This is an automated email from the ASF dual-hosted git repository.
shahar pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new db9368bb75b Add checksum verification to Apache RAT downloading in
release instructions (#60841)
db9368bb75b is described below
commit db9368bb75b625afae60e6bc5bba456795039b4c
Author: Shahar Epstein <[email protected]>
AuthorDate: Wed Jan 21 09:27:21 2026 +0200
Add checksum verification to Apache RAT downloading in release instructions
(#60841)
---
dev/README_RELEASE_AIRFLOW.md | 7 +++++--
dev/README_RELEASE_AIRFLOWCTL.md | 7 +++++--
dev/README_RELEASE_HELM_CHART.md | 11 ++++++++---
dev/README_RELEASE_PROVIDERS.md | 7 +++++--
dev/README_RELEASE_PYTHON_CLIENT.md | 7 +++++--
5 files changed, 28 insertions(+), 11 deletions(-)
diff --git a/dev/README_RELEASE_AIRFLOW.md b/dev/README_RELEASE_AIRFLOW.md
index f80c6829212..c6b8a91a7f7 100644
--- a/dev/README_RELEASE_AIRFLOW.md
+++ b/dev/README_RELEASE_AIRFLOW.md
@@ -889,10 +889,13 @@ This can be done with the Apache RAT tool.
Download the latest jar from https://creadur.apache.org/rat/download_rat.cgi
(unpack the binary, the jar is inside)
-You can run this command to do it for you:
+You can run this command to do it for you (including checksum verification for
your own security):
```shell script
-wget -qO-
https://dlcdn.apache.org//creadur/apache-rat-0.17/apache-rat-0.17-bin.tar.gz |
gunzip | tar -C /tmp -xvf -
+# Checksum value is taken from
https://downloads.apache.org/creadur/apache-rat-0.17/apache-rat-0.17-bin.tar.gz.sha512
+wget -q
https://dlcdn.apache.org//creadur/apache-rat-0.17/apache-rat-0.17-bin.tar.gz -O
/tmp/apache-rat-0.17-bin.tar.gz
+echo
"32848673dc4fb639c33ad85172dfa9d7a4441a0144e407771c9f7eb6a9a0b7a9b557b9722af968500fae84a6e60775449d538e36e342f786f20945b1645294a0
/tmp/apache-rat-0.17-bin.tar.gz" | sha512sum -c -
+tar -xzf /tmp/apache-rat-0.17-bin.tar.gz -C /tmp
```
Unpack the release source archive (the `<package + version>-source.tar.gz`
file) to a folder
diff --git a/dev/README_RELEASE_AIRFLOWCTL.md b/dev/README_RELEASE_AIRFLOWCTL.md
index 9a22d7bfc18..9eb06947ab1 100644
--- a/dev/README_RELEASE_AIRFLOWCTL.md
+++ b/dev/README_RELEASE_AIRFLOWCTL.md
@@ -546,10 +546,13 @@ This can be done with the Apache RAT tool.
Download the latest jar from https://creadur.apache.org/rat/download_rat.cgi
(unpack the binary, the jar is inside)
-You can run this command to do it for you:
+You can run this command to do it for you (including checksum verification for
your own security):
```shell script
-wget -qO-
https://dlcdn.apache.org//creadur/apache-rat-0.17/apache-rat-0.17-bin.tar.gz |
gunzip | tar -C /tmp -xvf -
+# Checksum value is taken from
https://downloads.apache.org/creadur/apache-rat-0.17/apache-rat-0.17-bin.tar.gz.sha512
+wget -q
https://dlcdn.apache.org//creadur/apache-rat-0.17/apache-rat-0.17-bin.tar.gz -O
/tmp/apache-rat-0.17-bin.tar.gz
+echo
"32848673dc4fb639c33ad85172dfa9d7a4441a0144e407771c9f7eb6a9a0b7a9b557b9722af968500fae84a6e60775449d538e36e342f786f20945b1645294a0
/tmp/apache-rat-0.17-bin.tar.gz" | sha512sum -c -
+tar -xzf /tmp/apache-rat-0.17-bin.tar.gz -C /tmp
```
Unpack the release source archive (the `<package + version>-source.tar.gz`
file) to a folder
diff --git a/dev/README_RELEASE_HELM_CHART.md b/dev/README_RELEASE_HELM_CHART.md
index c59e4fb7b28..385b48df8bb 100644
--- a/dev/README_RELEASE_HELM_CHART.md
+++ b/dev/README_RELEASE_HELM_CHART.md
@@ -542,10 +542,15 @@ cd
${SVN_REPO_ROOT}/dev/airflow/helm-chart/${VERSION}${VERSION_SUFFIX}
## Licence check
-This can be done with the Apache RAT tool.
