This is an automated email from the ASF dual-hosted git repository.
zeroshade pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/arrow-go.git
The following commit(s) were added to refs/heads/main by this push:
new 25a7ef92 build: verify Apache RAT jar checksum before execution (#908)
25a7ef92 is described below
commit 25a7ef92b4d78b6174f167ad3ae7c1135dceb91f
Author: Minh Vu <[email protected]>
AuthorDate: Thu Jul 9 21:01:13 2026 +0200
build: verify Apache RAT jar checksum before execution (#908)
---
dev/release/run_rat.sh | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/dev/release/run_rat.sh b/dev/release/run_rat.sh
index 21043692..afecfc20 100755
--- a/dev/release/run_rat.sh
+++ b/dev/release/run_rat.sh
@@ -24,6 +24,7 @@ RELEASE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
RAT_VERSION=0.16.1
RAT_JAR="${RELEASE_DIR}/apache-rat-${RAT_VERSION}.jar"
+RAT_SHA512="23047a236abcc182a0b3ecb42941f2c4d6307bf3b15c2b765863e33ec9040db6dd0466df0563d039622f503b87931948b5d6b8f729cbefb0f062c5bc67fcaa35"
if [ ! -f "${RAT_JAR}" ]; then
curl \
--fail \
@@ -33,6 +34,23 @@ if [ ! -f "${RAT_JAR}" ]; then
https://repo1.maven.org/maven2/org/apache/rat/apache-rat/${RAT_VERSION}/apache-rat-${RAT_VERSION}.jar
fi
+if ! ${PYTHON:-python3} - "${RAT_JAR}" "${RAT_SHA512}" <<'PY'; then
+import hashlib
+import pathlib
+import sys
+
+actual = hashlib.sha512(pathlib.Path(sys.argv[1]).read_bytes()).hexdigest()
+expected = sys.argv[2].strip()
+if actual != expected:
+ print(f"checksum mismatch for RAT jar {sys.argv[1]}")
+ print(f"expected: {expected}")
+ print(f"actual: {actual}")
+ raise SystemExit(1)
+PY
+ echo "checksum verification failed for ${RAT_JAR}" >&2
+ exit 1
+fi
+
RAT_XML="${RELEASE_DIR}/rat.xml"
java \
-jar "${RAT_JAR}" \
