jianguotian opened a new pull request, #104: URL: https://github.com/apache/paimon-mosaic/pull/104
Local release deployment can otherwise publish Javadoc from an unintended JVM or signatures that verify successfully but use a non-compliant signing key. Validate Maven’s JDK 8 and JNI architecture, use the same JDK for smoke checks, and build in UTC. Check the LICENSE/NOTICE and expected JDK 8 assets in sources/Javadoc JARs. The Maven release profile verifies all four actual signatures after signing and before Nexus deployment, requiring RSA keys of at least 2048 bits and checking the signing subkey rather than only its primary key. Source packaging applies the same signature check before exposing its output and reports missing `tomllib` before creating an archive. CI’s unsigned builds remain supported; Python runtime requirements and native SVN upload commands are unchanged. Validation: - 174 release-tool tests and 5 Java staging shell scenarios passed. - Real Maven release-version rehearsal: Ed25519 blocked before the Nexus deploy goal; RSA2048 completed local staging with remote upload disabled. - Maven JDK 11 rejected during validation; signing-subkey, Javadoc legal-content, UTC NOTICE and missing-Python-dependency regressions covered. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
