This is an automated email from the ASF dual-hosted git repository.
JingsongLi pushed a commit to branch release-2.0
in repository https://gitbox.apache.org/repos/asf/paimon.git
The following commit(s) were added to refs/heads/release-2.0 by this push:
new f30d3ea082 [docs] Require RSA release signing keys
f30d3ea082 is described below
commit f30d3ea082a1bb1e0c4d6e0c7efd5ae7b22ef147
Author: JingsongLi <[email protected]>
AuthorDate: Tue Aug 4 10:42:38 2026 +0800
[docs] Require RSA release signing keys
(cherry picked from commit 191370c05b3deac8c18b53133ee3c9739c37aa0b)
---
docs/docs/project/creating-a-release.md | 15 ++++++++++++---
docs/docs/project/verifying-a-release-candidate.md | 16 ++++++++++++++--
2 files changed, 26 insertions(+), 5 deletions(-)
diff --git a/docs/docs/project/creating-a-release.md
b/docs/docs/project/creating-a-release.md
index b4a6397335..e0c35ee89d 100644
--- a/docs/docs/project/creating-a-release.md
+++ b/docs/docs/project/creating-a-release.md
@@ -113,8 +113,12 @@ workflow passes only these two secrets to the reusable
publishing workflow.
Before managing the first release:
-1. Create a GPG key associated with your `@apache.org` identity and publish it
- to a public key server.
+1. Create an RSA GPG key of at least 2048 bits associated with your
+ `@apache.org` identity and publish it to a public key server. The
+ [ASF Release Distribution
Policy](https://infra.apache.org/release-distribution.html)
+ requires RSA keys for new artifacts; use RSA 4096 for a newly generated
+ release key. Do not use DSA, ECDSA, EdDSA, or Ed25519 to sign release
+ artifacts.
2. Append the public key to the Paimon
[KEYS](https://downloads.apache.org/paimon/KEYS) file. Never remove keys
required to verify an older release.
@@ -132,11 +136,16 @@ Before managing the first release:
log.
```shell
-gpg --list-secret-keys --keyid-format LONG
+gpg --list-options show-subkey-fingerprint \
+ --list-secret-keys --keyid-format LONG
git config user.signingkey
svn --version
```
+Confirm that the exact key or signing subkey configured for the release is
+reported as `rsa2048` or larger. Do not infer compliance from another key in
+the same keyring.
+
## Prepare the release
### Agree on the release
diff --git a/docs/docs/project/verifying-a-release-candidate.md
b/docs/docs/project/verifying-a-release-candidate.md
index 3129a32e1e..22d0847608 100644
--- a/docs/docs/project/verifying-a-release-candidate.md
+++ b/docs/docs/project/verifying-a-release-candidate.md
@@ -71,7 +71,19 @@ gpg --verify "${PYPAIMON_ARCHIVE}.asc" "${PYPAIMON_ARCHIVE}"
```
Confirm that both signatures are good and that the full signing-key fingerprint
-belongs to the RM and appears in the downloaded `KEYS` file.
+belongs to the RM and appears in the downloaded `KEYS` file. Also inspect the
+exact key or subkey that produced each signature:
+
+```shell
+gpg --list-options show-subkey-fingerprint \
+ --list-keys "<FULL_SIGNING_KEY_FINGERPRINT>"
+```
+
+The signing key must be RSA and at least 2048 bits, as required by the
+[ASF Release Distribution
Policy](https://infra.apache.org/release-distribution.html).
+A newly generated release key should be RSA 4096. DSA, ECDSA, EdDSA, and
+Ed25519 signing keys do not satisfy this policy, even when the signature is
+cryptographically valid.
On Linux:
@@ -380,7 +392,7 @@ binding, and list the checks you completed.
Verified:
- signed RC tag and announced commit SHA
-- Paimon and PyPaimon GPG signatures and SHA-512 checksums
+- Paimon and PyPaimon GPG signatures, RSA signing-key policy, and SHA-512
checksums
- LICENSE, NOTICE, source-only archive contents, and release versions
- Paimon source build/test scope on <OS/ARCH>, JDK <version>, Maven <version>
- Java staging repository and representative class-file targets
