Repository navigation
Conversation
- unify Java 17 RC and source prevalidation workflows - verify package integrity, signer, versions and staging origin - exercise Server, Client, Loader, Tools and Hubble with cleanup - align bilingual instructions and cover validation failures
- initialize authenticated Server through stdin and disable monitor jobs - decode gzip responses and replace runtime properties idempotently - inspect bundled Maven license declarations and retain manual reports - cover startup cleanup and prohibited dependency failure paths
- end GPG option parsing before the selected release signer - reject selectors that could export the entire project keyring - retain real signature tests for valid and unrelated signers
- preserve GPG status evidence and native failure codes - reject revoked or expired signatures before package builds - test actual revocation and signature status combinations - align bilingual guidance on signer fingerprints and manual license review
- distinguish active listeners from recently closed TCP connections - preserve occupied loopback and wildcard listener protection - verify TIME_WAIT reuse and existing-service isolation
bitflicker64
left a comment
bitflicker64
left a comment
There was a problem hiding this comment.
Blocking: yes. Summary: The rewritten validator, workflow and docs are consistent with each other and the unit tests pass, but the new exact-four-archive rule drops the AI and Computer coverage the old validator had and fails the whole run on a 1.7.0-style candidate directory, while the docs point to per-component workflows that do not exist; the new manual GPG snippet also uses exit in a loop meant to be pasted into a terminal. Evidence: read the full exact-head diff against merge base e6389aa (validate-release.sh, release-smoke.py, prepare-release.sh, ReleaseClientSmoke.java, validate-release.yml, EN/CN docs, dist/README.md); python3 -m unittest discover -s dist/tests ran 30 tests OK and bash -n passed on both scripts at this head; the base validator and workflow built and checked hugegraph-ai and hugegraph-computer source packages; https://downloads.apache.org/hugegraph/1.7.0/ holds six archives (ai and computer src included); gh api on apache/hugegraph-ai and apache/hugegraph-computer shows no release validation workflow.
This branch has not been deployed
3 participants
Release validation uses Java 17 and one shared validator for CI and local runs. Package versions and RC paths are separate inputs. Publishing stays in nocode; this PR uses public candidates and verification keys, with no signing, uploading or Maven staging changes.
The four Server/Toolchain source and binary archives are required. AI and Computer source archives may share the candidate directory: every present archive receives SHA512, signer, contents and license checks, and Computer sources are rebuilt with Maven. Unknown archives and mismatched versions fail. AI and Computer product runtime tests remain separate.
Server/Toolchain source-built and downloaded binary distributions each run Server, Client, ordinary Loader, Tools and Hubble checks, including data readback, backup contents and shutdown. SDK JARs and POMs must come from the selected staging repository; legacy and matching URL-qualified Maven origin markers are supported.
The console and GitHub Job Summary show the result, failed phase, review notes and evidence location. Unsigned source prevalidation uses exact commits and explicitly excludes real RC signatures, downloads and remote staging provenance. Existing helpers and tests are reused, without a new reporting framework or dependency. Manual licensing review and release approval remain required.
Validation:
6df8dd909d56969322f90b505f1e0571464bccef, Toolchain039153cdbfe26798fdc4fb2628ef016948917f23. Both runtime phases passed. The summary surfaced five manual review notes for large files, image provenance and aggregate license mentions.35e29491f5e6fdff1ceff266868461fdef937a8dbuilt all ten Maven modules with Temurin 17.0.20.1 and an isolated repository; its Client JAR/POM matched staging 1163 checksums. Temporary build files were removed.Signed RC validation against actual SVN candidates and the full platform matrix remain pending. The source-prevalidation run does not replace them.