From ef64531e38d3e87d7165596958b6d31f9f076aef Mon Sep 17 00:00:00 2001
From: Henrik Ingo <henrik@nyrk.io>
Date: Wed, 12 Nov 2025 23:18:37 -0800
Subject: [PATCH 1/3] Add a bash script that contributors may use/adapt to
 validate releases

---
 util/verify-asf-release | 106 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 106 insertions(+)
 create mode 100755 util/verify-asf-release

diff --git a/util/verify-asf-release b/util/verify-asf-release
new file mode 100755
index 00000000..c2f7c388
--- /dev/null
+++ b/util/verify-asf-release
@@ -0,0 +1,106 @@
+#!/bin/bash
+
+# This is a script that contributors can use to verify release candidates before voting
+# Note: ASF rules specifically require each contributor, ultimately committer, to personally,
+# that is, manually, inspect a release candidate source tar file before voting on it.
+# Scripting this "manual" process is allowed. Also sharing such scripts between contributors
+# is allowed. If you use this script, consider adding your own checks or variations to diversify
+# the positive impact on quality that this process is intended to have.
+# Note that trying to fully automate these checks, for example by putting this script in CI,
+# is not allowed. Releases must always be approved via voting, and voters must have personally
+# validated the release.
+
+
+set -e
+set -x
+
+
+PYTHON_VERSION=3.8
+PROJECT_NAME="apache-otava"
+SHORT_NAME="otava"
+PROJECT_VERSION="0.7.0-incubating-rc3"
+DIST="dev/incubator"
+#DIST="release/incubator"
+
+ASF_BASE_URL="https://dist.apache.org/repos/dist"
+KEYS_URL="${ASF_BASE_URL}/release/incubator/KEYS"
+BASE_URL="${ASF_BASE_URL}/${DIST}/${SHORT_NAME}/${PROJECT_VERSION}"
+
+TAR_BASE="${PROJECT_NAME}-${PROJECT_VERSION}"
+TAR_FILE="${TAR_BASE}-src.tar.gz"
+TAR_URL="${BASE_URL}/${TAR_FILE}"
+
+
+# Just execute the tests, skip the download and unpack
+workdir=$1
+
+
+if [[ ! -d ${workdir} ]]
+then
+###################################### Download and unpack #########################################3
+    uname=asf-verifier-$RANDOM
+    uvenv=venv-$uname
+    workdir=/tmp/$uname
+
+    set +x
+
+    echo " "
+
+    echo "Please execute:"
+    echo ""
+    echo "   gpg --fetch-keys $KEYS_URL"
+    echo ""
+    echo "... manually."
+    echo "(For security reasons I won't.)"
+    echo ""
+    set -x
+
+
+    mkdir /tmp/$uname
+    cd /tmp/$uname
+
+    curl -f "$TAR_URL" > "$TAR_FILE"
+    curl -f -o "$TAR_FILE".asc "$TAR_URL".asc
+    curl -f -o "$TAR_FILE".sha512 "$TAR_URL".sha512
+
+    gpg -v --verify "$TAR_FILE".asc "$TAR_FILE"
+    sha512sum --check "$TAR_FILE".sha512
+
+    tar xvf "$TAR_FILE"
+    #cd "$PROJECT_NAME"
+    ls -laiFhR
+else
+    cd $workdir
+fi
+cd ${SHORT_NAME}-${PROJECT_VERSION}
+cat README.md
+cat LICENSE
+cat DISCLAIMER
+cat NOTICE
+
+echo
+echo Try to actually execute something
+echo
+
+set -x
+uv venv --allow-existing
+uv pip install .
+uv run otava
+
+# Commented out lines from here on are because they don't work
+# uv run otava -h
+uv run otava analyze -h
+
+uv run otava list-groups  # There are no groups yet
+uv run otava --config-file examples/csv/config/otava.yaml analyze -h
+uv run otava --config-file examples/csv/config/otava.yaml list-groups
+uv run otava --config-file examples/csv/config/otava.yaml list-tests
+
+# This works, but it didn't analyze local.sample
+# uv run otava --config-file examples/csv/config/otava.yaml analyze local.sample
+
+# This one fails and prints an "ERROR: ..." message, but doesn't return with nonzero exit
+uv run otava --config-file examples/csv/config/otava.yaml analyze --tests-local.sample-file=examples/csv/data/local_sample.csv local.sample
+
+
+docker compose -f examples/csv/docker-compose.yaml run --build otava analyze local.sample

