janhoy commented on a change in pull request #355:
URL: https://github.com/apache/lucene/pull/355#discussion_r727578265
##########
File path: dev-tools/scripts/smokeTestRelease.py
##########
@@ -1043,122 +823,81 @@ def getPOMcoordinate(treeRoot):
packaging = 'jar' if packaging is None else packaging.text.strip()
return groupId, artifactId, packaging, version
-def verifyMavenSigs(baseURL, tmpDir, artifacts, keysFile):
- print(' verify maven artifact sigs', end=' ')
- for project in ('lucene', 'solr'):
-
- # Set up clean gpg world; import keys file:
- gpgHomeDir = '%s/%s.gpg' % (tmpDir, project)
- if os.path.exists(gpgHomeDir):
- shutil.rmtree(gpgHomeDir)
- os.makedirs(gpgHomeDir, 0o700)
- run('gpg --homedir %s --import %s' % (gpgHomeDir, keysFile),
- '%s/%s.gpg.import.log' % (tmpDir, project))
-
- reArtifacts = re.compile(r'\.(?:pom|[jw]ar)$')
- for artifactFile in [a for a in artifacts[project] if
reArtifacts.search(a)]:
- artifact = os.path.basename(artifactFile)
- sigFile = '%s.asc' % artifactFile
- # Test sig (this is done with a clean brand-new GPG world)
- logFile = '%s/%s.%s.gpg.verify.log' % (tmpDir, project, artifact)
- run('gpg --homedir %s --verify %s %s' % (gpgHomeDir, sigFile,
artifactFile),
- logFile)
- # Forward any GPG warnings, except the expected one (since it's a clean
world)
- f = open(logFile)
- for line in f.readlines():
- if line.lower().find('warning') != -1 \
- and line.find('WARNING: This key is not certified with a trusted
signature') == -1 \
- and line.find('WARNING: using insecure memory') == -1:
- print(' GPG: %s' % line.strip())
- f.close()
- # Test trust (this is done with the real users config)
- run('gpg --import %s' % keysFile,
- '%s/%s.gpg.trust.import.log' % (tmpDir, project))
- logFile = '%s/%s.%s.gpg.trust.log' % (tmpDir, project, artifact)
- run('gpg --verify %s %s' % (sigFile, artifactFile), logFile)
- # Forward any GPG warnings:
- f = open(logFile)
- for line in f.readlines():
- if line.lower().find('warning') != -1 \
- and line.find('WARNING: This key is not certified with a trusted
signature') == -1 \
- and line.find('WARNING: using insecure memory') == -1:
- print(' GPG: %s' % line.strip())
- f.close()
+def verifyMavenSigs(tmpDir, artifacts, keysFile):
+ print(' verify maven artifact sigs', end=' ')
- sys.stdout.write('.')
+ # Set up clean gpg world; import keys file:
+ gpgHomeDir = '%s/lucene.gpg' % tmpDir
+ if os.path.exists(gpgHomeDir):
+ shutil.rmtree(gpgHomeDir)
+ os.makedirs(gpgHomeDir, 0o700)
+ run('gpg --homedir %s --import %s' % (gpgHomeDir, keysFile),
+ '%s/lucene.gpg.import.log' % tmpDir)
+
+ reArtifacts = re.compile(r'\.(?:pom|[jw]ar)$')
+ for artifactFile in [a for a in artifacts if reArtifacts.search(a)]:
+ artifact = os.path.basename(artifactFile)
+ sigFile = '%s.asc' % artifactFile
+ # Test sig (this is done with a clean brand-new GPG world)
+ logFile = '%s/lucene.%s.gpg.verify.log' % (tmpDir, artifact)
+ run('gpg --homedir %s --verify %s %s' % (gpgHomeDir, sigFile,
artifactFile),
+ logFile)
+
+ # Forward any GPG warnings, except the expected one (since it's a clean
world)
+ print_warnings_in_file(logFile)
+
+ # Test trust (this is done with the real users config)
+ run('gpg --import %s' % keysFile,
+ '%s/lucene.gpg.trust.import.log' % tmpDir)
+ logFile = '%s/lucene.%s.gpg.trust.log' % (tmpDir, artifact)
+ run('gpg --verify %s %s' % (sigFile, artifactFile), logFile)
+ # Forward any GPG warnings:
+ print_warnings_in_file(logFile)
+
+ sys.stdout.write('.')
print()
+
+def print_warnings_in_file(file):
+ f = open(file)
Review comment:
Done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscr...@lucene.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@lucene.apache.org
For additional commands, e-mail: issues-h...@lucene.apache.org
