-1, I verified the packages, but the signatures are invalid.
It looks like the https://dist.apache.org/repos/dist/dev/pulsar/pulsar-2.8.2-candidate-1/apache-pulsar-2.8.2-bin.tar.gz.asc file is from December 1st. I checked this in the SVN staging repository history ( https://dist.apache.org/repos/dist/dev/pulsar) . The command I used: svn log https://dist.apache.org/repos/dist/dev/pulsar -v |less It seems that signatures and hashes were added in "r51152 | linlin | 2021-12-01 06:03:42 +0200 (Wed, 01 Dec 2021)". The newer change "r51361 | linlin | 2021-12-13 15:19:12 +0200 (Mon, 13 Dec 2021)" didn't update the signatures and hashes. Lin Lin, please check. -Lari On Tue, Dec 14, 2021 at 5:26 AM linlin <lin...@apache.org> wrote: > This is the first release candidate for Apache Pulsar, version 2.8.2. > > It fixes the following issues: > > https://github.com/apache/pulsar/issues?q=label%3Acherry-picked%2Fbranch-2.8+is%3Aclosed+label%3Arelease%2F2.8.2 > > *** Please download, test and vote on this release. This vote will stay > open > for at least 72 hours *** > > Note that we are voting upon the source (tag), binaries are provided for > convenience. > > Source and binary files: > https://dist.apache.org/repos/dist/dev/pulsar/pulsar-2.8.2-candidate-1/ > > SHA-512 checksums: > > f51e93d5caa7ea4ec2616e096ca75dd71bccb475632ee5ff35d713b8f5112689d17315a1cd9350dd8f8f0bdc2e059be5fb179b2b8b3b39aae77e466103294683 > apache-pulsar-2.8.2-bin.tar.gz > > 8540641e76fb541f9dbfaff263946ed19a585266e5de011e78188d78ec4e1c828e8893eb2e783a1ebad866f5513efffd93396b7abd77c347f34ab689badf4fad > apache-pulsar-2.8.2-src.tar.gz > > > Maven staging repo: > https://repository.apache.org/content/repositories/orgapachepulsar-1108/ > > The tag to be voted upon: > v2.8.2-candidate-1 > https://github.com/apache/pulsar/releases/tag/v2.8.2-candidate-1 > > Pulsar's KEYS file containing PGP keys we use to sign the release: > https://dist.apache.org/repos/dist/dev/pulsar/KEYS > > Please download the source package, and follow the README to build > and run the Pulsar standalone service. > > Lin Lin >
