yihua opened a new issue, #752: URL: https://github.com/apache/hudi-rs/issues/752
Two problems in `release/verify_src_release.sh`, both hit while verifying `0.5.0-rc.1`. **The signature check accepts an expired signing key.** The script runs `gpg --verify "$pub_key" "$src"` under `set -o errexit`. When the signing key has expired, gpg reports the signature as good, prints `Note: This key has expired!`, and **exits 0**, so the check passes. Observed directly against a release signed with a key that had since expired: ``` gpg: Good signature from "..." [expired] gpg: Note: This key has expired! [GNUPG:] EXPKEYSIG ... gpg exit code: 0 ``` The ASF release-signing guidance is explicit that this should not count as valid: "A signature is valid, if gpg verifies the .asc as a good signature, and doesn't complain about expired or revoked keys. Technically: `gpg --verify --status-fd 1 ...` should classify the .asc as a GOODSIG." The script should require `GOODSIG` rather than relying on the exit code, so `EXPKEYSIG` and `REVKEYSIG` fail. **`docker run -it` breaks whenever there is no TTY.** The license check at the end uses `-it`. Run from anything without a terminal (CI, a pipe, a script) it dies with `the input device is not a TTY`, which under `errexit` aborts the script and silently skips both the license check and the binary-file check that follows. The `-t` serves no purpose for a non-interactive container. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
