From 1d3165cd1904a82e9a770dbc170ca94d26469260 Mon Sep 17 00:00:00 2001 From: Gianluca Graziadei Date: Sun, 19 Jul 2026 14:10:23 +0200 Subject: [PATCH] verify-release-file.sh: check .sha512 files with sha512sum -c The script compared the output of 'gpg --print-md SHA512' textually against the published .sha512 file, but release .sha512 files are generated in sha512sum format, so the diff always failed and the script reported 'SHA file is not correct' even when the hash matched. Verified against the apache-storm-2.8.9-rc1 artifacts: the script now reports 'SHA file is correct' for a valid file. Co-Authored-By: Claude Fable 5 --- dev-tools/rc/verify-release-file.sh | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/dev-tools/rc/verify-release-file.sh b/dev-tools/rc/verify-release-file.sh index 3e6a8690b18..933990f42e1 100755 --- a/dev-tools/rc/verify-release-file.sh +++ b/dev-tools/rc/verify-release-file.sh @@ -35,12 +35,10 @@ else fi # checking SHA -GPG_SHA_FILE="/tmp/${TARGET_FILE}_GPG.sha512" -gpg --print-md SHA512 ${TARGET_FILE} > ${GPG_SHA_FILE} SHA_TARGET_FILE="${TARGET_FILE}.sha512" echo ">> checking SHA file... (${SHA_TARGET_FILE})" -diff /tmp/${TARGET_FILE}_GPG.sha512 ${SHA_TARGET_FILE} +sha512sum -c ${SHA_TARGET_FILE} if [ $? -eq 0 ]; then