...
$ brew install gpg2 coreutilsbrew install gpg2 coreutilsWarning: gnupg2-2.0.30_3 already installedWarning: coreutils-8.26 already installed$ which gpg2 gsha256sum gmd5sum /usr/local/bin/gpg2/usr/local/bin/gsha256sum/usr/local/bin/gmd5sum$ gpg2 --import ../KEYSgpg: directory `/Users/espino/.gnupg' createdgpg: new configuration file `/Users/espino/.gnupg/gpg.conf' createdgpg: WARNING: options in `/Users/espino/.gnupg/gpg.conf' are not yet active during this rungpg: keyring `/Users/espino/.gnupg/secring.gpg' createdgpg: keyring `/Users/espino/.gnupg/pubring.gpg' createdgpg: /Users/espino/.gnupg/trustdb.gpg: trustdb createdgpg: key D0D6D44A: public key "Caleb Welton <cwelton@apache.org>" importedgpg: key 9AF9C0EE: public key "Ting (Goden) Yao (CODE SIGNING KEY) <godenyao@apache.org>" importedgpg: key 8051460D: public key "Ting (Goden) Yao (CODE SIGNING KEY) <godenyao@apache.org>" importedgpg: key 9475BD5D: public key "Roman V Shaposhnik (CODE SIGNING KEY) <rvs@apache.org>" importedgpg: key 2858A0C9: public key "Lei Chang <lei_chang@apache.org>" importedgpg: key 57325522: public key "Edward Bartolo Espino (CODE SIGNING KEY) <espino@apache.org>" importedgpg: Total number processed: 6gpg: imported: 6 (RSA: 5)gpg: no ultimately trusted keys found$ gpg2 --verify apache-hawq-src-2.1.0.0-incubating.tar.gz.ascgpg: assuming signed data in 'apache-hawq-src-2.1.0.0-incubating.tar.gz'gpg: Signature made Tue Jan 10 17:25:01 2017 CST using RSA key ID 57325522gpg: Good signature from "Edward Bartolo Espino (CODE SIGNING KEY) <espino@apache.org>" [unknown]gpg: WARNING: This key is not certified with a trusted signature!gpg: There is no indication that the signature belongs to the owner.Primary key fingerprint: BBED A7B5 F336 D516 B34A DE0C FC06 62F2 5732 5522$ gsha256sum --check apache-hawq-src-2.1.0.0-incubating.tar.gz.sha256apache-hawq-src-2.1.0.0-incubating.tar.gz: OK$ gmd5sum --check apache-hawq-src-2.1.0.0-incubating.tar.gz.md5apache-hawq-src-2.1.0.0-incubating.tar.gz: OK
- Build is successful (Refer to Build and Install for build instructions)
- DISCLAIMER is correct, filenames include “incubating”
- LICENSE and NOTICE files are correct and dependency licenses are acceptable
- LICENSE and NOTICE files at the root of the artifact directory must only reflect the contents of the artifact in which they are contained.
- See:
- LICENSE file requirements
- LICENSE requirements for distribution artifacts with multiple licenses
- NOTICE file requirements (Check Copyright year)
- Apache Legal
- Acceptable and Unacceptable Dependency Licenses
- All source files have license headers where appropriate, RAT checks pass
- Additional check:
- pom.xml (For artifactId "hawq", verify version is consistent with the version specified in getversion file in the root directory).
- Additional check:
- The provenance of all source files is clear (ASF or software grants)
...