishing happen later.
+ # Build and sign; publishing happens later.
args: release --clean --skip=publish,validate
env:
# Name artifacts with the final version (0.7.0, not 0.7.0-rc1) so the
@@ -136,6 +135,7 @@ jobs:
path: |
dist/*.zip
dist/*_SHA256SUMS
+ dist/*_SHA256SUMS.sig
dist/*_manifest.json
if-no-files-found: error
@@ -169,7 +169,7 @@ jobs:
GH_TOKEN: ${{ github.token }}
TAG: ${{ github.ref_name }}
run: |
- # release_rc.sh adds signatures afterwards; CI never signs.
+ # release_rc.sh adds the source signature afterwards.
gh release create "${TAG}" \
--prerelease \
--verify-tag \
diff --git a/.goreleaser.yml b/.goreleaser.yml
index 4235795..790a72c 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -25,9 +25,7 @@
# The official binary layout required by the registries is documented at
# https://developer.hashicorp.com/terraform/registry/providers/publishing
#
-# Signing of the SHA256SUMS file is performed locally by the release manager
-# with their KEYS-registered GPG key, so the `signs` block below is skipped in
-# CI (`--skip=sign`). See docs/releasing.md for the manual signing step.
+# The `signs` block below signs the SHA256SUMS file in CI. See docs/releasing.md.
version: 2
# The Terraform Registry requires the binary and archives to be named
diff --git a/dev/release/release_rc.sh b/dev/release/release_rc.sh
index 42947cb..0672ad2 100755
--- a/dev/release/release_rc.sh
+++ b/dev/release/release_rc.sh
@@ -23,8 +23,9 @@
# "Terraform Build Release Candidate" workflow (../../.github/workflows/tf-release.yml).
# 2. Waits for that workflow to publish the GitHub prerelease, then downloads
# its artifacts.
-# 3. Signs the source tarball (.asc) and the binary SHA256SUMS (.sig) with your
-# KEYS-registered GPG key and uploads the signatures back to the prerelease.
+# 3. Signs the source tarball (.asc) with your KEYS-registered GPG key and
+# uploads the signature back to the prerelease. CI signs the binary
+# SHA256SUMS (see docs/releasing.md).
# 4. Uploads the signed *source* release to the Apache dev SVN (the artifact the
# PMC votes on). Convenience binaries stay on the GitHub prerelease.
# 5. Prints the [VOTE] email for dev@iceberg.apache.org.
@@ -138,7 +139,7 @@ if [ "${RELEASE_SIGN}" -gt 0 ]; then
--repo "${repository}" \
"${id}/${rc_tar_gz}.asc"
- # Signatures are now done by CI via ATR
+ # The binary SHA256SUMS is now signed in CI (see docs/releasing.md).
# rm -rf binaries-rc
# mkdir -p binaries-rc
# gh release download "${rc_tag}" \
diff --git a/docs/releasing.md b/docs/releasing.md
index 8309211..a2e8188 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -47,9 +47,13 @@ The steps include:
* Terraform / OpenTofu Registry Access
* The [`apache` namespace on the Terraform Registry](https://registry.terraform.io/providers/apache)
must have the `terraform-provider-iceberg` provider claimed, with the
- release manager's GPG public key (the same key in `KEYS`) registered under
+ Iceberg project GPG public key (the key CI uses to sign `SHA256SUMS`,
+ also published in `KEYS`) registered under
**Settings → GPG Keys**. The OpenTofu Registry mirrors GitHub Releases for
- the same namespace and requires no separate upload.
+ the same namespace, but verifies signatures against the keys under
+ `keys/a/apache/iceberg/` in
+ [`opentofu/registry`](https://github.com/opentofu/registry), so the same
+ public key must be submitted there.
* Tooling installed locally
* `git`, `svn`, `gpg`, and `shasum`/`sha512sum`.
* [`gh`](https://cli.github.com/) (GitHub CLI), used to watch the build and
@@ -145,12 +149,12 @@ The script:
1. Tags `v<version>-rc<rc>` and pushes it, which triggers the
[`Terraform Build Release Candidate`](../.github/workflows/tf-release.yml)
- workflow. The workflow builds the source tarball and the convenience binaries
- and publishes them as a GitHub **prerelease**.
-2. Waits for the workflow, downloads the artifacts, and signs them with your
- KEYS-registered GPG key — a detached `.asc` over the source tarball and a
- detached `.sig` over the binary `SHA256SUMS` — then uploads the signatures
- back onto the prerelease.
+ workflow. The workflow builds the source tarball and the convenience binaries,
+ signs the binary `SHA256SUMS` (detached `.sig`) with the Iceberg project GPG
+ key, and publishes them as a GitHub **prerelease**.
+2. Waits for the workflow, downloads the source tarball, signs it with your
+ KEYS-registered GPG key (detached `.asc`), and uploads the signature back
+ onto the prerelease.
3. Uploads the signed **source** release to the Apache dev SVN at
`dev/iceberg/apache-iceberg-terraform-<version>-rc<rc>/`. Only the source is
voted on and archived in SVN; the convenience binaries stay on the GitHub
@@ -326,9 +330,9 @@ gpg --armor --export <YOUR KEY ID HERE> >> KEYS # append public key block
svn commit -m "add key for <YOUR NAME HERE>" # this requires Iceberg PMC privileges
```
-Register the **same** key under your account on the Terraform Registry
-(**Settings → GPG Keys**) so the registry can verify the `SHA256SUMS.sig` you
-attach to GitHub Releases.
+The `SHA256SUMS.sig` on GitHub Releases is signed in CI by the Iceberg project
+GPG key, not your personal key. That key's public half must be in `KEYS` and
+registered with both registries (see [Requirements](#requirements)).
> **Note:** Updating the `KEYS` artifact in the `release/` distribution requires
> Iceberg PMC privileges. Please work with a PMC member to update the file.