Google Git
Sign in
apache / infrastructure-download-integrity-checker / 42792075b899b84b0743fa96a8da8bee48bc46bd
commit42792075b899b84b0743fa96a8da8bee48bc46bd[log] [tgz]
authorSebb <sebb@apache.org>Mon Jul 25 11:11:52 2022 +0100
committerSebb <sebb@apache.org>Mon Jul 25 11:11:52 2022 +0100
tree532a51eedbad0659784ecd81f553ef7e06e50bbb
parent73cfc67fea548a00599d112b32af1495cbe73a42 [diff]
Another TODO
1 file changed
tree: 532a51eedbad0659784ecd81f553ef7e06e50bbb
  1. .github/
  2. tests/
  3. checker.yaml
  4. email-template.txt
  5. main.py
  6. pipservice-download-integrity-checker.service
  7. README.md
  8. requirements.txt
README.md

Download Integrity Checker for ASF Infra

This service runs as a Pipservice and verifies download artifacts using their accompanying chekcums and detached signatures, as per our release distribution policies ( outlined at https://infra.apache.org/release-distribution.html ).

When a mismatch is detected, projects (and infra) are notified of this via email.

TODO

  • check all directories and files for errors in sigs and hashes (not just some extensions)
  • where a project has multiple KEYS files, use the appropriate (closest) one only for checking