Once a release candidate has been staged to https://dist.apache.org/repos/dist/dev/incubator/pegasus it must be validated and voted on in order to proceed.
The full checklist can be found here: Incubator Release Checklist.
Prerequisites
For MacOS:
brew install gpg
For ubuntu:
sudo apt install gnupg
For RHEL or CentOS:
sudo yum install gnupg
Downloading the release files
Suppose you are going to validate version {a.b.c-RCd}.
A release consists of a source zip, a signature file, a sha512 checksum file.
- Source package: https://dist.apache.org/repos/dist/dev/incubator/pegasus/a.b.c-RCd/apache-pegasus-a.b.c-incubating-src.zip
- Signature (asc): https://dist.apache.org/repos/dist/dev/incubator/pegasus/a.b.c-RCd/apache-pegasus-a.b.c-incubating-src.zip.asc
- Checksum (sha512): https://dist.apache.org/repos/dist/dev/incubator/pegasus/a.b.c-RCd/apache-pegasus-a.b.c-incubating-src.zip.sha512
Please download the files altogether.
Verifying the signature (ASC)
Before checking the signature, you should download and import the public keys from https://dist.apache.org/repos/dist/dev/incubator/pegasus/KEYS
gpg --import KEYS
In order to check the signature (ASC) of the release:
gpg --verify apache-pegasus-a.b.c-incubating-src.zip.asc apache-pegasus-a.b.c-incubating-src.zip
This should produce something like this: ("Good signature" means correct!)
gpg: using RSA key B29EB88AD60BB41EC9D82687B1DA1BBC34C617A9 gpg: issuer "wutao@apache.org" gpg: Good signature from "Tao Wu <wutao@apache.org>" [ultimate]
If you get the following error, it means you don't have the public key of the person who signed the message.
gpg: Signature made 一 10/14 13:04:42 2019 CST gpg: using RSA key BA45CDBB87E8B146A81F5BBE2206EF8F64C35889 gpg: Can't check signature: No public key
Verifying the checksum (SHA512)
Linux:
sha512sum --check apache-pegasus-a.b.c-incubating-src.zip.sha512
MacOS:
shasum -a 512 --check apache-pegasus-a.b.c-incubating-src.zip.sha512
If it produces "apache-pegasus-a.b.c-incubating-src.zip: OK", it means the package is good.
Running RAT
Before building it might be a good idea to run RAT on the unpacked sources. This tool will find all binaries and files without license headers.
Download the latest version of RAT from here: apache-rat-0.13-bin.tar.gz
Unpack it somewhere and run the following command:
java -jar apache-rat-0.13/apache-rat-0.13.jar -d apache-pegasus-a.b.c-incubating-src \ -E apache-pegasus-a.b.c-incubating-src/.rat-excludes \ -e apache-pegasus-a.b.c-incubating-src/rdsn
Compile Pegasus
Please read the document compile-from-source or compile-by-docker to build pegasus.
Reply to the vote thread
This is a template for the reply email of your validation result. It's not required to completely follow the template.
+1/0/-1 (binding) # "binding" means you are an Apache PMC/PPMC. If not, "not-binding" here.
I checked:
(yes/no) Do release files have the word incubating in their name?
(yes/no) Are the digital signature and hashes correct?
(yes/no) Does DISCLAIMER file exist?
(yes/no) Do LICENSE and NOTICE files exist?
(yes/no) Is the LICENSE and NOTICE text correct?
(yes/no) Is the NOTICE year correct?
(yes/no) Un-included software dependencies are not mentioned in LICENSE or NOTICE?
(yes/no) License information is not mentioned in NOTICE?
Is there any 3rd party code contained inside the release? If so:
(yes/no) Does the software have a compatible license?
(yes/no) Are all software licenses mentioned in LICENSE?
(yes/no) Is the full text of the licenses (or pointers to it) in LICENSE?
Is any of this code Apache-licensed? Do they have NOTICE files? If so:
(yes/no) Have relevant parts of those NOTICE files been added to this NOTICE file?
(yes/no) Do all source files have ASF headers?
(yes/no) Do the contents of the release match with what's tagged in version control?
(yes/no) Are there any unexpected binary files in the release?
(yes/no) Can you compile from source? Are the instructions clear?