bitflicker64 commented on code in PR #512:
URL: https://github.com/apache/hugegraph-doc/pull/512#discussion_r4230989113
##########
content/en/docs/contribution-guidelines/validate-release.md:
##########
@@ -90,32 +112,26 @@ gpg: key 28DCAED849C4180E: public key "coderzc (CODE
SIGNING KEY) <zhaocong@apac
gpg: Total number processed: x
gpg: imported: x
-# 2. Trust release users (trust n username mentioned in voting mail, if more
than one user,
-# just repeat the steps in turn or use the script below)
-gpg --edit-key $USER # input the username, enter the interactive mode
-gpg> trust
-...output options..
-Your decision? 5 # select 5
-Do you really want to set this key to ultimate trust? (y/N) y # slect y, then
q quits trusting the next user
-
-# (Optional) You could also use the command to trust one user in
non-interactive mode:
-echo -e "5\ny\n" | gpg --batch --command-fd 0 --edit-key $USER trust
-# Or trust all currently imported GPG public keys (review them carefully
first):
-for key in $(gpg --no-tty --list-keys --with-colons | awk -F: '/^pub/ {print
$5}'); do
- echo -e "5\ny\n" | gpg --batch --command-fd 0 --edit-key "$key" trust
+# 2. Compare the full primary-key fingerprint with the release vote email
+release_signer_fingerprint='<signer-full-fingerprint>'
+gpg --fingerprint -- "$release_signer_fingerprint"
+
+# 3. Verify each archive; stop on a nonzero verification exit code
+for archive in *.tar.gz; do
+ gpg --status-fd 1 --verify -- "$archive.asc" "$archive" > "$archive.status"
|| exit "$?"
Review Comment:
Minor: this loop is shown as a snippet for voters to paste into their shell,
but `|| exit "$?"` and the two `exit 1` lines terminate that interactive shell
(and close the terminal window in most setups) on the first bad or expired
signature, so the voter loses the failing archive's output instead of seeing
it. Please use `break` with an explicit failure message, or wrap the loop in a
subshell `( for archive in ...; done )` so `exit` only leaves the subshell. The
CN page (lines 110-114) has the same snippet.
##########
dist/validate-release.sh:
##########
@@ -788,615 +504,295 @@ check_notice_year() {
return 0 # Already checked in check_required_files
fi
- local current_year=$(date +%Y)
+ local current_year
+
+ current_year=$(date +%Y)
if ! grep -q "$current_year" NOTICE; then
collect_warning "Package '$package': NOTICE file may not contain
current year ($current_year). Please verify copyright dates."
else
mark_check_passed
fi
}
-################################################################################
-# Main Validation Functions
-################################################################################
-
-validate_source_package() {
- local package_file=$1
- local package_dir=$(basename "$package_file" .tar.gz)
-
- # Set current package context for error reporting
- CURRENT_PACKAGE="$package_file"
-
- info "Validating source package: $package_file"
-
- # Extract package
- rm -rf "$package_dir"
- tar -xzf "$package_file"
-
- if [[ ! -d "$package_dir" ]]; then
- collect_error "Failed to extract package: $package_file"
- CURRENT_PACKAGE=""
- return 1
- fi
-
- pushd "$package_dir" > /dev/null
-
- # Run all checks
- check_package_name "$package_file"
- check_required_files "$package_file"
- check_license_categories "$package_file" "LICENSE NOTICE"
- check_empty_files_and_dirs "$package_file"
- check_file_sizes "$package_file" "$MAX_FILE_SIZE"
- check_binary_files "$package_file"
- check_license_headers "$package_file"
- check_version_consistency "$package_file" "$RELEASE_VERSION"
- check_notice_year "$package_file"
-
- # Compile check
- info "Compiling source package: $package_file"
- TOTAL_CHECKS=$((TOTAL_CHECKS + 1))
-
- if [[ "$package_file" =~ 'hugegraph-ai' ]]; then
- warn "Skipping compilation for AI module (not required)"
- mark_check_passed
- elif [[ "$package_file" =~ "hugegraph-computer" ]]; then
- if cd computer 2>/dev/null && mvn clean package -DskipTests
-Dcheckstyle.skip=true -ntp -e; then
- success "Compilation successful: $package_file"
- mark_check_passed
- else
- collect_error "Compilation failed: $package_file"
- fi
- cd ..
