kevinjqliu commented on code in PR #141:
URL:
https://github.com/apache/terraform-provider-iceberg/pull/141#discussion_r4308982301
##########
.github/workflows/tf-release.yml:
##########
@@ -17,8 +17,7 @@
# On a release-candidate tag (e.g. v0.7.0-rc1), builds the source tarball and
# convenience binaries and publishes them as a GitHub prerelease. The release
-# manager drives the rest from dev/release/release_rc.sh (see
docs/releasing.md);
-# CI never signs.
Review Comment:
removes "CI never signs."
##########
.github/workflows/tf-release.yml:
##########
@@ -136,6 +135,7 @@ jobs:
path: |
dist/*.zip
dist/*_SHA256SUMS
+ dist/*_SHA256SUMS.sig
Review Comment:
this is the main change, everything else is just docs.
without this, the artifact will not have `sig` files and verify_rc will fail
##########
docs/releasing.md:
##########
@@ -47,9 +47,13 @@ The steps include:
* Terraform / OpenTofu Registry Access
* The [`apache` namespace on the Terraform
Registry](https://registry.terraform.io/providers/apache)
must have the `terraform-provider-iceberg` provider claimed, with the
- release manager's GPG public key (the same key in `KEYS`) registered
under
+ Iceberg project GPG public key (the key CI uses to sign `SHA256SUMS`,
+ also published in `KEYS`) registered under
Review Comment:
need to add this new key to the KEYS file, otherwise it will not be
recognized
##########
dev/release/release_rc.sh:
##########
@@ -23,8 +23,9 @@
# "Terraform Build Release Candidate" workflow
(../../.github/workflows/tf-release.yml).
# 2. Waits for that workflow to publish the GitHub prerelease, then downloads
# its artifacts.
-# 3. Signs the source tarball (.asc) and the binary SHA256SUMS (.sig) with
your
-# KEYS-registered GPG key and uploads the signatures back to the
prerelease.
+# 3. Signs the source tarball (.asc) with your KEYS-registered GPG key and
Review Comment:
perhaps we should sign the source tarball in CI too?
##########
.github/workflows/tf-release.yml:
##########
@@ -169,7 +169,7 @@ jobs:
GH_TOKEN: ${{ github.token }}
TAG: ${{ github.ref_name }}
run: |
- # release_rc.sh adds signatures afterwards; CI never signs.
Review Comment:
again, removes "CI never signs."
##########
docs/releasing.md:
##########
@@ -145,12 +149,12 @@ The script:
1. Tags `v<version>-rc<rc>` and pushes it, which triggers the
[`Terraform Build Release Candidate`](../.github/workflows/tf-release.yml)
- workflow. The workflow builds the source tarball and the convenience
binaries
- and publishes them as a GitHub **prerelease**.
-2. Waits for the workflow, downloads the artifacts, and signs them with your
- KEYS-registered GPG key — a detached `.asc` over the source tarball and a
- detached `.sig` over the binary `SHA256SUMS` — then uploads the signatures
- back onto the prerelease.
+ workflow. The workflow builds the source tarball and the convenience
binaries,
+ signs the binary `SHA256SUMS` (detached `.sig`) with the Iceberg project GPG
+ key, and publishes them as a GitHub **prerelease**.
+2. Waits for the workflow, downloads the source tarball, signs it with your
Review Comment:
lots of these changes are due to the fact that we're signing with 2 keys,
once in CI and another locally by the release manager.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
