Repository navigation
perf(release-verify-rc): classify RAT, JVM, Nexus and reproducibility results as code - #1619
Merged
Merged
Conversation
potiuk
added
family:tools
potiuk
added this pull request to stack #1620
October 13, 2026 14:14
potiuk
force-pushed
the
perf/release-mgmt-2-verify-rc
branch
from
October 13, 2026 15:23
a7d855d to
1fa7801
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
potiuk
force-pushed
the
perf/release-mgmt-2-verify-rc
branch
from
October 14, 2026 08:09
1fa7801 to
85dda73
Compare
potiuk
force-pushed
the
perf/release-mgmt-2-verify-rc
branch
from
October 15, 2026 23:06
85dda73 to
3e9e2a6
Compare
github-actions
Bot
added
family:docs
potiuk
force-pushed
the
perf/release-mgmt-2-verify-rc
branch
2 times, most recently
from
October 15, 2026 23:47
4a1af88 to
090c032
Compare
potiuk
force-pushed
the
perf/release-mgmt-2-verify-rc
branch
from
October 16, 2026 00:20
090c032 to
c23d133
Compare
potiuk
force-pushed
the
perf/release-mgmt-2-verify-rc
branch
from
October 16, 2026 00:25
c23d133 to
d237649
Compare
potiuk
force-pushed
the
perf/release-mgmt-2-verify-rc
branch
3 times, most recently
from
October 16, 2026 05:42
e50fba8 to
6cfe171
Compare
potiuk
force-pushed
the
perf/release-mgmt-2-verify-rc
branch
from
October 16, 2026 06:28
6cfe171 to
954206a
Compare
potiuk
force-pushed
the
perf/release-mgmt-2-verify-rc
branch
from
October 16, 2026 06:56
954206a to
36f1f8c
Compare
potiuk
force-pushed
the
perf/release-mgmt-2-verify-rc
branch
from
October 16, 2026 07:15
36f1f8c to
f477141
Compare
… results as code
release-verify-rc ran the release-verify checks and then had the agent
turn the configuration into their arguments and classify what came
back, by hand, from ~10k tokens of prose. tools/release-management now
does it, reading saved files only (no network, no gpg, nothing run):
- `args` emits the exact release-verify invocations for Steps 1-3, 5-8
and `all` from release-build.md: --expect / --expect-optional per
artefact, the digest set (never md5), --prohibit / --accept,
validators, the manifest and the unpacked directory.
- `rat` (Step 4): exit code and report → PASS / FAIL with the
unapproved files, or SKIP + WARN when no RAT config exists.
- `source-tree` (Step 7): REVIEW resolved from validator exit codes.
- `jvm` (Step 6b): the gate, jvm_digest_set, --podling from a root
DISCLAIMER, ABSENT → FAIL only under `staged`, findings and the
per-companion `gpg --verify` line.
- `nexus` (Step 6c): the gates, the staging-repo id shape
(`orgapache<project>-NNNN` or `snapshots`, checked before any URL is
built, because the id is spliced into curl URLs), the read-only
recipe, and every classification rule over the saved probe output.
- `repro` (Step 9): mandatory / skip, the RM-key vs ci-automated source
table, SWHIDs compared without qualifiers, per-mode binary rules,
`binaries.differs`.
- `report` (Step 10): the report and --post-to comment from
`release-verify verdict`, with the voter-obligation reminder and the
trusted-hardware attestation only when every condition holds.
The trusted-hardware attestation fails closed: it needs automated
signing, Step 9 PASS, the source identical and every declared
convenience artefact positively `identical` (one that was skipped or
never rebuilt withholds it too), and --trusted-hardware. Every rendered
recipe quotes its configured values with the shared shell helpers.
release-config's `load --skill verify-rc` now exposes the
required/optional artefact marker, binary-exclude globs, RAT paths,
validators and JVM keys the arguments need (existing fields unchanged).
SKILL.md becomes a router (9,936 → 6,280 tokens, 684 → 466 lines): the
36 failure-mode rows move into per-step files, and the JVM, Nexus and
reproducibility siblings keep their policy plus the command to run.
Step numbering ("Step 9"), the "Reproducibility validated on trusted
hardware" literal and `binaries.differs`, which release-promote reads,
are unchanged, and a test pins the reminder and attestation literals.
Evals: 33 cases in 9 suites → 17 in 8. The step-9 suite and the
scripted 6b / 6c cases become pytest cases named after each former
case; the judgement cases stay, their fixtures now carrying the real
tool output.
