snoopdave opened a new pull request, #177: URL: https://github.com/apache/roller/pull/177
The release-candidate guard in `assembly-release/sign-release.sh` reads: ```bash if [ rcstring != "" ]; then ``` The `$` is missing, so this compares the literal word `rcstring` against the empty string and is always true. Final releases therefore took the rename branch as well, where it degenerated into renaming each archive onto itself. The version and RC suffix were also hardcoded to the previous release (`6.1.5` / `-rc2`), so the script had to be hand-edited before every use — and would silently sign the wrong filenames if anyone forgot. ## Changes - Take the version and optional RC suffix as arguments, and print usage when they are missing. - Rename only when there is a suffix to add, and skip an archive that has already been renamed, so re-running after a partial failure is not confusing. - Require the signing key to be named via `ROLLER_SIGNING_KEY`, and refuse a key that is not RSA or is under 4096 bits. A release manager may still have older keys in their keyring, and gpg would otherwise pick one by default. See <https://infra.apache.org/release-signing.html>. - Write checksums in `shasum(1)` format instead of `gpg --print-md`, so downloaders can verify with `shasum -c`. The `--print-md` output is space-grouped and names a `target/`-prefixed path, so it cannot be checked directly. Emit SHA-512 alongside SHA-256, per the current distribution policy. ## Verification Guards, with real exit codes: | invocation | result | |---|---| | no arguments | usage, exit 2 | | version, no `ROLLER_SIGNING_KEY` | explains why the key must be named, exit 2 | | key not in keyring | `no key matching ...`, exit 1 | | DSA-1024 key | refused as not RSA, exit 1 | Rename behaviour, against dummy archives: - final release (no suffix) — no rename attempted, files untouched - release candidate (`-rc1`) — archive renamed to carry the suffix before signing The signing and checksum steps themselves need a passphrase prompt on a TTY, so they were exercised only as far as the gpg invocation. Usage is now: ```bash ROLLER_SIGNING_KEY=<keyid> ./sign-release.sh 6.1.6 # final ROLLER_SIGNING_KEY=<keyid> ./sign-release.sh 6.1.6 -rc1 # candidate ``` https://claude.ai/code/session_019R1jdtwkaYEeA6L9DXEtEi -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
