Shell script to verify staged release candidate artifacts

[snazy]

Performs a bunch of verifications against a proposed (staged) release candidate using the new tools/verify-release/verify-release.sh script against Maven artifacts, main distributions and Helm chart.

Checks:

• GPG signature and checksum verifications
• All expected artifacts are present
• Build artifacts are reproducible (minus known exceptions)
  • jar files
  • Main distribution zip/tarball
  • Helm chart
• Build passes.
• DISCLAIMER/LICENSE/NOTICE files are present in artifacts that require those

More information in the added web site page.

Fixes #2822

[adutra]

Excellent improvement that will greatly simplify release verification!

My impression is that the tool is mostly focusing on artifact comparison and reproducible builds. A possible future addition would be to actually test the distribution by building and running basic tests, including tests for Helm chart.

[adutra]

Why not include a step to automate this?

I usually use the below to test the source distribution and check for licenses etc.

./gradlew rat test :checkForCopiedCode \
  :polaris-server:assemble \
  :polaris-server:quarkusAppPartsBuild --rerun \
  -Dquarkus.container-image.tag=${version} \
  -Dquarkus.container-image.build=true

[snazy]

The assumption is that CI, which performs all these checks, is "green".

[snazy]

BTW: The script can keep (-k option) the (temporary) directory, which contains all the downloaded and locally built artifacts.
Tests can be run from there.

[adutra]

This could also be automated:

executable_files=$(find . -type f ! -size 0 | perl -lne 'print if -B' | xargs file | grep executable)
if [ -n "$executable_files" ]; then
  echo "Binary executable files found:"
  echo "$executable_files"
  exit 1
fi

[snazy]

Hm, I think the line 52 should read No disallowed binary artifacts are bundled in the source archive..
A strict "no binary artifacts at all" is difficult to achieve, as png and jpeg are binary.
Bash scripts for example are permitted, as those are "text" files, despite being executable.

[snazy]

Thanks @pingtimeout !

All the issues should be fixed now.

I hit a couple of "interesting" issues along the way:

• ulimit - bumped to 16384 - the (macOS?) default of 256 was definitely not enough
• shasum can run into Perl compilation errors on macOS (no clue why) - replaced with the native variants, if those are available (those are in /sbin on macOS, so should be there all the time)
• tar/warning - omit on macOS
• had to optimize the script to use less subshells/subprocesses - but it also got faster that way
• made the console output a bit more readable by omitting the temp-dir path when checking signatures/checksums (TMPDIR is loooong on macOS)
• added a note for wget2 that it may print "Failed to parse date" messages (only on macOS) - but it works
• weird hang on macOS in a bash regex-if