This is an automated email from the ASF dual-hosted git repository.
jamesnetherton pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-quarkus.git
The following commit(s) were added to refs/heads/main by this push:
new a9979dd138 Fixes #9061. Verify release signatures before publishing
checksums
a9979dd138 is described below
commit a9979dd138cb05a1c5f9c59179b2b2338ed12a3e
Author: Andrea Cosentino <[email protected]>
AuthorDate: Tue Sep 1 15:39:45 2026 +0200
Fixes #9061. Verify release signatures before publishing checksums
* Fixes #9061. Verify release signatures before publishing checksums
upload-source.sh downloaded the source zip, both CycloneDX SBOMs and their
detached signatures, then generated the published .sha512 files straight
from
those downloads and svn-imported the result to dist.apache.org. gpg --verify
was never run, so the .asc files were carried along without ever being
checked
and the published checksums described whatever had been downloaded.
Import the project KEYS into a throwaway keyring and verify each signature
before its checksum is generated. The three near-identical download blocks
become one fetch_verify_checksum helper. set -e means a failed verification
aborts the release rather than publishing an unverified artifact.
Also drop -k from the staging probe, which disabled certificate validation
for
no benefit.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
* Fixes #9061. Clear the staging directory when a verification fails
Only gpgHome had an EXIT trap, so a failed verification left a partly
downloaded ${version}/ behind and the next attempt stopped at mkdir with
"File exists". The trap now clears the staging directory too, using an
absolute path so it still resolves after the script has cd'd into it.
Also record that gpg --verify exits 0 for a signature made by a revoked or
expired key, reporting it only as a warning. KEYS holds expired keys by
design, so a release manager whose key expired mid-cycle would still pass.
Closing that needs EXPKEYSIG and REVKEYSIG rejected from --status-fd, which
is left as a follow-up rather than folded in here.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
release-utils/scripts/upload-source.sh | 52 +++++++++++++++++++++++++---------
1 file changed, 39 insertions(+), 13 deletions(-)
diff --git a/release-utils/scripts/upload-source.sh
b/release-utils/scripts/upload-source.sh
index a02493f028..3d80c35af9 100755
--- a/release-utils/scripts/upload-source.sh
+++ b/release-utils/scripts/upload-source.sh
@@ -28,28 +28,54 @@ version=$1
stagingRepoId=$2
sourcesUrl=https://repository.apache.org/content/repositories/orgapachecamel-${stagingRepoId}/org/apache/camel/quarkus/camel-quarkus/${version}
-if [[ "$(curl -k -L -s -o /dev/null -w "%{http_code}" ${sourcesUrl})" != "200"
]]; then
+if [[ "$(curl -L -s -o /dev/null -w "%{http_code}" ${sourcesUrl})" != "200"
]]; then
echo "Failed to access ${sourcesUrl}. Is the ${version} staging repository
closed?"
exit 1
fi
-mkdir ${version}/
-cd ${version}/
+# Import the release keys into a throwaway keyring, so the verification below
is
+# answered by the project KEYS file rather than by whatever the release manager
+# happens to have in their own keyring
+gpgHome=$(mktemp -d)
+chmod 700 ${gpgHome}
+
+# Absolute, so that the trap still resolves it after the cd below
+stagingDir=$(pwd)/${version}
-wget ${sourcesUrl}/camel-quarkus-${version}-src.zip -O
apache-camel-quarkus-${version}-src.zip
-wget ${sourcesUrl}/camel-quarkus-${version}-src.zip.asc -O
apache-camel-quarkus-${version}-src.zip.asc
-sha512sum -b apache-camel-quarkus-${version}-src.zip >
apache-camel-quarkus-${version}-src.zip.sha512
+# Clear the staging directory on the way out, whether or not the run succeeded.
+# Without this a failed verification leaves a partly downloaded ${version}/
+# behind and the next attempt stops at mkdir with "File exists".
+trap 'rm -rf "${gpgHome}" "${stagingDir}"' EXIT
-wget ${sourcesUrl}/camel-quarkus-${version}-cyclonedx.json -O
apache-camel-quarkus-${version}-sbom.json
-wget ${sourcesUrl}/camel-quarkus-${version}-cyclonedx.json.asc -O
apache-camel-quarkus-${version}-sbom.json.asc
-sha512sum -b apache-camel-quarkus-${version}-sbom.json >
apache-camel-quarkus-${version}-sbom.json.sha512
+gpg --homedir ${gpgHome} --quiet --import ${location}/../../KEYS
+
+# Download an artifact with its detached signature, verify the signature, and
only
+# then generate the checksum that gets published alongside it. set -e aborts
the
+# release if any verification fails.
+#
+# NOTE: gpg --verify exits 0 for a good signature made by a revoked or expired
+# key, reporting it only as a warning. KEYS holds expired keys by design, since
+# ASF keeps the keys that signed past releases, so a release manager whose key
+# expired mid-cycle would still pass here. Reject EXPKEYSIG and REVKEYSIG from
+# --status-fd if that needs closing.
+fetch_verify_checksum() {
+ remoteName=$1
+ localName=$2
+
+ wget ${sourcesUrl}/${remoteName} -O ${localName}
+ wget ${sourcesUrl}/${remoteName}.asc -O ${localName}.asc
+ gpg --homedir ${gpgHome} --verify ${localName}.asc ${localName}
+ sha512sum -b ${localName} > ${localName}.sha512
+}
+
+mkdir ${version}/
+cd ${version}/
-wget ${sourcesUrl}/camel-quarkus-${version}-cyclonedx.xml -O
apache-camel-quarkus-${version}-sbom.xml
-wget ${sourcesUrl}/camel-quarkus-${version}-cyclonedx.xml.asc -O
apache-camel-quarkus-${version}-sbom.xml.asc
-sha512sum -b apache-camel-quarkus-${version}-sbom.xml >
apache-camel-quarkus-${version}-sbom.xml.sha512
+fetch_verify_checksum camel-quarkus-${version}-src.zip
apache-camel-quarkus-${version}-src.zip
+fetch_verify_checksum camel-quarkus-${version}-cyclonedx.json
apache-camel-quarkus-${version}-sbom.json
+fetch_verify_checksum camel-quarkus-${version}-cyclonedx.xml
apache-camel-quarkus-${version}-sbom.xml
cd ../
svn import ${version}/
https://dist.apache.org/repos/dist/dev/camel/camel-quarkus/${version}/ -m
"Import camel-quarkus ${version} release"
-rm -rf ${version}/