- else
- if mvn clean package -DskipTests -Dcheckstyle.skip=true -ntp -e; then
- success "Compilation successful: $package_file"
- mark_check_passed
- else
- collect_error "Compilation failed: $package_file"
- fi
- fi
-
- popd > /dev/null
- # Clear package context
- CURRENT_PACKAGE=""
-
- info "Finished validating source package: $package_file"
+check_java() {
+ local actual
+ actual=$(java -version 2>&1 | awk -F '"' '/version/ {print $2; exit}')
+ [[ "$actual" == 17.* && "$JAVA_VERSION" == 17 ]] || {
+ info "Java 17 required (requested $JAVA_VERSION, actual $actual)";
return 1;
+ }
}
-validate_binary_package() {
- local package_file=$1
- local package_dir=$(basename "$package_file" .tar.gz)
-
- # Set current package context for error reporting
- CURRENT_PACKAGE="$package_file"
-
- info "Validating binary package: $package_file"
-
- # Extract package
- rm -rf "$package_dir"
- tar -xzf "$package_file"
-
- if [[ ! -d "$package_dir" ]]; then
- collect_error "Failed to extract package: $package_file"
- CURRENT_PACKAGE=""
- return 1
- fi
-
- pushd "$package_dir" > /dev/null
-
- # Run checks
- check_package_name "$package_file"
- check_required_files "$package_file"
-
- # Binary packages should have licenses directory
- TOTAL_CHECKS=$((TOTAL_CHECKS + 1))
- if [[ ! -d "licenses" ]]; then
- collect_error "Package '$package_file' missing licenses directory"
- else
- mark_check_passed
- fi
-
- check_license_categories "$package_file" "LICENSE NOTICE licenses"
- check_empty_files_and_dirs "$package_file"
-
- popd > /dev/null
-
- # Clear package context
- CURRENT_PACKAGE=""
-
- info "Finished validating binary package: $package_file"
+prepare_maven() {
+ [[ "$STAGING_REPOSITORY" =~
^https://repository\.apache\.org/content/(repositories/[A-Za-z0-9._-]+|groups/staging)/?$
]] || {
+ info 'Expected an Apache HTTPS staging repository URL'; return 1;
+ }
+ mkdir -p "$RUN_DIR/m2/server" "$RUN_DIR/m2/toolchain"
+ cat > "$RUN_DIR/settings.xml" <<EOF
+<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0";>
+ <profiles><profile><id>release-validation</id><repositories>
+ <repository><id>selected-staging</id><url>$STAGING_REPOSITORY</url>
+
<releases><enabled>true</enabled><updatePolicy>always</updatePolicy><checksumPolicy>fail</checksumPolicy></releases>
+ <snapshots><enabled>false</enabled></snapshots>
+ </repository>
+ </repositories></profile></profiles>
+
<activeProfiles><activeProfile>release-validation</activeProfile></activeProfiles>
+</settings>
+EOF
+ MAVEN_ARGS=(-B -ntp -s "$RUN_DIR/settings.xml" -Papache-release
-DskipTests -Dgpg.skip=true)
+ if [[ -n "$SDK_REPOSITORY" ]]; then
+ [[ $SOURCE_PREVALIDATION -eq 1 && -d
"$SDK_REPOSITORY/org/apache/hugegraph" ]] || {
+ info '--sdk-repository requires source-prevalidation and a built
SDK repository'; return 1;
+ }
+ mkdir -p "$RUN_DIR/m2/toolchain/org/apache"
+ cp -R "$SDK_REPOSITORY/org/apache/hugegraph"
"$RUN_DIR/m2/toolchain/org/apache/"
+ info "SDK origin: same-source repository $SDK_REPOSITORY (NOT remote
staging)"
+ else info "SDK origin: remote Maven resolution using $STAGING_REPOSITORY";
fi
}
-################################################################################
-# Cleanup Function
-################################################################################
-
-cleanup() {
- local exit_code=$?
-
- if [[ $ENABLE_CLEANUP -eq 0 ]]; then
- return "$exit_code"
- fi
-
- log "CLEANUP" "Starting cleanup (exit code: $exit_code)"
-
- # Stop running services
- if [[ $SERVER_STARTED -eq 1 ]]; then
- info "Stopping HugeGraph server..."
