I see the same: [INFO] Verifying jackrabbit-filevault-3.4.6-src.zip... gpg: assuming signed data in './filevault/3.4.6/jackrabbit-filevault-3.4.6-src.zip' gpg: Signature made Tue Jul 28 14:55:53 2020 JST gpg: using RSA key D7742D58455ECC7C gpg: Good signature from "Konrad Windszus <[email protected]<mailto:[email protected]>>" [ultimate] [INFO] OK: jackrabbit-filevault-3.4.6-src.zip.asc openssl:Error: '' is an invalid command.
There was an error in the script. I fixed it, and how it works correctly: [INFO] 3. Verify checksums and signatures [INFO] [INFO] Verifying jackrabbit-filevault-3.4.6-src.zip... gpg: assuming signed data in './filevault/3.4.6/jackrabbit-filevault-3.4.6-src.zip' gpg: Signature made Tue Jul 28 14:55:53 2020 JST gpg: using RSA key D7742D58455ECC7C gpg: Good signature from "Konrad Windszus <[email protected]<mailto:[email protected]>>" [ultimate] [INFO] OK: jackrabbit-filevault-3.4.6-src.zip.asc [INFO] OK: jackrabbit-filevault-3.4.6-src.zip.sha1 [INFO] OK: jackrabbit-filevault-3.4.6-src.zip.sha512 [INFO] [INFO] 3. Verify checksums and signatures [INFO] [INFO] Verifying filevault-package-maven-plugin-1.1.4-source-release.zip... gpg: assuming signed data in './filevault-package-maven-plugin/1.1.4/filevault-package-maven-plugin-1.1.4-source-release.zip' gpg: Signature made Tue Jul 28 16:43:49 2020 JST gpg: using RSA key D7742D58455ECC7C gpg: Good signature from "Konrad Windszus <[email protected]<mailto:[email protected]>>" [ultimate] [INFO] OK: filevault-package-maven-plugin-1.1.4-source-release.zip.asc [INFO] OK: filevault-package-maven-plugin-1.1.4-source-release.zip.sha512 [INFO] Regards, Toby On 31 Jul 2020, at 03:28, Konrad Windszus <[email protected]<mailto:[email protected]>> wrote: Regarding "Can you please check whether you see the same gpg/openssl issues in your log?" Yes, that message is totally expected. As I said already: My key is not signed yet! Therefore GPG emits a message related to that. IMHO that should not make the check fail though (and in fact it doesn't) because it is equal to the key from the KEYS file. "You should get your key linked to the Apache web of trust<http://www.apache.org/dev/release-signing.html#apache-wot>. Once other people have signed your key, you can update the KEYS file with the signatures you’ve received." (https://jackrabbit.apache.org/filevault/howto_release.html#Appendix_A:_Create_and_add_your_key_to_the_Jackrabbit_KEYS_file). I will try to get it signed by someone else, but IMHO this is just a nice to have, not mandatory! Konrad
