oscerd opened a new pull request, #9064: URL: https://github.com/apache/camel-quarkus/pull/9064
Fixes #9061. `release-utils/scripts/upload-source.sh` downloaded each artifact together with its detached signature, then generated the `.sha512` files that get published directly from those downloads and `svn import`ed the directory to `dist.apache.org/repos/dist/dev`. `gpg --verify` was never invoked, so the `.asc` files were copied along unchecked and the published checksums described whatever had been downloaded rather than something verified. **Changes** - Import the in-repo `KEYS` into a throwaway `--homedir` (via `mktemp -d`, removed by an `EXIT` trap) so verification is answered by the project release keys rather than by whatever is in the release manager's own keyring. - Add a `fetch_verify_checksum` helper that downloads the artifact and its `.asc`, verifies the signature, and only then writes the `.sha512`. This collapses the three near-identical blocks into three calls. - Drop `-k` from the staging probe. Only a status code is consumed there so the impact was minimal, but disabling certificate validation bought nothing. `set -e` is already in force, so a failed verification aborts the release rather than publishing an unverified artifact. **Verification** - `bash -n` passes. - `KEYS` imports cleanly into a throwaway keyring (25 public keys). - `gpg --verify` against a bogus signature exits non-zero, confirming `set -e` will abort. - The `location` used to resolve `KEYS` is captured before the script `cd`s into the version directory, so the relative path still resolves. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
