1. Download the release candidate tarbells and open the directory for the corresponding release candidate
   

   $ svn co https://dist.apache.org/repos/dist/dev/incubator/pinot pinot-dev-dist 
   $ cd pinot-dev-dist/apache-pinot-incubating-x.x.x-rcx

   
   

2. Verify bundle name, signature & SHA512 hash
   1. Verify if the bundle contains "incubating" in name (e.g. apache-pinot-incubating-x.x.x-src.tar.gz)
   2. Import public keys from Pinot release managers (need to do once)
      

      $ wget https://dist.apache.org/repos/dist/release/incubator/pinot/KEYS
      $ gpg --import KEYS
      $ rm KEYS
      
      

   1. Verify the signature
      

      $ gpg --verify apache-pinot-incubating-x.x.x-bin.tar.gz.asc
      $ gpg --verify apache-pinot-incubating-x.x.x-src.tar.gz.asc
      
      # Expected output
      gpg: assuming signed data in 'apache-pinot-incubating-x.x.x-bin.tar.gz'
      gpg: Signature made Mon Feb 11 13:23:40 2019 PST
      gpg: using RSA key FD534854D542FD474278B85344BA03AD164D961B
      gpg: Good signature from "Seunghyun Lee <snlee@apache.org>" [ultimate]
      
      

   2. Verify hashes
      

      # Compare the output with *.tar.gz.sha512 file
      $ shasum -a 512 apache-pinot-incubating-x.x.x-bin.tar.gz
      $ shasum -a 512 apache-pinot-incubating-x.x.x-src.tar.gz

      
      

3. Open a directory for the corresponding release candidate and untar the tarbell
   

   $ cd apache-pinot-incubating-x.x.x-rcx 
   $ tar -xzvf apache-pinot-incubating-x.x.x-src.tar.gz
   $ tar -xzvf apache-pinot-incubating-x.x.x-bin.tar.gz

   
   

4. Verify git commit hash & tag 
   1. Check if git commit hash provided in voting mail matches with the commit hash from the actual tag
   2. Check if the source release matches with the git tag. 
      

      $ git clone -b 'release-x.x.x-rcx' --single-branch --depth 1 https://github.com/apache/incubator-pinot.git pinot-git-src  
      $ cd pinot-git-src
      $ git log # Check git commit hash given here against the one given in the voting mail
      $ cd ..
      $ diff -r apache-pinot-incubating-x.x.x-src pinot-git-src
      
      # Expected output is to only include lines starting with "Only in pinot-git-src..."
      Only in pinot-git-src: .codecov_bash
      Only in pinot-git-src: .codecov.yml
      ...
      
      

5. Verify DISCLAIMER, LICENSE, NOTICE files are present in the extracted bundle.
   
   
6. Verify if the source distribution can compile
   

   # Build Pinot (This will run license check, compilation, and tests)
   $ mvn clean install -Pbin-dist
   
   # Run Quick Demo
   $ cd pinot-distribution/target/apache-pinot-incubating-x.x.x-bin
   $ bin/quick-start-offline.sh
   
   # At this point, open a web browser and go to http://localhost:9000/query and try to run some queries

   
   

7. Verify if binary distribution are working well with the Quick Demo

   # Run Quick Demo
   $ cd apache-pinot-incubating-x.x.x-bin
   $ bin/quick-start-offline.sh
   
   # At this point, open a web browser and go to http://localhost:9000/query and try to run some queries

Checklist

1. Verify if the bundle contains "incubating" in name
2. Verify signature, hash
3. Verify if the released source matches with the provided git tag & hash
4. Verify if DISCLAIMER, LICENSE, NOTICE files are present
5. Check if the source distribution can compile (Do not skip the tests)
6. Run quick demo from both source and binary distributions

For the official incubator release checklist, please refer to https://wiki.apache.org/incubator/IncubatorReleaseChecklist