Generated-by: Claude Opus 5
Claude-Session: https://claude.ai/code/session_01GTPsZ5aEE5bUVYqp47Dpvv
…/ SKIP / FAIL Review findings on the verify-rc tool: - `source-tree` accepts --load like every other subcommand, so the documented `<verify-rc> source-tree …` form no longer fails on argparse; a test checks every documented subcommand takes --load. - Nexus versions come only from folders holding <artifactId>-<version> jars or poms, so maven-metadata.xml no longer reads as a foreign version and FAILs every real staging repository. - jvm and nexus without --inventory / --staged-dir are pending, not a confident SKIP; a wrong inventory or directory is an error. - RAT never PASSes without an exit code. - known: divergences match an entry or its key exactly, so an unknown divergence cannot drop from FAIL to WARN. - A maven-artifact-verify report without a status is refused. Generated-by: Claude Opus 5
…ries Adversarial-review findings on the verify-rc tool: - Nexus matches the RC only when a jar or pom folder for its version is present; a crawl holding only maven-metadata.xml fails. - Reproducibility does not PASS (and does not unlock the trusted-hardware attestation) without the repro-archive check report and the epoch. - The binary-exclusion parser accepts a glob only on an affirmative, non-negated accept or exception marker in its own bullet, so "prohibited; no exceptions accepted" stays prohibited. - Divergence entries are matched to the declared artefact names, so a container image tag containing ':' keeps its result. - The custom-source recipe copies the build's output to where the comparison reads it. Generated-by: Claude Opus 5
potiuk
force-pushed
the
perf/release-mgmt-2-verify-rc
branch
from
October 16, 2026 07:37
f477141 to
f5b14da
Compare
3 tasks done
potiuk
added a commit
that referenced
this pull request
Oct 17, 2026
Hand-sync of tools/spec-loop/specs/ with the functionality that landed between d58ecb7 and 43e4c6e. Specs changed: - release-management-lifecycle: verify-rc classification as code (abd5969, #1619), vote-draft / promote / announce-draft renders (c87ad08, d5fe7fd), the per-outcome / backend / classification file split across the family, and the SKILL.md size gap closed (all ten now under 500 lines). - adoption-and-setup: the utilities first-run welcome guide and the text-file mirror fallback in the family scan (9f8c479, #1669). - meta-and-quality-tooling: the zero-token /magpie-skills Claude Code mod in magpie-utilities (861c84e, #1667). - agent-isolation-sandbox: the agent-guard --junie adapter (6c24f30, #1666) and sandbox-lint refusing a tracked .claude/settings.json (4a07965, #1675). - adapters, security-issue-lifecycle, project-agnosticism: the canonical apache-magpie status-rollup marker, preferred over and replacing the legacy tracker-named one for new rollups (ccead70, #1665). - .last-sync bumped to 43e4c6e. No spec change needed (specs already updated in the commit itself): 43e4c6e, 399ab1b, 622bfbc, 5fc6a32, a75734c, e44b44a, a93a7d1, c67e3c6, a3d9b71, ec015bb. Exempt (mechanical): 0a79a33 (dev version bump), 80a0f1f (npm pin bump in prek hooks). Generated-by: Claude Opus 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Second PR of the release-management stack; it builds on #1604.
release-verify-rcran therelease-verifychecks, then had the agent work out their arguments fromrelease-build.mdand classify what came back, by hand.tools/release-management verify-rcnow does it, reading saved files only.args(the exactrelease-verifyinvocations),rat(Step 4),source-tree(Step 7 REVIEW resolution),jvm(6b gates and findings),nexus(6c gates, staging-repo id check, every classification rule over saved probe output),repro(Step 9) andreport(Step 10 report and--post-tocomment).load --skill verify-rcnow exposes the required/optional artefact marker, binary-exclude globs, RAT paths, validators and JVM keys. Existing fields are unchanged.Security notes
^orgapache[a-z0-9]+-[0-9]+$orsnapshots. The recipes stay GETs only.identical(an artefact that was skipped or never rebuilt also withholds it), and--trusted-hardware.binaries.differs, and the Step 9 numbering. A test pins the reminder and attestation literals against both skills.Behaviour I checked against the normative text
tools/asf-nexus/staging-verification.mdand the classification rules; only the one-line summary innexus-staging.mdreads looser.jvm_companion_locationunset: this behaves as before (notstaged), so an ABSENT jar is not a FAIL.Type of change
Test plan
prek run --all-filespasses on the stack tip.tools/release-management: pytest / ruff / mypy, including a real-loadintegration test.tools/release-confighas 4 new load tests.step-6c case-3failed there, and that case's fixture now carries the realnexusoutput, including the existence-200 line and.sha1siblings its "otherwise complete" scenario describes.Was generative AI tooling used to co-author this PR?
Generated-by:.🤖 Generated with Claude Code
https://claude.ai/code/session_01GTPsZ5aEE5bUVYqp47Dpvv