mirror of
https://github.com/apache/airflow.git
synced 2026-11-04 15:58:21 +00:00
124 lines
4.3 KiB
Bash
Executable File
124 lines
4.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Licensed to the Apache Software Foundation (ASF) under one
|
|
# or more contributor license agreements. See the NOTICE file
|
|
# distributed with this work for additional information
|
|
# regarding copyright ownership. The ASF licenses this file
|
|
# to you under the Apache License, Version 2.0 (the
|
|
# "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing,
|
|
# software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
# KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
# Run the reviewer checklist from java-sdk/README.md against an Apache Airflow
|
|
# Java SDK source-release tarball (except the GPG signature).
|
|
#
|
|
# Usage:
|
|
# verify-source-release.sh --tarball <path> --tag java-sdk/<version>-rc<N> \
|
|
# [--sha512 <path>]
|
|
#
|
|
# Requirements:
|
|
# Bash with common shell tools, Git, Gradle, JDK 11.
|
|
#
|
|
# Staged convenience binaries are checked separately by
|
|
# smoke-test-staged-binaries.sh (only meaningful for a staged release).
|
|
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
|
|
|
|
tarball="" tag="" sha512=""
|
|
while [ "$#" -gt 0 ]; do
|
|
case "$1" in
|
|
--tarball) tarball="$2"; shift 2 ;;
|
|
--tag) tag="$2"; shift 2 ;;
|
|
--sha512) sha512="$2"; shift 2 ;;
|
|
*) echo "Unknown argument: $1" >&2; exit 2 ;;
|
|
esac
|
|
done
|
|
if [ -z "$tarball" ] || [ -z "$tag" ]; then
|
|
echo "ERROR: --tarball and --tag are required" >&2
|
|
exit 2
|
|
fi
|
|
tarball="$(cd "$(dirname "$tarball")" && pwd)/$(basename "$tarball")"
|
|
[ -z "$sha512" ] || sha512="$(cd "$(dirname "$sha512")" && pwd)/$(basename "$sha512")"
|
|
|
|
work="$(mktemp -d)"
|
|
tagco="$work/tagco"
|
|
cleanup() {
|
|
git -C "$REPO_ROOT" worktree remove --force "$tagco" >/dev/null 2>&1 || true
|
|
rm -rf "$work"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
echo "==> 1. Checksum"
|
|
if [ -n "$sha512" ]; then
|
|
( cd "$(dirname "$tarball")" && sha512sum -c "$sha512" )
|
|
else
|
|
echo " no --sha512 given; skipping"
|
|
fi
|
|
|
|
echo "==> 2. Extract to a clean directory outside the repo"
|
|
tar -xzf "$tarball" -C "$work"
|
|
extracted="$(find "$work" -maxdepth 1 -type d -name 'apache-airflow-java-sdk-*' | head -n1)"
|
|
[ -n "$extracted" ] || { echo "ERROR: no apache-airflow-java-sdk-* directory inside the tarball" >&2; exit 1; }
|
|
echo " $extracted"
|
|
|
|
echo "==> 3. No compiled/binary files (ASF source releases must be source-only)"
|
|
bins="$(find "$extracted" -type f -exec sh -c 'file -b "$1" | grep -qviE "text|json|xml|empty" && echo "$1"' _ {} \; || true)"
|
|
if [ -n "$bins" ]; then
|
|
echo "ERROR: non-source files found in the tarball:" >&2
|
|
echo "$bins" >&2
|
|
exit 1
|
|
fi
|
|
echo " OK"
|
|
|
|
echo "==> 4. Diff against the tagged source (only export-ignored files may differ)"
|
|
git -C "$REPO_ROOT" worktree add --detach --quiet "$tagco" "$tag"
|
|
diffout="$(diff -rq "$extracted" "$tagco/java-sdk" \
|
|
| grep -vE ': (gradlew|gradlew\.bat|gradle-wrapper\.jar|scripts)$' || true)"
|
|
if [ -n "$diffout" ]; then
|
|
echo "ERROR: tarball differs from the tag beyond the export-ignored files:" >&2
|
|
echo "$diffout" >&2
|
|
exit 1
|
|
fi
|
|
echo " OK"
|
|
|
|
echo "==> 5. Build from scratch (regenerate the wrapper, then ./gradlew build)"
|
|
props="$extracted/gradle/wrapper/gradle-wrapper.properties"
|
|
gv="$(sed -n 's#^distributionUrl=.*/gradle-\(.*\)-bin\.zip#\1#p' "$props")"
|
|
gsum="$(sed -n 's#^distributionSha256Sum=##p' "$props")"
|
|
if [ -z "$gv" ] || [ -z "$gsum" ]; then
|
|
echo "ERROR: could not read Gradle version/sha256 from $props" >&2
|
|
exit 1
|
|
fi
|
|
(
|
|
cd "$extracted"
|
|
gradle --no-daemon wrapper --gradle-version "$gv" --gradle-distribution-sha256-sum "$gsum"
|
|
./gradlew --no-daemon build # `build` runs `check`, which runs :bom:verifyBomCoverage
|
|
)
|
|
echo " OK"
|
|
|
|
echo "==> 6. LICENSE and NOTICE present in every published jar"
|
|
repo="$work/maven-repo"
|
|
( cd "$extracted" && ./gradlew --no-daemon publish -PmavenUrl="file://$repo" -PskipSigning=true )
|
|
missing=0
|
|
while IFS= read -r jar; do
|
|
for entry in META-INF/LICENSE META-INF/NOTICE; do
|
|
if ! unzip -l "$jar" | grep -qE "${entry}$"; then
|
|
echo "ERROR: ${entry} missing from ${jar##*/}" >&2
|
|
missing=1
|
|
fi
|
|
done
|
|
done < <(find "$repo" -name '*.jar')
|
|
[ "$missing" -eq 0 ] || exit 1
|
|
echo " OK"
|
|
|
|
echo "All release-verification checks passed."
|