I do pretty much the same thing, more manual in some cases. I also use "meld" to compare the release artifact to the tagg'd source repo. I usually verify the following at a minimum: http://incubator.apache.org/guides/releasemanagement.html#check-list
Patrick On Thu, May 8, 2014 at 5:06 AM, Tim Williams <[email protected]> wrote: > Everyone probably has their own manual nits that they go looking for > to validate a release but I'm wondering if folks have commands/tools > they use to help out? And if so, what are they? Here are a few that > I typically start out with, for example: > > #Snag the artifacts > wget --no-directories -r -q -np -l 1 > https://dist.apache.org/repos/dist/dev/incubator/blur/0.2.2-incubating/ > > #Check sums > for f in `ls *.gz` ;do echo -n `md5 $f` && echo -n "?=?" && cat $f.md5 > && echo -n `openssl sha1 $f` && echo -n "?=?" && cat $f.sha1 ;done > > #Verify sigs > for f in `ls *.gz` ;do gpg --verify $f.asc ;done > > #Gut check of tarball contents > diff <(tar -tf apache-blur-0.2.2-incubating-src.tar.gz) <(tar -tf > ../incubator-blur/distribution/target/apache-blur-0.2.2-incubating-src.tar.gz) > > Anyone else want to share? > Thanks, > --tim
