snoopdave opened a new pull request, #177:
URL: https://github.com/apache/roller/pull/177

   The release-candidate guard in `assembly-release/sign-release.sh` reads:
   
   ```bash
   if [ rcstring != "" ]; then
   ```
   
   The `$` is missing, so this compares the literal word `rcstring` against the 
empty string and is always true. Final releases therefore took the rename 
branch as well, where it degenerated into renaming each archive onto itself.
   
   The version and RC suffix were also hardcoded to the previous release 
(`6.1.5` / `-rc2`), so the script had to be hand-edited before every use — and 
would silently sign the wrong filenames if anyone forgot.
   
   ## Changes
   
   - Take the version and optional RC suffix as arguments, and print usage when 
they are missing.
   - Rename only when there is a suffix to add, and skip an archive that has 
already been renamed, so re-running after a partial failure is not confusing.
   - Require the signing key to be named via `ROLLER_SIGNING_KEY`, and refuse a 
key that is not RSA or is under 4096 bits. A release manager may still have 
older keys in their keyring, and gpg would otherwise pick one by default. See 
<https://infra.apache.org/release-signing.html>.
   - Write checksums in `shasum(1)` format instead of `gpg --print-md`, so 
downloaders can verify with `shasum -c`. The `--print-md` output is 
space-grouped and names a `target/`-prefixed path, so it cannot be checked 
directly. Emit SHA-512 alongside SHA-256, per the current distribution policy.
   
   ## Verification
   
   Guards, with real exit codes:
   
   | invocation | result |
   |---|---|
   | no arguments | usage, exit 2 |
   | version, no `ROLLER_SIGNING_KEY` | explains why the key must be named, 
exit 2 |
   | key not in keyring | `no key matching ...`, exit 1 |
   | DSA-1024 key | refused as not RSA, exit 1 |
   
   Rename behaviour, against dummy archives:
   
   - final release (no suffix) — no rename attempted, files untouched
   - release candidate (`-rc1`) — archive renamed to carry the suffix before 
signing
   
   The signing and checksum steps themselves need a passphrase prompt on a TTY, 
so they were exercised only as far as the gpg invocation.
   
   Usage is now:
   
   ```bash
   ROLLER_SIGNING_KEY=<keyid> ./sign-release.sh 6.1.6        # final
   ROLLER_SIGNING_KEY=<keyid> ./sign-release.sh 6.1.6 -rc1   # candidate
   ```
   
   https://claude.ai/code/session_019R1jdtwkaYEeA6L9DXEtEi


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to