oscerd opened a new issue, #9061:
URL: https://github.com/apache/camel-quarkus/issues/9061
`release-utils/scripts/upload-source.sh`
The script downloads the release artifacts and their detached signatures,
then generates the checksums that get published from those downloads:
```sh
wget ${sourcesUrl}/camel-quarkus-${version}-src.zip -O
apache-camel-quarkus-${version}-src.zip
wget ${sourcesUrl}/camel-quarkus-${version}-src.zip.asc -O
apache-camel-quarkus-${version}-src.zip.asc
sha512sum -b apache-camel-quarkus-${version}-src.zip >
apache-camel-quarkus-${version}-src.zip.sha512
```
The same pattern repeats for both CycloneDX SBOMs, and the directory is then
`svn import`ed to `dist.apache.org/repos/dist/dev`. `gpg --verify` is never
invoked, so the `.asc` files are copied alongside the artifacts without ever
being checked, and the published `.sha512` files describe whatever was
downloaded rather than something verified.
Separately, the staging probe on line 31 disables certificate validation:
```sh
if [[ "$(curl -k -L -s -o /dev/null -w "%{http_code}" ${sourcesUrl})" !=
"200" ]]; then
```
Only a status code is consumed there, so the impact of `-k` alone is
minimal, but it is unnecessary.
**Suggested fix**
Run `gpg --verify` on each `.asc` against the checked-in `KEYS` file before
generating any checksum or importing to `dist`, and drop `-k` from the probe.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
