Chia-Ping Tsai created KAFKA-21208:
--------------------------------------
Summary: Auto-check the signing key and verify the asc files
before publishing
Key: KAFKA-21208
URL: https://issues.apache.org/jira/browse/KAFKA-21208
Project: Kafka
Issue Type: Improvement
Reporter: Chia-Ping Tsai
Assignee: Chia-Ping Tsai
see [https://lists.apache.org/thread.html/8jhfc95ltgfg6zfd24ott64c0nojty0w]
Our release flow does not check the signing key before publishing, so it is
easy to use the subkey which can't be used to sign. We can add following
improvements.
# verify_gpg_key should check the input key must be signing-capable
# run gpg verification (we can leverage signMavenJavaPublication to generate
the asc files) automatically before command "./gradlew publish"
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
