[
https://issues.apache.org/jira/browse/KAFKA-21208?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
dino2895 reassigned KAFKA-21208:
--------------------------------
Assignee: dino2895 (was: Chia-Ping Tsai)
> Auto-check the signing key and verify the asc files before publishing
> ---------------------------------------------------------------------
>
> Key: KAFKA-21208
> URL: https://issues.apache.org/jira/browse/KAFKA-21208
> Project: Kafka
> Issue Type: Improvement
> Reporter: Chia-Ping Tsai
> Assignee: dino2895
> Priority: Minor
>
> see [https://lists.apache.org/thread.html/8jhfc95ltgfg6zfd24ott64c0nojty0w]
> Our release flow does not check the signing key before publishing, so it is
> easy to use the subkey which can't be used to sign. We can add following
> improvements.
>
> # verify_gpg_key should check the input key must be signing-capable
> # run gpg verification (we can leverage signMavenJavaPublication to generate
> the asc files) automatically before command "./gradlew publish"
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
