First stab at automating some release checks

abesto commented 5 years ago

This sets up the framework and implements all the needed checks (I think):

Downloads the release and the KEYS file
Verifies that the KEYS file contains the key provided in the release notes (passed in as an argument)
Verifies SHA512 checksum
Verifies GPG signature, without polluting the default GPG keyring
Verifies that base dir name in the zip is as expected
Verifies that source matches git revision
DISCLAIMER looks good (asks human)
NOTICE looks good (asks human)
LICENSE is Apache 2 (compares to hard-coded string)
LICENSE looks good to human eyes
There are no binary files in the source distribution
Project builds / tests cleanly (mvnw package)

Possible next steps include

Adding any missed checks
Set up a stable Docker environment and run the script via that
Add a wrapper (possibly curl|sh) script that pulls the latest version, builds the Docker image, and runs in that with the same arguments.

To run right now:

cd src
virtualenv --python=python3 venv
. venv/bin/activate
pip install -r requirements.txt
python main.py brave-karaf 0.1.2 --gpg-key BB67A050 --git-hash 31545805a55dbe5e495403d84172fc865a4935e0

Output looks like this:

2019-02-17-203750_2528x1339 2019-02-17-203837_1692x855

michaelsembwever commented 5 years ago

Love it @abesto !

abesto commented 5 years ago

Added (I think) all checks, updated the description accordingly. Will leave this open for a bit to get more eyes on it, then merge.

abesto commented 5 years ago

I've now seen this used in a live release vote, gonna say "good enough, merge".

openzipkin-attic / apache-release-verification

First stab at automating some release checks #1