GGraziadei opened a new pull request, #8906: URL: https://github.com/apache/storm/pull/8906
## What is the purpose of the change `dev-tools/rc/verify-release-file.sh` always reports `SHA file is not correct` for release candidates, even when the checksum is valid. The script compares the output of `gpg --print-md SHA512` (uppercase hash, split in 8-char blocks across multiple lines) textually with the published `.sha512` file, but release `.sha512` files are generated in `sha512sum` format (lowercase continuous hash followed by the file name), so the `diff` never matches. This replaces the `gpg --print-md` + `diff` comparison with `sha512sum -c`, which verifies the checksum regardless of formatting. ## How was the change tested Ran the script against the `apache-storm-2.8.9-rc1` artifacts from `dist.apache.org`: - before: `Signature seems correct` / `SHA file is not correct` (false negative on every file) - after: `Signature seems correct` / `apache-storm-2.8.9-src.tar.gz: OK — SHA file is correct` 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
