jianguotian commented on PR #72: URL: https://github.com/apache/paimon-mosaic/pull/72#issuecomment-5341793264
PR #72 head is now `a7d4b2e27ef0da79556c19b9e881c4575b032980` and directly includes/supersedes PR #71's local Java staging automation. The integrated flow also fixes the review P1s and follow-up hardening items: - reject `assume-unchanged`, `skip-worktree`, and Git replacement refs; - validate native formats without relying on the external `file` command, and scan every JAR entry for undeclared ELF/PE/Mach-O payloads; - replace manual staging steps with the fail-closed local script and use Rust `--no-verify` packaging; - force `github.com`, neutralize hostile Maven skip properties, require an exact full GPG fingerprint present in the local secret keyring and ASF Paimon `KEYS`, and verify all artifact signatures use that signer; - run the staging safety suite portably on Ubuntu and macOS. Validation on the exact head: - fork `Release` run passed: https://github.com/jianguotian/paimon-mosaic/actions/runs/32249593553 (`19` jobs succeeded; all `4` publication jobs skipped as intended); - release-tool Python tests: `122 passed`; - staging shell tests: `14/14 passed` with Bash 4.4; - real-signing staging E2E passed with an ephemeral key and no Nexus change (`deploy` mapped to `verify`); - full Rust tests, format/Clippy, advisory/license/header checks, actionlint, deterministic source archive, Java release build, and JAR verification passed. PR #71 is now technically redundant, but I have left it open rather than closing it implicitly. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
