yihua opened a new issue, #752:
URL: https://github.com/apache/hudi-rs/issues/752

   Two problems in `release/verify_src_release.sh`, both hit while verifying 
`0.5.0-rc.1`.
   
   **The signature check accepts an expired signing key.** The script runs `gpg 
--verify "$pub_key" "$src"` under `set -o errexit`. When the signing key has 
expired, gpg reports the signature as good, prints `Note: This key has 
expired!`, and **exits 0**, so the check passes. Observed directly against a 
release signed with a key that had since expired:
   
   ```
   gpg: Good signature from "..." [expired]
   gpg: Note: This key has expired!
   [GNUPG:] EXPKEYSIG ...
   gpg exit code: 0
   ```
   
   The ASF release-signing guidance is explicit that this should not count as 
valid: "A signature is valid, if gpg verifies the .asc as a good signature, and 
doesn't complain about expired or revoked keys. Technically: `gpg --verify 
--status-fd 1 ...` should classify the .asc as a GOODSIG." The script should 
require `GOODSIG` rather than relying on the exit code, so `EXPKEYSIG` and 
`REVKEYSIG` fail.
   
   **`docker run -it` breaks whenever there is no TTY.** The license check at 
the end uses `-it`. Run from anything without a terminal (CI, a pipe, a script) 
it dies with `the input device is not a TTY`, which under `errexit` aborts the 
script and silently skips both the license check and the binary-file check that 
follows. The `-t` serves no purpose for a non-interactive container.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to