This is an automated email from the ASF dual-hosted git repository. chaokunyang pushed a commit to branch new_release_process2 in repository https://gitbox.apache.org/repos/asf/fory-site.git
commit efe2e66f7eeee25b9ef612903e17bd8aceeaccbf Author: chaokunyang <[email protected]> AuthorDate: Tue Sep 1 00:42:54 2026 +0800 docs: use unsigned source builds for local verification --- docs/community/how_to_release.md | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/docs/community/how_to_release.md b/docs/community/how_to_release.md index f5e75c348a3..f6d550363cf 100644 --- a/docs/community/how_to_release.md +++ b/docs/community/how_to_release.md @@ -425,8 +425,18 @@ that a build is reproducible. other build inputs. Rebuild from source without reusing CI-produced binaries or build-output caches. Run packaging steps only: do not invoke `stage_jvm`, `publish_jvm`, or upload another candidate merely to verify an existing one. - Local reproduction does not require the CI private signing key or Nexus - deployment credentials. + For the source archive, run this unsigned build from the repository root: + + ```bash + python3 ci/release.py build -v "$release_version" --skip-sign + ``` + + This writes the source archive and its SHA-512 file under `dist/` without + invoking GPG or generating an `.asc` file. CI continues to use `build` without + `--skip-sign` to sign the staged archive. Local verification must not sign + artifacts, import the CI private key, or require Nexus deployment credentials. + Use only the public key to verify the signatures downloaded from staging. + 3. Compare the complete locally rebuilt files with the staged files. The scope includes the source `.tar.gz` and every CI-signed JVM artifact in both Nexus repositories: binary, source, and documentation JARs, POMs, and any other --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
