VERIFY.md

<!--
  ~ Licensed to the Apache Software Foundation (ASF) under one
  ~ or more contributor license agreements.  See the NOTICE file
  ~ distributed with this work for additional information
  ~ regarding copyright ownership.  The ASF licenses this file
  ~ to you under the Apache License, Version 2.0 (the
  ~ "License"); you may not use this file except in compliance
  ~ with the License.  You may obtain a copy of the License at
  ~
  ~   http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing,
  ~ software distributed under the License is distributed on an
  ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  ~ KIND, either express or implied.  See the License for the
  ~ specific language governing permissions and limitations
  ~ under the License.
-->

# Apache Release Verification Checklist

This markdown file serves as a local checklist for verifying the authenticity and integrity of Apache Software Foundation releases.

## 1. Source & Infrastructure
- [ ] **Official Download Domain**: Verify the file was downloaded from `*.apache.org` (e.g., `downloads.apache.org` or `archive.apache.org`) and not a third-party mirror.
- [ ] **Secure Protocol**: Ensure the download URL uses HTTPS (`https://`).

## 2. Cryptographic Key Import
- [ ] **Fetch KEYS File**: Download the official `KEYS` file from the main Apache project site.
- [ ] **Import to GPG keyring**: Run the command:
  ```bash
  gpg --import KEYS
  ```
- [ ] **Verify Key Fingerprint**: (Optional but recommended) Cross-reference the key's fingerprint with known release managers listed on the official project page.

## 3. Cryptographic Signature Verification
- [ ] **Fetch ASC File**: Download the detached signature file (`.asc`) for your exact release version.
- [ ] **Execute Signature Check**: Run the verification command:
  ```bash
  curl https://dist.apache.org/repos/dist/release/incubator/openserverless/KEYS -o KEYS
  gpg --import KEYS
  gpg --verify <filename>.<extension>.asc <filename>.<extension>
  ```
- [ ] **Confirm 'Good Signature'**: Ensure the output states `"Good signature from..."`. (Ignore the "not certified with a trusted signature" warning if you haven't explicitly set trust levels, provided the name matches the release manager).

## 4. Checksum Integrity Validation
- [ ] **Fetch Checksum File**: Download the `.sha512` or `.sha256` file corresponding to the release.
- [ ] **Generate Local Hash**: Compute the hash locally based on your OS:
  - Linux: `sha512sum <filename>.<extension>`
  - macOS: `shasum -a 512 <filename>.<extension>`
  - Windows: `CertUtil -hashfile <filename>.<extension> SHA512`
- [ ] **Match Checksums**: Verify that your locally generated string matches the content of the downloaded checksum file exactly.

## 5. Archive Content & Compliance Auditing
- [ ] **Mandatory Root Files**: Unpack the archive and verify the root contains the required metadata files:
  - `LICENSE`
  - `NOTICE`

- [ ] **Informational Files**: Verify the presence of setup and project notes:
  - `README` or `README.md`
  - `RELEASE_NOTES` or `CHANGES`

- [ ] **Source Cleanliness**: For source distributions, check that no compiled binaries (`.jar`, `.class`, `.so`, `.dll`, or target/build folders) are accidentally bundled inside the package.


## 6.Build and Test the Sources
Execute:

  - Linux: `./build-and-test-ubuntu.sh`
  - macOS: `./build-and-test-mac.sh` (you need [Lima](https://lima-vm.io/))
  - Windows: `.\build-and-test-windows.ps1` (you need a recent WSL )

Ensure it builds cleanly and all the test passes.