This is an automated email from the ASF dual-hosted git repository. FreeAndNil pushed a commit to branch Feature/312-more-hardening in repository https://gitbox.apache.org/repos/asf/logging-log4net.git
commit 2543994440c7a2e7933f495f1f5c0a8cc2b47cc9 Author: Jan Friedrich <[email protected]> AuthorDate: Tue Sep 1 19:02:06 2026 +0200 require PowerShell 7.4 in the release scripts All native command error handling in these scripts rests on $PSNativeCommandUseErrorActionPreference, which exists only from 7.4. Under Windows PowerShell 5.1 the assignment is a silent no-op, so a failing gpg --verify was ignored and verify-release.ps1 reported success and exited 0, undoing the fail-closed work in 3.4.0. The comments claimed 7.3, but there it was only an experimental feature. release-review.adoc said "Windows (PowerShell)" and never installed PowerShell 7, so it now installs it and runs the script with pwsh. --- scripts/build-preview.ps1 | 4 +++- scripts/build-release.ps1 | 4 +++- scripts/verify-release.ps1 | 6 +++++- src/changelog/3.4.1/312-require-powershell-74.xml | 14 ++++++++++++++ src/site/antora/modules/ROOT/pages/release-review.adoc | 9 +++++++-- 5 files changed, 32 insertions(+), 5 deletions(-) diff --git a/scripts/build-preview.ps1 b/scripts/build-preview.ps1 index eecde7f7..7c6926ad 100644 --- a/scripts/build-preview.ps1 +++ b/scripts/build-preview.ps1 @@ -1,3 +1,5 @@ +#Requires -Version 7.4 + param( $Version = '3.4.1', $Preview = '1' @@ -7,7 +9,7 @@ Set-StrictMode -Version Latest $ErrorActionPreference = 'Stop' # $ErrorActionPreference alone does not apply to native commands: dotnet, gpg and git only set # $LASTEXITCODE, so without this a failing build would still be signed and tagged. -# Requires PowerShell 7.3+. +# Only honored from PowerShell 7.4, hence the #Requires above. $PSNativeCommandUseErrorActionPreference = $true 'building ...' diff --git a/scripts/build-release.ps1 b/scripts/build-release.ps1 index 9a036172..d5bbfd51 100644 --- a/scripts/build-release.ps1 +++ b/scripts/build-release.ps1 @@ -1,3 +1,5 @@ +#Requires -Version 7.4 + param( $Version = '3.4.1' ) @@ -6,7 +8,7 @@ Set-StrictMode -Version Latest $ErrorActionPreference = 'Stop' # $ErrorActionPreference alone does not apply to native commands: dotnet, git, zip, gpg and mvnw # only set $LASTEXITCODE, so without this a failing build would still be packaged and signed. -# Requires PowerShell 7.3+. +# Only honored from PowerShell 7.4, hence the #Requires above. $PSNativeCommandUseErrorActionPreference = $true function Write-HashAndSignature diff --git a/scripts/verify-release.ps1 b/scripts/verify-release.ps1 index ee2d538f..712eebed 100644 --- a/scripts/verify-release.ps1 +++ b/scripts/verify-release.ps1 @@ -1,3 +1,7 @@ +# Not a hint: $PSNativeCommandUseErrorActionPreference below exists only from 7.4, and setting it +# on an older host is a silent no-op that leaves a failed signature check unnoticed. +#Requires -Version 7.4 + Param ( [Parameter()] [System.IO.DirectoryInfo]$Directory @@ -7,7 +11,7 @@ Set-StrictMode -Version Latest $ErrorActionPreference = 'Stop' # $ErrorActionPreference alone does not apply to native commands: gpg only sets $LASTEXITCODE, so # without this a failed signature check would still reach the extraction at the end and the script -# would exit 0. Requires PowerShell 7.3+. +# would exit 0. Only honored from PowerShell 7.4, hence the #Requires above. $PSNativeCommandUseErrorActionPreference = $true if (!$Directory) diff --git a/src/changelog/3.4.1/312-require-powershell-74.xml b/src/changelog/3.4.1/312-require-powershell-74.xml new file mode 100644 index 00000000..f2b9813d --- /dev/null +++ b/src/changelog/3.4.1/312-require-powershell-74.xml @@ -0,0 +1,14 @@ +<?xml version="1.0" encoding="UTF-8"?> +<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; + xmlns="https://logging.apache.org/xml/ns"; + xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"; + type="changed"> + <issue id="312" link="https://github.com/apache/logging-log4net/pull/312"/> + <description format="asciidoc"> + require PowerShell 7.4 in the release scripts. All native command error handling in them rests on + `$PSNativeCommandUseErrorActionPreference`, which exists only from 7.4, so under Windows PowerShell + 5.1 a failing `gpg --verify` was ignored and `verify-release.ps1` reported success and exited 0. The + scripts now refuse to start on an older host, and the review instructions install PowerShell 7 and + run the script with `pwsh` (audit da18b6fd-f004) + </description> +</entry> diff --git a/src/site/antora/modules/ROOT/pages/release-review.adoc b/src/site/antora/modules/ROOT/pages/release-review.adoc index a105df06..cf215d40 100644 --- a/src/site/antora/modules/ROOT/pages/release-review.adoc +++ b/src/site/antora/modules/ROOT/pages/release-review.adoc @@ -20,7 +20,11 @@ Releases of log4net can be verified with following steps: [#windows] -== Windows (PowerShell) +== Windows (PowerShell 7) + +The scripts need PowerShell 7.4 or newer and refuse to run on anything older, because the setting +that makes a failing `gpg` abort the script exists only from 7.4. +Windows PowerShell 5.1, the `powershell.exe` that ships with Windows, is not enough; use `pwsh`. . Prerequisites (winget - in case of problems see next section choco) + @@ -28,6 +32,7 @@ Releases of log4net can be verified with following steps: ---- # as administrator Set-ExecutionPolicy -ExecutionPolicy RemoteSigned +winget install -e --id Microsoft.PowerShell winget install -e --id GnuPG.Gpg4win winget install -e --id Slik.Subversion # or any other subversion client winget install -e --id Mono.Mono @@ -60,7 +65,7 @@ pushd log4net-${releaseVersion} [source,powershell] ---- Unblock-File ./verify-release.ps1 -& ./verify-release.ps1 +pwsh ./verify-release.ps1 ---- . switch to the directory where you extracted the sources (in case you didn't use verify-release.ps1)
