Skip to content

[Release] .sha{256,512} for .jar related files should use relative path not absolute path for easy to use #592

Closed

Description

@kou

Describe the enhancement requested

For example, arrow-algorithm-18.2.0-cyclonedx.json.sha256 in https://github.com/apache/arrow-java/releases/tag/v18.2.0-rc5 is:

3dc20ba4ef1fe4714e85609c10d4892b7ce9ea27f7b13fe88f2056b7623b0562  /home/runner/work/arrow-java/arrow-java/binaries/arrow-algorithm-18.2.0-cyclonedx.json

It should be:

3dc20ba4ef1fe4714e85609c10d4892b7ce9ea27f7b13fe88f2056b7623b0562  arrow-algorithm-18.2.0-cyclonedx.json

Activity

  1. self-assigned this
    on Feb 12, 2025
  2. jbonofre commented on Feb 12, 2025

    @jbonofre
    Member

    Yes, agree, related path is preferred 😄

  3. kou commented on Apr 15, 2025

    @kou
    MemberAuthor

    @yyossy5 You may be interested in this.

    We must provide checksums for release artifacts based on the Apache Software Foundation policy: https://infra.apache.org/release-distribution.html#sigs-and-sums

    We generate checksums for binary artifacts by

    for artifact in "${dist_dir}"/*; do
    sha256sum "${artifact}" >"${artifact}.sha256"
    sha512sum "${artifact}" >"${artifact}.sha512"
    done
    but it uses absolute paths not relative paths. It's inconvenient because we can't use sha512sum -c to verify the checksums.

    FYI: We can use $(basename "${artifact}") to get basename in shell.

  4. yysd5 commented on Apr 15, 2025

    @yysd5

    Thank you @kou , I'll check this when I have a moment.

  5. added a commit that references this issue on Oct 8, 2025
  6. added a commit that references this issue on Oct 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions