[Release] .sha{256,512} for .jar related files should use relative path not absolute path for easy to use

[kou]

Describe the enhancement requested

For example, arrow-algorithm-18.2.0-cyclonedx.json.sha256 in https://github.com/apache/arrow-java/releases/tag/v18.2.0-rc5 is:

3dc20ba4ef1fe4714e85609c10d4892b7ce9ea27f7b13fe88f2056b7623b0562  /home/runner/work/arrow-java/arrow-java/binaries/arrow-algorithm-18.2.0-cyclonedx.json

It should be:

3dc20ba4ef1fe4714e85609c10d4892b7ce9ea27f7b13fe88f2056b7623b0562  arrow-algorithm-18.2.0-cyclonedx.json

[jbonofre]

Yes, agree, related path is preferred 😄

[kou]

@yyossy5 You may be interested in this.

We must provide checksums for release artifacts based on the Apache Software Foundation policy: https://infra.apache.org/release-distribution.html#sigs-and-sums

We generate checksums for binary artifacts by

arrow-java/ci/scripts/jni_full_build.sh

Lines 100 to 103 in 4b4d928

	for artifact in "${dist_dir}"/*; do
	sha256sum "${artifact}" >"${artifact}.sha256"
	sha512sum "${artifact}" >"${artifact}.sha512"
	done

but it uses absolute paths not relative paths. It's inconvenient because we can't use sha512sum -c to verify the checksums.

FYI: We can use $(basename "${artifact}") to get basename in shell.

[xpgcrx]

Thank you @kou , I'll check this when I have a moment.