- local server_dir=$(find_package_dir_silent
"*hugegraph*${RELEASE_VERSION}*src/hugegraph-server/*hugegraph-server*${RELEASE_VERSION}*")
- if [[ -n "$server_dir" ]] && [[ -d "$server_dir" ]]; then
- pushd "$server_dir" > /dev/null 2>&1
- bin/stop-hugegraph.sh || true
- popd > /dev/null 2>&1
- fi
- fi
-
- if [[ $HUBBLE_STARTED -eq 1 ]]; then
- info "Stopping Hubble..."
- # Hubble stop is handled in the test flow
- fi
-
- # Show final report
- echo ""
- echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
- echo " VALIDATION SUMMARY "
- echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
- echo ""
-
- # Calculate execution time
- local script_end_time=$(date +%s)
- local execution_seconds=$((script_end_time - SCRIPT_START_TIME))
- local execution_minutes=$((execution_seconds / 60))
- local execution_seconds_remainder=$((execution_seconds % 60))
-
- echo "Execution Time: ${execution_minutes}m
${execution_seconds_remainder}s"
- echo "Total Checks: $TOTAL_CHECKS"
- echo -e "${GREEN}Passed: $PASSED_CHECKS${NC}"
- echo -e "${RED}Failed: $FAILED_CHECKS${NC}"
- echo -e "${YELLOW}Warnings: ${#VALIDATION_WARNINGS[@]}${NC}"
- echo ""
-
- if [[ ${#VALIDATION_ERRORS[@]} -gt 0 ]]; then
- echo -e
"${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
- echo -e "${RED} ERRORS
${NC}"
- echo -e
"${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
- echo ""
- local err_index=1
- for err in "${VALIDATION_ERRORS[@]}"; do
- echo -e "${RED}[E${err_index}] $err${NC}"
- echo "" # Blank line between errors for readability
- err_index=$((err_index + 1))
- done
- fi
-
- if [[ ${#VALIDATION_WARNINGS[@]} -gt 0 ]]; then
- echo -e
"${YELLOW}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
- echo -e "${YELLOW} WARNINGS
${NC}"
- echo -e
"${YELLOW}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
- echo ""
- local warn_index=1
- for warn in "${VALIDATION_WARNINGS[@]}"; do
- echo -e "${YELLOW}[W${warn_index}] $warn${NC}"
- echo "" # Blank line between warnings for readability
- warn_index=$((warn_index + 1))
- done
- fi
-
- echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
- echo ""
+extract_package() {
+ local archive=$1 destination=$2
+ # Validate archive paths and its single, expected root before extraction.
+ python3 "$SCRIPT_DIR/release-smoke.py" extract "$archive" "$destination"
+}
- if [[ ${#VALIDATION_ERRORS[@]} -gt 0 ]]; then
- echo -e "${RED}VALIDATION FAILED${NC}"
- echo -e "Log file: ${LOG_FILE}"
- echo ""
- exit 1
+validate_package() {
+ local archive=$1 kind=$2 destination=$3
+ local name root before
+ name=$(basename "$archive")
+ root="$destination/${name%.tar.gz}"
+ CURRENT_PACKAGE=$name
+ extract_package "$archive" "$destination"
+ pushd "$root" >/dev/null
+ before=${#VALIDATION_ERRORS[@]}
+ check_package_name "$name" || true
+ check_required_files "$name" || true
+ check_empty_files_and_dirs "$name" || true
+ if [[ "$kind" == source ]]; then
+ check_license_categories "$name" LICENSE NOTICE || true
+ check_file_sizes "$name" "$MAX_FILE_SIZE" || true
+ check_binary_files "$name" || true
+ check_license_headers "$name" || true
+ check_version_consistency "$name" "$RELEASE_VERSION" || true
+ check_notice_year "$name" || true
else
- echo -e "${GREEN}✓ VALIDATION PASSED${NC}"
- echo -e "Log file: ${LOG_FILE}"
- echo ""
- echo "Please review the validation results and provide feedback in the"
- echo "release voting thread on the mailing list."
