This is an automated email from the ASF dual-hosted git repository. yihua pushed a commit to branch release/0.5.x in repository https://gitbox.apache.org/repos/asf/hudi-rs.git
commit 7c65257571c9198ddc2e77b5be6f71fa0c5ab974 Author: Y Ethan Guo <[email protected]> AuthorDate: Fri Sep 4 23:00:49 2026 -0700 fix(release): reject an expired signing key in the src release verification (#753) (cherry picked from commit ddb727482694b25f5003db2a66b9dedd4a48cbae) --- release/verify_src_release.sh | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/release/verify_src_release.sh b/release/verify_src_release.sh index ab6e7959..ff408f3c 100755 --- a/release/verify_src_release.sh +++ b/release/verify_src_release.sh @@ -70,7 +70,15 @@ echo "<<< OK" echo ">>> Verifying signature..." curl -s "https://dist.apache.org/repos/dist/$repo/hudi/KEYS"; >"$work_dir/KEYS" gpg -q --import "$work_dir/KEYS" -gpg --verify "$pub_key" "$src" +# gpg exits 0 for a good signature made by an expired or revoked key, reporting +# EXPKEYSIG/REVKEYSIG instead of GOODSIG. ASF requires GOODSIG, so match on the +# status output rather than the exit code. +# human-readable output goes to stderr and stays visible; status goes to the file +gpg --verify --status-fd 1 "$pub_key" "$src" >"$work_dir/gpg_status" +if ! grep -q '^\[GNUPG:\] GOODSIG ' "$work_dir/gpg_status"; then + echo "ERROR: signature is not a GOODSIG (expired or revoked signing key)." + exit 1 +fi echo "<<< OK" echo "Un-tarring the source release artifact" @@ -100,7 +108,7 @@ fi echo "<<< OK" echo ">>> Verifying licenses..." -docker run -it --rm -v $(pwd):/github/workspace apache/skywalking-eyes header check +docker run -i --rm -v $(pwd):/github/workspace apache/skywalking-eyes header check echo "<<< OK" echo ">>> Verifying no binary files..."
