oscerd commented on PR #9064:
URL: https://github.com/apache/camel-quarkus/pull/9064#issuecomment-5494529153
Thanks @jamesnetherton — both notes are right, and the second one reproduces
exactly as you described.
**Leftover `${version}/` — fixed.** I stubbed out `curl`/`wget`/`gpg`/`svn`
and forced the verification to fail on the *second* artifact, i.e. after the
script has already `cd`'d into the staging directory. Against the previous
revision the directory is left behind and the re-run dies at `mkdir` with `File
exists`; with this change it is cleared and the re-run gets past `mkdir`. The
trap now covers `stagingDir` as well as `gpgHome`, captured as an absolute path
before the `cd` so it still resolves from inside the directory it is removing.
The explicit `rm -rf ${version}/` at the end is gone, since the trap covers the
success path too.
**Revoked and expired keys — documented, not enforced.** You are right that
`gpg --verify` exits 0 for both and only warns, and that `KEYS` holds expired
keys by design because ASF keeps whatever signed past releases. So the
realistic gap really is an RM whose key lapsed mid-cycle rather than a forged
signature. I have taken the option you offered and put a note above
`fetch_verify_checksum` recording the gap and naming the fix (`--status-fd 1`,
reject `EXPKEYSIG`/`REVKEYSIG`), rather than folding the enforcement into this
PR — it changes which releases pass, so it seemed better as its own change.
Happy to do it here instead if you would rather.
Also confirmed your reading of the three `fetch_verify_checksum` call sites:
they expand to the same URLs and filenames as the blocks they replaced.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
