This is an automated email from the ASF dual-hosted git repository.
jerryshao pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/gravitino.git
The following commit(s) were added to refs/heads/main by this push:
new cf725eeeb3 [#13637] docs: fix checksum algorithm in
how-to-sign-releases (#13643)
cf725eeeb3 is described below
commit cf725eeeb30f8f12d7a5868b6d7774c7ecf68429
Author: Bharath Krishna <[email protected]>
AuthorDate: Wed Oct 7 23:38:19 2026 -0700
[#13637] docs: fix checksum algorithm in how-to-sign-releases (#13643)
### What changes were proposed in this pull request?
`docs/how-to-sign-releases.md` documents `.sha256` / `shasum -a 256` in
five places. Releases ship `.sha512` — `release-build.sh` generates
every checksum with `shasum -a 512`. Corrected both halves of the page,
and refreshed the examples, which still referenced
`gravitino.0.2.0.zip`.
### Why are the changes needed?
Part of #13637
Step 3 of "Verify a Release" is the step meant to prove the artifact
downloaded intact, and as written it cannot succeed: the `.sha256` file
does not exist, and even if it did, a SHA-256 hash would never match a
published SHA-512 one.
### Does this PR introduce _any_ user-facing change?
No, documentation only.
### How was this patch tested?
Ran both commands against a published 1.3.1 artifact.
As the page now reads:
```
$ diff -u gravitino-trino-connector-435-439-1.3.1.tar.gz.sha512 \
<(shasum -a 512 gravitino-trino-connector-435-439-1.3.1.tar.gz)
RESULT: checksum matches
```
As it read before:
```
$ diff -u gravitino-trino-connector-435-439-1.3.1.tar.gz.sha256 \
<(shasum -a 256 gravitino-trino-connector-435-439-1.3.1.tar.gz)
diff: gravitino-trino-connector-435-439-1.3.1.tar.gz.sha256: No such file
or directory
```
---
docs/how-to-sign-releases.md | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/docs/how-to-sign-releases.md b/docs/how-to-sign-releases.md
index ffe02b997f..4a575b9cf0 100644
--- a/docs/how-to-sign-releases.md
+++ b/docs/how-to-sign-releases.md
@@ -135,13 +135,13 @@ Keep your private key secure and saved somewhere other
than just on your compute
Use the following command to generate hashes for a release:
```shell
- shasum -a 256 <filename>.[zip|tar.gz] > <filename>.[zip|tar.gz].sha256
+ shasum -a 512 <filename>.[zip|tar.gz] > <filename>.[zip|tar.gz].sha512
```
- For example, to generate a hash for the Gravitino 0.2.0 release you would
use this command:
+ For example, to generate a hash for the Gravitino 1.3.1 release you would
use this command:
```shell
- shasum -a 256 gravitino.0.2.0.zip > gravitino.0.2.0.zip.sha256
+ shasum -a 512 gravitino-1.3.1-bin.tar.gz >
gravitino-1.3.1-bin.tar.gz.sha512
```
4. **Copy your public key to the KEYS file:**
@@ -155,7 +155,7 @@ Keep your private key secure and saved somewhere other than
just on your compute
5. **Publish hashes and signatures:**
- Upload the generated .asc and .sha256 files along with the release
artifacts and KEYS file to the release area.
+ Upload the generated .asc and .sha512 files along with the release
artifacts and KEYS file to the release area.
## Verify a Release
@@ -188,13 +188,13 @@ Keep your private key secure and saved somewhere other
than just on your compute
Check if the hashes match, using the following command:
```shell
- diff -u <filename>.[zip|tar.gz].sha256 <(shasum -a 256
<filename>.[zip|tar.gz])
+ diff -u <filename>.[zip|tar.gz].sha512 <(shasum -a 512
<filename>.[zip|tar.gz])
```
- For example to verify the Gravitino 2.0 zip file you would use this
command:
+ For example to verify the Gravitino 1.3.1 binary tarball you would use
this command:
```shell
- diff -u gravitino.0.2.0.zip.sha256 <(shasum -a 256 gravitino.0.2.0.zip)
+ diff -u gravitino-1.3.1-bin.tar.gz.sha512 <(shasum -a 512
gravitino-1.3.1-bin.tar.gz)
```
This command ensures that the signatures match and that there are no
differences between them.