From a31a60f3b5074eeed08146b14efde3250bb6326d Mon Sep 17 00:00:00 2001
From: Dave Fischer <wave@apache.org>
Date: Sun, 23 Nov 2025 18:22:17 +0200
Subject: [PATCH 2/3] Add another script to be used as helper to check release
 tar file.

This script was shared by Dave Fischer in the mailing list discussion.
---
 util/check-signatures | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100755 util/check-signatures

diff --git a/util/check-signatures b/util/check-signatures
new file mode 100755
index 00000000..81745c44
--- /dev/null
+++ b/util/check-signatures
@@ -0,0 +1,35 @@
+#!/bin/bash
+# This is another script used by some project contributors to
+# download and verify release tar files before voting to approve.
+# You are encouraged to use one of these scripts to help you
+# before voting. You may want to extend this script with your own
+# checks, or use it as inspiration for your own script.
+
+export DISTURL='https://dist.apache.org/repos/dist/dev'
+export PROJECT=${1}
+export ARTIFACT=${2}
+export DISTRO=${DISTURL}/${PROJECT}/${ARTIFACT}
+
+echo ${DISTRO}
+
+export TMPDIR=/tmp/${PROJECT}
+
+mkdir -p $TMPDIR
+cd $TMPDIR
+pwd
+
+curl -f -L ${DISTRO} --output ${ARTIFACT}
+curl -f -L ${DISTRO}.asc --output ${ARTIFACT}.asc
+curl -f -L ${DISTRO}.sha256 --output ${ARTIFACT}.sha256
+curl -f -L ${DISTRO}.sha512 --output ${ARTIFACT}.sha512
+
+echo 'Check signature'
+gpg --verify ${ARTIFACT}.asc
+echo 'Compare checksum to sha256'
+cat ${ARTIFACT}.sha256
+shasum -a 256 ${ARTIFACT}
+echo 'Compare checksum to sha512'
+cat ${ARTIFACT}.sha512
+shasum -a 512 ${ARTIFACT}
+echo
+

From 3ffbc188d0320311d358c421dba4194a3b138eb3 Mon Sep 17 00:00:00 2001
From: Henrik Ingo <henrik@nyrk.io>
Date: Sun, 23 Nov 2025 18:48:40 +0200
Subject: [PATCH 3/3] Add ASF license header to scripts in util/

Also change filename to end in .sh. This brings these files
into the view of .pre-commit-config.yaml
---
 util/{check-signatures => check-signatures.sh}  | 17 +++++++++++++++++
 ...verify-asf-release => verify-asf-release.sh} | 17 +++++++++++++++++
 2 files changed, 34 insertions(+)
 rename util/{check-signatures => check-signatures.sh} (55%)
 rename util/{verify-asf-release => verify-asf-release.sh} (79%)

diff --git a/util/check-signatures b/util/check-signatures.sh
similarity index 55%
rename from util/check-signatures
rename to util/check-signatures.sh
index 81745c44..5dc93fa2 100755
--- a/util/check-signatures
+++ b/util/check-signatures.sh
@@ -1,4 +1,21 @@
 #!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
 # This is another script used by some project contributors to
 # download and verify release tar files before voting to approve.
 # You are encouraged to use one of these scripts to help you
diff --git a/util/verify-asf-release b/util/verify-asf-release.sh
similarity index 79%
rename from util/verify-asf-release
rename to util/verify-asf-release.sh
index c2f7c388..9ca46e98 100755
--- a/util/verify-asf-release
+++ b/util/verify-asf-release.sh
@@ -1,5 +1,22 @@
 #!/bin/bash
 
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
 # This is a script that contributors can use to verify release candidates before voting
 # Note: ASF rules specifically require each contributor, ultimately committer, to personally,
 # that is, manually, inspect a release candidate source tar file before voting on it.