Hi, Can this key and its history be explained? https://github.com/apache/texera/blob/98d3d4b1ec8b02f611801d035c190fa31f56fa47/.github/workflows/create-release-candidate.yml#L231
The usual is that the release manager signs on hardware they control. Here it appears that an individual committer's private key and passphrase are stored in GitHub secrets, and any workflow run with access to those secrets could sign with them. The ASF release-signing policy (https://infra.apache.org/release-signing.html#automated-release-signing) allows CI signing only after Infra approves it, and it then expects a project key that Infra manages, not a committer's personal key. These ASF Infra KEYS will not have an individual's name assigned to them. Apache Pekko's CI Signing Key (public part) appears in https://downloads.apache.org/pekko/KEYS - as a reference. Unless the secrets.GPG_PRIVATE_KEY was provided by ASF Infra then it appears that you are in violation of ASF policies. Thanks, PJ
