Re: [I] [Release] Add support for verifying .{asc,sha256,512} for .jar related files in `dev/release/verify_rc.sh` [arrow-java]
kou commented on issue #593: URL: https://github.com/apache/arrow-java/issues/593#issuecomment-2803538530 @yyossy5 You may be interested in this. We need to vote before we publish an "official" release based on the Apache Software Foundation policy: https://infra.apache.org/release-publishing.html#voting We have a verification script to help the process: https://github.com/apache/arrow-java/blob/main/dev/release/verify_rc.sh But it's not completed. This issue focus on https://github.com/apache/arrow-java/blob/4b4d92851c8ecba1876a8f452279122e88e5ff8e/dev/release/verify_rc.sh#L142 We want to add auto verification for `.asc`/`.sha256`/`.sha512` in this issue as the first step. We'll run unit tests against built `.jar` in follow-up tasks. We'll be able to run the code by `VERIFY_DEFAULT=0 VERIFY_BINARY=1 dev/release/verify_rc.sh 18.2.0 5`. See also: https://github.com/apache/arrow-java/blob/main/dev/release/README.md#verify -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: github-unsubscr...@arrow.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
Re: [I] [Release] Add support for verifying .{asc,sha256,512} for .jar related files in `dev/release/verify_rc.sh` [arrow-java]
yyossy5 commented on issue #593: URL: https://github.com/apache/arrow-java/issues/593#issuecomment-2803561855 Thank you @kou , I'll check this when I have a moment. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: github-unsubscr...@arrow.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
Re: [I] [Release] Add support for verifying .{asc,sha256,512} for .jar related files in `dev/release/verify_rc.sh` [arrow-java]
jbonofre commented on issue #593: URL: https://github.com/apache/arrow-java/issues/593#issuecomment-2662661408 @kou for staging, it's fine, we can use GitHub Release location. As we also push to dist.apache.org (`release` location, not `dev` after release), it's OK. @kou so you are right, GitHub Release is good enough for verification. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: github-unsubscr...@arrow.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
Re: [I] [Release] Add support for verifying .{asc,sha256,512} for .jar related files in `dev/release/verify_rc.sh` [arrow-java]
kou commented on issue #593: URL: https://github.com/apache/arrow-java/issues/593#issuecomment-2655212592 Oh, really!? https://www.apache.org/legal/release-policy.html#host-rc uses "SHOULD": > Projects should use the [/dev tree of the dist repository](https://dist.apache.org/repos/dist/dev) or the staging features of repository.apache.org to host release candidates posted for developer testing/voting (prior to being, potentially, formally blessed as a GA release). So, I thought that we can use other ASF approved locations such as Artifactory https://apache.jfrog.io/ and GitHub Release. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: github-unsubscr...@arrow.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
Re: [I] [Release] Add support for verifying .{asc,sha256,512} for .jar related files in `dev/release/verify_rc.sh` [arrow-java]
jbonofre commented on issue #593: URL: https://github.com/apache/arrow-java/issues/593#issuecomment-2653979928 From an ASF standpoint, the most important is to verify the source distribution from dist.apache.org. So, maybe we can verify artifacts from GitHub Release, but also from dist.apache.org. Do you want me to give it a shoot ? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: github-unsubscr...@arrow.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