+You can run this command to do it for you (including checksum verification for
your own security):
+
+```shell script
+# Checksum value is taken from
https://downloads.apache.org/creadur/apache-rat-0.17/apache-rat-0.17-bin.tar.gz.sha512
+wget -q
https://dlcdn.apache.org//creadur/apache-rat-0.17/apache-rat-0.17-bin.tar.gz -O
/tmp/apache-rat-0.17-bin.tar.gz
+echo
"32848673dc4fb639c33ad85172dfa9d7a4441a0144e407771c9f7eb6a9a0b7a9b557b9722af968500fae84a6e60775449d538e36e342f786f20945b1645294a0
/tmp/apache-rat-0.17-bin.tar.gz" | sha512sum -c -
+tar -xzf /tmp/apache-rat-0.17-bin.tar.gz -C /tmp
+```
-* Download the latest jar from https://creadur.apache.org/rat/download_rat.cgi
(unpack the binary,
- the jar is inside)
* Unpack the release source archive (the `<package + version>-source.tar.gz`
file) to a folder
* Enter the sources folder run the check
diff --git a/dev/README_RELEASE_PROVIDERS.md b/dev/README_RELEASE_PROVIDERS.md
index b6ed381522c..aa98623a906 100644
--- a/dev/README_RELEASE_PROVIDERS.md
+++ b/dev/README_RELEASE_PROVIDERS.md
@@ -832,10 +832,13 @@ This can be done with the Apache RAT tool.
Download the latest jar from https://creadur.apache.org/rat/download_rat.cgi
(unpack the binary, the jar is inside)
-You can run this command to do it for you:
+You can run this command to do it for you (including checksum verification for
your own security):
```shell script
-wget -qO-
https://dlcdn.apache.org//creadur/apache-rat-0.17/apache-rat-0.17-bin.tar.gz |
gunzip | tar -C /tmp -xvf -
+# Checksum value is taken from
https://downloads.apache.org/creadur/apache-rat-0.17/apache-rat-0.17-bin.tar.gz.sha512
+wget -q
https://dlcdn.apache.org//creadur/apache-rat-0.17/apache-rat-0.17-bin.tar.gz -O
/tmp/apache-rat-0.17-bin.tar.gz
+echo
"32848673dc4fb639c33ad85172dfa9d7a4441a0144e407771c9f7eb6a9a0b7a9b557b9722af968500fae84a6e60775449d538e36e342f786f20945b1645294a0
/tmp/apache-rat-0.17-bin.tar.gz" | sha512sum -c -
+tar -xzf /tmp/apache-rat-0.17-bin.tar.gz -C /tmp
```
Unpack the release source archive (the `<package + version>-source.tar.gz`
file) to a folder
diff --git a/dev/README_RELEASE_PYTHON_CLIENT.md
b/dev/README_RELEASE_PYTHON_CLIENT.md
index 4458683341e..16369a6d840 100644
--- a/dev/README_RELEASE_PYTHON_CLIENT.md
+++ b/dev/README_RELEASE_PYTHON_CLIENT.md
@@ -462,10 +462,13 @@ This can be done with the Apache RAT tool.
Download the latest jar from https://creadur.apache.org/rat/download_rat.cgi
(unpack the binary, the jar is inside)
-You can run this command to do it for you:
+You can run this command to do it for you (including checksum verification for
your own security):
```shell script
-wget -qO-
https://dlcdn.apache.org//creadur/apache-rat-0.17/apache-rat-0.17-bin.tar.gz |
gunzip | tar -C /tmp -xvf -
+# Checksum value is taken from
https://downloads.apache.org/creadur/apache-rat-0.17/apache-rat-0.17-bin.tar.gz.sha512
+wget -q
https://dlcdn.apache.org//creadur/apache-rat-0.17/apache-rat-0.17-bin.tar.gz -O
/tmp/apache-rat-0.17-bin.tar.gz
+echo
"32848673dc4fb639c33ad85172dfa9d7a4441a0144e407771c9f7eb6a9a0b7a9b557b9722af968500fae84a6e60775449d538e36e342f786f20945b1645294a0
/tmp/apache-rat-0.17-bin.tar.gz" | sha512sum -c -
+tar -xzf /tmp/apache-rat-0.17-bin.tar.gz -C /tmp
```
Unpack the release source archive (the `<package + version>-source.tar.gz`
file) to a folder
