bitflicker64 commented on code in PR #536: URL: https://github.com/apache/hugegraph-doc/pull/536#discussion_r4304096601
########## dist/prepare-release.sh: ########## @@ -55,7 +97,7 @@ cat > "$OUTPUT/origin.txt" <<EOF Unsigned source prevalidation, NOT an ASF release candidate Server: https://github.com/apache/hugegraph/commit/$SERVER_SHA Toolchain: https://github.com/apache/hugegraph-toolchain/commit/$TOOLCHAIN_SHA -SDK repository: $OUTPUT/m2 (same Server source, NOT remote staging) +SDK repository: $SDK_ORIGIN Review Comment: Minor: In staged mode nothing ties the selected staging repository to `SERVER_SHA`. A repository staged from another commit of the same version passes, and `origin.txt` then lists both lines as if they belong together. `staging-origin` checks only that the artifacts came from `selected-staging`, and `verify_candidate_image_sdk.py --mode release` checks only coordinates and that the packaged jars match that repository. The Server source built here is packaged, not compared with the staged jars. Nexus keeps earlier closed repositories of a version (for example one from a previous upload attempt). If an operator passes one of those, the run passes and this file reports `Server: .../commit/<SERVER_SHA>` next to that repository. Please say here, in the summary and in `dist/README.md`, that the staged SDK is not checked against the Server commit. Alternatively, compare the class entries of the Server-built `hugegraph-common`, `hg-pd-*` and `hugegraph-core` jars with the staged ones. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
