yihua opened a new pull request, #753:
URL: https://github.com/apache/hudi-rs/pull/753
## Description
closes #752
`gpg --verify` exits 0 for a good signature made by an expired or revoked
key, emitting `EXPKEYSIG`/`REVKEYSIG` instead of `GOODSIG`, so the bare call
under `errexit` accepted a release whose signing key was no longer valid. ASF's
release-signing guidance requires `GOODSIG`, so this matches on `--status-fd`
output rather than the exit code.
The license check also ran its container with `docker run -it`. Without a
TTY that fails immediately, and under `errexit` that skipped both the license
check and the binary-file check after it. The `-t` is not needed for a
non-interactive container.
## How are the changes test-covered
- [x] N/A
- [ ] Automated tests (unit and/or integration tests)
- [x] Manual tests
- [x] Details are described below
The signature regression was reproduced with a throwaway key created and
used to sign under `--faked-system-time`, expiring before the present, so the
signature was made while the key was valid:
| check | result |
| --- | --- |
| `gpg --verify` exit code | `0`, the old check passes |
| status line emitted | `[GNUPG:] EXPKEYSIG ...` |
| this change's check | rejects, exits 1 |
The whole script was then run against the real `0.5.0-rc.1` artifacts in the
dev repo. It reports `GOODSIG` and passes, and now reaches the license check
(533 files, 0 invalid) and the binary-file check, both of which the `-it`
failure previously skipped.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
