The script rcverify.sh is available to automate the process of verifying a release.
The script will download the release candidate, verify signatures, notice, and license. The tool assumes that are no executable files in the release and will flag any executable that it finds. If the tool discovers an issue during verification, it will try to emit useful information for you to further inspect the findings. The release is left on your disk for you to further inspect and you must delete the scratch space when finished.
Example of how to use rcverify.sh:
rcverify.sh openwhisk-client-js 'OpenWhisk Client Js' 3.20.0 rc2 TODO: put updated script output here