Page History

...

1. Verify signatures using the instructions at https://www.apache.org/info/verification.html#CheckingSignatures. You will need GPG installed. On MacOS machines, you can install GPG with HomeBrew using brew install gpg.

2. Verify checkums for the source and binary artifacts from the corresponding .mds files. E.g. a quick way to do so using gpg is:

   Code Block
   language bash theme RDark
   gpg --print-mds hadoop-3.1.1-src.tar.gz > mds.tmp diff hadoop-3.1.1-src.tar.gz.mds mds.tmp

   
   

3. Verify that there are no MD5 signatures provided.
4. Verify that jars have been correctly staged to repository.apache.org.
   1. For 3.x releases and later, verify that the shaded fat jars look correct.
5. Sanity check the CHANGES.md and RELEASENOTES.md files.
6. Verify that source and binary tarballs include LICENSE.txt and NOTICE.txt files.

...

1. Extract the source tarball and build the release from sources using:

   1. mvn clean install package -Pdist -DskipTests=true

2. The binary tarball will be available at hadoop-dist/target/hadoop-<version>.tar.gz.

3. Follow all the steps from the Verify Binary Release section below.

4. Verify that the source distribution has no extra files/changes by diffing against the git tag in a local clone of the Hadoop repo. E.g.

   Code Block
   language bash theme RDark
   $ git checkout release-3.1.0-RC1 $ diff -r $PWD /tmp/hadoop-3.1.0 # Assuming RC src tarball was unpacked in /tmp/hadoop-3.1.0

   
   

Verify Binary Release Bits

...