- echo ""
- exit 0
+ [[ -d licenses ]] || collect_error 'Missing licenses directory'
+ check_binary_licenses "$name"
fi
+ popd >/dev/null
+ [[ ${#VALIDATION_ERRORS[@]} -eq $before ]]
}
-# Set trap for cleanup
-trap cleanup EXIT
-trap 'echo -e "${RED}Script interrupted${NC}"; exit 130' INT TERM
-
-################################################################################
-# Main Execution
-################################################################################
-
-main() {
- # Record script start time
- SCRIPT_START_TIME=$(date +%s)
-
- # Parse command line arguments
- while [[ $# -gt 0 ]]; do
- case $1 in
- --help|-h)
- show_usage
- exit 0
- ;;
- --version|-v)
- echo "Apache HugeGraph Release Validation Script
v${SCRIPT_VERSION}"
- exit 0
- ;;
- --non-interactive)
- NON_INTERACTIVE=1
- shift
- ;;
- *)
- break
- ;;
- esac
- done
-
- # Parse positional arguments
- RELEASE_VERSION=${1:-}
- USER=${2:-}
- LOCAL_DIST_PATH=${3:-}
- JAVA_VERSION=${4:-11}
-
- # Validate required arguments
- if [[ -z "$RELEASE_VERSION" ]]; then
- error "Missing required argument: version"
- echo ""
- show_usage
- exit 1
- fi
-
- if [[ -z "$USER" ]]; then
- error "Missing required argument: user"
- echo ""
- show_usage
- exit 1
- fi
-
- # Initialize
- WORK_DIR=$(cd "$(dirname "$0")" && pwd)
- cd "${WORK_DIR}"
-
- setup_logging
-
- echo ""
- echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
- echo " Apache HugeGraph Release Validation v${SCRIPT_VERSION}"
- echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
- echo ""
- echo " Version: ${RELEASE_VERSION}"
- echo " User: ${USER}"
- echo " Java: ${JAVA_VERSION}"
- echo " Mode: $([ -n "${LOCAL_DIST_PATH}" ] && echo "Local
(${LOCAL_DIST_PATH})" || echo "SVN Download")"
- echo " Log: ${LOG_FILE}"
- echo ""
- echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
- echo ""
-
- ####################################################
- # Step 1: Check Dependencies
- ####################################################
- print_step 1 9 "Check Dependencies"
- check_dependencies
- check_java_version "$JAVA_VERSION"
-
- ####################################################
- # Step 2: Prepare Release Files
- ####################################################
- print_step 2 9 "Prepare Release Files"
-
- if [[ -n "${LOCAL_DIST_PATH}" ]]; then
- # Use local directory
- DIST_DIR="${LOCAL_DIST_PATH}"
- info "Using local directory: ${DIST_DIR}"
-
- if [[ ! -d "${DIST_DIR}" ]]; then
- collect_error "Directory ${DIST_DIR} does not exist"
- exit 1
- fi
+require_packages() {
+ PACKAGES=("$DIST_DIR/apache-hugegraph-$RELEASE_VERSION-src.tar.gz"
+
"$DIST_DIR/apache-hugegraph-toolchain-$RELEASE_VERSION-src.tar.gz"
+ "$DIST_DIR/apache-hugegraph-$RELEASE_VERSION.tar.gz"
+ "$DIST_DIR/apache-hugegraph-toolchain-$RELEASE_VERSION.tar.gz")
+ for archive in "${PACKAGES[@]}"; do [[ -f "$archive" ]] || { info "Missing
required package: $archive"; return 1; }; done
+ local candidates=("$DIST_DIR"/*.tar.gz)
+ [[ ${#candidates[@]} -eq 4 ]] || {
+ info "Expected exactly the four Server/Toolchain archives; found
${#candidates[@]}"; return 1;
Review Comment:
Important: `require_packages` now fails the run when the candidate directory
holds anything other than the four Server/Toolchain archives, and the docs say
to "validate other components with their own workflows". Those workflows do not
exist: apache/hugegraph-ai and apache/hugegraph-computer have no release
validation workflow, and the base version of this script and of
`validate-release.yml` was the only place their source packages got the
LICENSE/NOTICE, Category X/B, header, binary-file and (for Computer) compile
checks. The last release directory,
https://downloads.apache.org/hugegraph/1.7.0/, has six archives including
`apache-hugegraph-ai-...-src.tar.gz` and
`apache-hugegraph-computer-...-src.tar.gz`. If the 1.8.0 RC uses the same
`dev/hugegraph/<path>` layout, the default workflow run and `bash
dist/validate-release.sh 1.8.0 pengjunzhi` stop here with "found 6" before any
check runs, and AI/Computer get no automated check at all. Please either keep a
source-content check (a
nd the Computer build) for any extra
`apache-hugegraph-ai-*`/`apache-hugegraph-computer-*` source archives in the
candidate directory, or state in the EN/CN docs and `dist/README.md` that 1.8.0
ships only Server and Toolchain and drop the reference to per-component
workflows until they exist.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
