)]}'
{
  "commit": "30623d0a79d73ecf4f22635206153fbc5715d0d0",
  "tree": "afaac315bbabe6efb8a7938630bd3df8177680ef",
  "parents": [
    "8a15bed514887911cb220b15b3e0bc7b64226fc9"
  ],
  "author": {
    "name": "David M. Johnson",
    "email": "snoopdave@apache.org",
    "time": "Sat Sep 05 16:39:55 2026 -0400"
  },
  "committer": {
    "name": "David M. Johnson",
    "email": "snoopdave@apache.org",
    "time": "Sat Sep 05 16:39:55 2026 -0400"
  },
  "message": "Fix release signing script argument handling and checksums\n\nThe release-candidate guard read\n\n    if [ rcstring !\u003d \"\" ]; then\n\nwhich compares the literal word \"rcstring\" against the empty string and is\ntherefore always true. Final releases took the rename branch too, where it\nbecame a no-op rename of each archive onto itself.\n\nThe version and RC suffix were also hardcoded to the previous release, so\nthe script had to be edited before every use.\n\nTake both as arguments, rename only when there is a suffix to add, and skip\nan archive that has already been renamed so a re-run after a failure is not\nconfusing.\n\nTwo other changes:\n\n- Require the signing key to be named through ROLLER_SIGNING_KEY, and refuse\n  a key that is not RSA or is under 4096 bits. Older keys may still be in a\n  release manager\u0027s keyring and would otherwise be picked by default.\n- Write checksums with shasum(1) rather than \"gpg --print-md\", so downloaders\n  can verify with \"shasum -c\", and emit SHA-512 alongside SHA-256.\n\nClaude-Session: https://claude.ai/code/session_019R1jdtwkaYEeA6L9DXEtEi\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c8a16738cc8d1eaed70f5f99e94de72d61b82844",
      "old_mode": 33261,
      "old_path": "assembly-release/sign-release.sh",
      "new_id": "54c946a86c01161a72d22263f9383b9d09c0ceba",
      "new_mode": 33261,
      "new_path": "assembly-release/sign-release.sh"
    }
  ]
}