Skip to content

ci: improve voter verification script #720

Closed
#741
Closed
ci: improve voter verification script#720
#741
Assignees
Haricharanpanjwani
Labels
area/ciWorkflows, build, release scriptskind/improvementImproving something that already existspriority/mediumImportant but not urgent

Description

@andreahlert
andreahlert
opened on Mar 30, 2026

Part of #715

Problem

The current `scripts/verify_apache_artifacts.py` covers basic checks (GPG, SHA-512, file presence), but does not verify reproducible builds or automate the full voter workflow.

Solution

Extend the verification script to:

  1. Rebuild from source and compare checksums against the SVN artifacts (requires ci: reproducible builds with SOURCE_DATE_EPOCH #716 reproducible builds)
  2. Run Apache RAT license check automatically
  3. Check that `DISCLAIMER`, `LICENSE`, `NOTICE` are present and correct in all artifacts
  4. Verify that the wheel includes the correct `LICENSE` files (related to 0.42 RC omits MIT License info from LICENSE-wheel #712)
  5. Print a summary with pass/fail for each check
  6. Optionally output a vote email draft with the verification results

Acceptance criteria

  • Reproducible build verification (rebuild + compare)
  • Apache RAT check integrated
  • LICENSE/NOTICE/DISCLAIMER presence check in all artifact types
  • Clear pass/fail summary output
  • Vote email draft generation (optional flag)

Activity

  1. andreahlert
    added
    kind/improvementImproving something that already exists
    area/ciWorkflows, build, release scripts
    priority/mediumImportant but not urgent
    on Mar 30, 2026

  2. andreahlert commented on Mar 30, 2026

    @andreahlert
    andreahlert
    on Mar 30, 2026
    CollaboratorAuthor

    @skrawcz @pjfanning the current verify_apache_artifacts.py covers GPG and SHA-512 but doesn't do a rebuild-and-compare check. once #716 lands we could add that. also thinking we should check LICENSE/NOTICE inside the wheel automatically, would've caught #712 earlier. any other checks you'd want?

  3. Haricharanpanjwani commented on Apr 17, 2026

    @Haricharanpanjwani
    Haricharanpanjwani
    on Apr 17, 2026
    Contributor

    @andreahlert please assign this issue to me.

  4. andreahlert
    assigned
    Haricharanpanjwani
    on Apr 17, 2026

  5. Haricharanpanjwani commented on Apr 19, 2026

    @Haricharanpanjwani
    Haricharanpanjwani
    on Apr 19, 2026
    Contributor

    Here is the pull request for this issue: #741, please review it

  6. Haricharanpanjwani commented on Apr 21, 2026

    @Haricharanpanjwani
    Haricharanpanjwani
    on Apr 21, 2026
    Contributor

    @skrawcz I have pushed revision 2 based on your feedback.

  7. Haricharanpanjwani commented on May 2, 2026

    @Haricharanpanjwani
    Haricharanpanjwani
    on May 2, 2026
    Contributor

    Waiting for review from @skrawcz @elijahbenizzy #741

  8. github-actions commented on May 20, 2026

    @github-actions
    github-actionsbot
    on May 20, 2026 – with GitHub Actions

    @Haricharanpanjwani, this issue has been inactive for 18 days.
    Are you still working on it? Drop a comment to let us know.

    If there is no update within 7 days, the assignment will be removed
    so someone else can pick it up
    (per the assignment policy).

  9. Haricharanpanjwani commented on Jun 1, 2026

    @Haricharanpanjwani
    Haricharanpanjwani
    on Jun 1, 2026
    Contributor

    PR is updated: #741, can I get a review on it?

  10. andreahlert
    closed this as completedin #741on Jun 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area/ciWorkflows, build, release scriptskind/improvementImproving something that already existspriority/mediumImportant but not urgent

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions