I'm now getting a bad signature error: + download_rc_file apache-arrow-go-18.8.0.tar.gz + '[' 1 -gt 0 ']' + download https://github.com/apache/arrow-go/releases/download/v18.8.0-rc1/apache-arrow-go-18.8.0.tar.gz apache-arrow-go-18.8.0.tar.gz + curl --fail --location --show-error --silent --output apache-arrow-go-18.8.0.tar.gz https://github.com/apache/arrow-go/releases/download/v18.8.0-rc1/apache-arrow-go-18.8.0.tar.gz + '[' 1 -gt 0 ']' + download_rc_file apache-arrow-go-18.8.0.tar.gz.asc + '[' 1 -gt 0 ']' + download https://github.com/apache/arrow-go/releases/download/v18.8.0-rc1/apache-arrow-go-18.8.0.tar.gz.asc apache-arrow-go-18.8.0.tar.gz.asc + curl --fail --location --show-error --silent --output apache-arrow-go-18.8.0.tar.gz.asc https://github.com/apache/arrow-go/releases/download/v18.8.0-rc1/apache-arrow-go-18.8.0.tar.gz.asc + gpg --verify apache-arrow-go-18.8.0.tar.gz.asc apache-arrow-go-18.8.0.tar.gz gpg: Signature made 2026年09月05日 03時51分30秒 JST gpg: using RSA key 74EE211E32BF1DF9D984FA394B86A1E5E59C8B81 gpg: BAD signature from "Matt Topol <[email protected]>" [unknown] + cleanup + go clean -modcache + '[' no = yes ']' + echo 'Failed to verify release candidate. See /tmp/arrow-go-18.8.0-1.Fuwpf for details.' Failed to verify release candidate. See /tmp/arrow-go-18.8.0-1.Fuwpf for details.
RC0 is still fine: + download_rc_file apache-arrow-go-18.8.0.tar.gz + '[' 1 -gt 0 ']' + download https://github.com/apache/arrow-go/releases/download/v18.8.0-rc0/apache-arrow-go-18.8.0.tar.gz apache-arrow-go-18.8.0.tar.gz + curl --fail --location --show-error --silent --output apache-arrow-go-18.8.0.tar.gz https://github.com/apache/arrow-go/releases/download/v18.8.0-rc0/apache-arrow-go-18.8.0.tar.gz + '[' 1 -gt 0 ']' + download_rc_file apache-arrow-go-18.8.0.tar.gz.asc + '[' 1 -gt 0 ']' + download https://github.com/apache/arrow-go/releases/download/v18.8.0-rc0/apache-arrow-go-18.8.0.tar.gz.asc apache-arrow-go-18.8.0.tar.gz.asc + curl --fail --location --show-error --silent --output apache-arrow-go-18.8.0.tar.gz.asc https://github.com/apache/arrow-go/releases/download/v18.8.0-rc0/apache-arrow-go-18.8.0.tar.gz.asc + gpg --verify apache-arrow-go-18.8.0.tar.gz.asc apache-arrow-go-18.8.0.tar.gz gpg: Signature made 2026年09月03日 04時07分12秒 JST gpg: using RSA key 74EE211E32BF1DF9D984FA394B86A1E5E59C8B81 gpg: Good signature from "Matt Topol <[email protected]>" [unknown] gpg: aka "Matthew Topol <[email protected]>" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. On Sat, Sep 5, 2026, at 03:52, Matt Topol wrote: > Hi, > > I would like to propose the following release candidate (RC1) of > Apache Arrow Go version 18.8.0. > > This release candidate is based on commit: > 72e9a5695337bab9ac01ec1e4d58177bc4949dc3 [1] > > The source release rc1 is hosted at [2]. > > This is not a permanent URL. If the RC is accepted, it will be moved to > the final release location. The SHA512 hash of the source tarball is: > 32a6c0249e65d36ac8539991120e2f2df5f59adb6db84efc07366b56b339f733da29f9f246853dcaedbbcaf378ef28a9e5d9b727503c020bfb5dba9408461b61. > > Please download, verify checksums and signatures, run the unit tests, > and vote on the release. See [3] for how to validate a release candidate. > > The vote will be open for at least 72 hours. > > [ ] +1 Release this as Apache Arrow Go 18.8.0 > [ ] +0 > [ ] -1 Do not release this as Apache Arrow Go 18.8.0 because... > > [1]: > https://github.com/apache/arrow-go/tree/72e9a5695337bab9ac01ec1e4d58177bc4949dc3 > [2]: https://github.com/apache/arrow-go/releases/v18.8.0-rc1 > [3]: > https://github.com/apache/arrow-go/blob/main/dev/release/README.md#verify
