This is an automated email from the ASF dual-hosted git repository.
zeroshade pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/terraform-provider-iceberg.git
The following commit(s) were added to refs/heads/main by this push:
new 1e2d2d9 Check binary licenses in dev/verify_rc.sh (#155)
1e2d2d9 is described below
commit 1e2d2d989ed5c87ea644ebc0a67796d6d636c8b0
Author: Alex Stephen <[email protected]>
AuthorDate: Tue Oct 27 11:40:28 2026 -0700
Check binary licenses in dev/verify_rc.sh (#155)
dev: check the binary license inventory in verify_rc.sh
Run dev/update_licenses.sh --check against the extracted source release so
voters verifying an RC also confirm that LICENSE-binary and licenses-binary/
match the dependencies actually linked into the convenience binaries. The
step
runs after the RAT check (whose excludes already cover build/, where the
pinned
go-licenses is installed) and can be skipped with VERIFY_LICENSES=0, like
the
other optional steps.
Document the new step and opt-out in docs/releasing.md.
---
dev/release/verify_rc.sh | 17 +++++++++++++++--
docs/releasing.md | 10 +++++++---
2 files changed, 22 insertions(+), 5 deletions(-)
diff --git a/dev/release/verify_rc.sh b/dev/release/verify_rc.sh
index 266d84e..3064e84 100755
--- a/dev/release/verify_rc.sh
+++ b/dev/release/verify_rc.sh
@@ -20,13 +20,15 @@
# Verifies a release candidate of the Apache Iceberg Terraform provider so you
# can cast an informed vote. It downloads the source release from the Apache
dev
# SVN and checks its GPG signature and checksum, runs the Apache RAT license
-# check, then builds and tests the provider from source in a throwaway sandbox.
+# check, checks that LICENSE-binary and licenses-binary/ match the dependencies
+# linked into the binaries, then builds and tests the provider from source in a
+# throwaway sandbox.
#
# Usage: dev/release/verify_rc.sh <version> <rc>
# e.g.: dev/release/verify_rc.sh 0.7.0 1
#
# A valid signature from a key in the KEYS file, a matching checksum, a clean
RAT
-# check, and a clean build/test is a +1.
+# check, a clean binary license check, and a clean build/test is a +1.
set -eu
@@ -59,6 +61,7 @@ BINARY_BASE_NAME="terraform-provider-iceberg_${VERSION}"
: "${VERIFY_FORCE_USE_GO_BINARY:=0}"
: "${VERIFY_SIGN:=${VERIFY_DEFAULT}}"
: "${VERIFY_RAT:=${VERIFY_DEFAULT}}"
+: "${VERIFY_LICENSES:=${VERIFY_DEFAULT}}"
: "${VERIFY_BINARY:=${VERIFY_DEFAULT}}"
VERIFY_SUCCESS=no
@@ -234,6 +237,15 @@ run_rat_check() {
fi
}
+run_binary_license_check() {
+ if [ "${VERIFY_LICENSES}" -gt 0 ]; then
+ # dev/update_licenses.sh installs its pinned go-licenses under build/ and
+ # fails if LICENSE-binary or licenses-binary/ have drifted from the modules
+ # the binaries link. Its list of modules shipping a NOTICE is advisory.
+ ./dev/update_licenses.sh --check
+ fi
+}
+
build_and_test_source_distribution() {
go build ./...
go test ./...
@@ -250,6 +262,7 @@ ensure_source_directory
ensure_go
pushd "${ARCHIVE_BASE_NAME}"
run_rat_check
+run_binary_license_check
build_and_test_source_distribution
popd
diff --git a/docs/releasing.md b/docs/releasing.md
index a2e8188..c0b74f7 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -297,19 +297,23 @@ Reviewers validate a candidate with:
The script imports the Apache Iceberg `KEYS`, downloads the source release from
the dev SVN, verifies its GPG signature and SHA-512 checksum, runs the Apache
RAT license check, verifies the convenience binaries against their signed
-`SHA256SUMS`, and builds and tests the provider from source in a throwaway
-sandbox.
+`SHA256SUMS`, checks that `LICENSE-binary` and `licenses-binary/` match the
+dependencies linked into the binaries, and builds and tests the provider from
+source in a throwaway sandbox.
It expects `git`, `gpg`, `curl`, and `shasum`/`sha512sum` on your `PATH`.
The RAT License check needs `java` and `unzip`, but can be skipped with
`VERIFY_RAT=0`.
Binary verification needs [`gh`](https://cli.github.com/) and can be skipped
with `VERIFY_BINARY=0`.
+The binary license check (`dev/update_licenses.sh --check`) downloads a pinned
+`go-licenses`, and can be skipped with `VERIFY_LICENSES=0`.
The binaries are named with the final version, but `go version -m` reports the
RC
tag they were built from. That is expected, and stays true of the final
release.
A valid signature from a key in the `KEYS` file, a matching checksum, a clean
RAT
-check, verified binaries, and a clean build and test is a `+1`.
+check, verified binaries, a clean binary license check, and a clean build and
+test is a `+1`.
## Misc
