This is an automated email from the ASF dual-hosted git repository.
chaokunyang pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/fory-site.git
The following commit(s) were added to refs/heads/main by this push:
new 76cef028189 docs: use unsigned source builds for local verification
(#500)
76cef028189 is described below
commit 76cef02818993005c903e9c84269c764843b7019
Author: Shawn Yang <[email protected]>
AuthorDate: Tue Sep 1 00:44:22 2026 +0800
docs: use unsigned source builds for local verification (#500)
---
docs/community/how_to_release.md | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/docs/community/how_to_release.md b/docs/community/how_to_release.md
index f5e75c348a3..f6d550363cf 100644
--- a/docs/community/how_to_release.md
+++ b/docs/community/how_to_release.md
@@ -425,8 +425,18 @@ that a build is reproducible.
other build inputs. Rebuild from source without reusing CI-produced binaries
or build-output caches. Run packaging steps only: do not invoke `stage_jvm`,
`publish_jvm`, or upload another candidate merely to verify an existing one.
- Local reproduction does not require the CI private signing key or Nexus
- deployment credentials.
+ For the source archive, run this unsigned build from the repository root:
+
+ ```bash
+ python3 ci/release.py build -v "$release_version" --skip-sign
+ ```
+
+ This writes the source archive and its SHA-512 file under `dist/` without
+ invoking GPG or generating an `.asc` file. CI continues to use `build`
without
+ `--skip-sign` to sign the staged archive. Local verification must not sign
+ artifacts, import the CI private key, or require Nexus deployment
credentials.
+ Use only the public key to verify the signatures downloaded from staging.
+
3. Compare the complete locally rebuilt files with the staged files. The scope
includes the source `.tar.gz` and every CI-signed JVM artifact in both Nexus
repositories: binary, source, and documentation JARs, POMs, and any other
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
