This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new b9a3082904d Make SDK release verification steps work on macOS and with
backports (#76897)
b9a3082904d is described below
commit b9a3082904d676e4d53f41ae6a9dc6e218ef26f1
Author: Amogh Desai <[email protected]>
AuthorDate: Wed Nov 11 13:23:23 2026 +0530
Make SDK release verification steps work on macOS and with backports
(#76897)
---
java-sdk/DEVELOPMENT.md | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/java-sdk/DEVELOPMENT.md b/java-sdk/DEVELOPMENT.md
index f3f54a34fd8..ba8c79104ca 100644
--- a/java-sdk/DEVELOPMENT.md
+++ b/java-sdk/DEVELOPMENT.md
@@ -360,9 +360,12 @@ manager, before sending the vote — should run against the
source package in
1. **Checksum.** Confirm the published SHA-512 matches the downloaded tarball:
```bash
- sha512sum -c apache-airflow-java-sdk-<VERSION>-src.tar.gz.sha512
+ shasum -a 512 -c apache-airflow-java-sdk-<VERSION>-src.tar.gz.sha512
```
+ `shasum` ships with both macOS and most Linux distributions; `sha512sum -c`
+ works too on Linux but is not installed on macOS by default.
+
2. **Signature.** Import the `KEYS` file and verify the GPG signature:
```bash
@@ -389,6 +392,16 @@ manager, before sending the vote — should run against the
source package in
Any remaining diff output is unexpected and should block the vote.
+ If the vote email says the source package was built from a commit before the
+ tag, diff the tarball against that commit instead, then confirm the tag adds
+ nothing to the SDK directory except the version bump. Limit the diff to the
+ SDK directory; the tag usually sits on a release branch, so an unscoped diff
+ also lists unrelated commits that landed in between:
+
+ ```bash
+ git -C tag-checkout diff <SOURCE-COMMIT> java-sdk/<VERSION>-rc<N> --stat --
java-sdk/
+ ```
+
4. **No binary files.** ASF source releases must not contain compiled code.
Scan for anything that isn't text:
