docs: maintain KEYS only in the release directory - #1050
Open
alaahong wants to merge 1 commit into
Open
Conversation
Align release documentation with ASF guidance: the KEYS file is a single source of truth kept in the release directory so it is available on downloads.apache.org for signature verification. Remove instructions to append the public key to the dev KEYS and change verification steps to fetch KEYS from downloads.apache.org instead of the dev directory.
alaahong
requested review from
delei and
psxjoy
and
a lite review from Copilot
August 27, 2026 15:04
Contributor
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Aligns the release/verification documentation with ASF guidance by treating KEYS as a single source of truth maintained in the dist/release area and verified via downloads.apache.org.
Changes:
- Update verification docs to fetch
KEYSfromhttps://downloads.apache.org/incubator/fesod/KEYSrather than from dist/dev. - Update release-manager docs to append public keys only to the dist/release
KEYS, and explicitly discourage duplicatingKEYSin dist/dev. - Remove outdated “SVN checkout includes KEYS” wording.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| website/community/release/verify-release.md | Downloads KEYS from downloads.apache.org and removes the “includes KEYS” note. |
| website/community/release/release-version.md | Documents KEYS as maintained only in dist/release and removes dev-repo instructions. |
| website/i18n/zh-cn/docusaurus-plugin-content-docs-community/current/release/verify-release.md | Mirrors the EN verification change for KEYS retrieval. |
| website/i18n/zh-cn/docusaurus-plugin-content-docs-community/current/release/release-version.md | Mirrors the EN release-manager guidance about KEYS being release-only. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+69
to
71
| # Download KEYS (kept in the release directory) | ||
| curl https://downloads.apache.org/incubator/fesod/KEYS > KEYS | ||
|
|
| ### 3.1 KEYS File | ||
|
|
||
| If you are a **first-time** release manager or your original key has expired, please **append** the **public key** to the **KEYS** files in the Apache SVN project repositories: | ||
| If you are a **first-time** release manager or your original key has expired, please **append** the **public key** to the **KEYS** file in the Apache SVN project **release** repository. The KEYS file is maintained in a single authoritative location (the release directory) so that it stays consistent and is available on downloads.apache.org for signature verification: |
Comment on lines
+71
to
73
| # 下载 KEYS（KEYS 在 release 目录维护，单一来源） | ||
| curl https://downloads.apache.org/incubator/fesod/KEYS > KEYS | ||
|
|
| ### 3.1 KEYS 文件 | ||
|
|
||
| 如果您是**第一次**作为发布者或原来的密钥已过期，请将**公钥**分别**追加**到 Apache SVN 项目仓库的 **KEYS** 文件中 | ||
| 如果您是**第一次**作为发布者或原来的密钥已过期，请将**公钥**追加到 Apache SVN 项目 **release 仓库**的 **KEYS** 文件中。KEYS 文件在单独权威位置（release 目录）维护，以保证一致性，并可在 downloads.apache.org 上用于签名验证： |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose of the pull request
Align release documentation with ASF guidance: the KEYS file is a single source of truth kept in the release directory so it is available on
downloads.apache.orgfor signature verification. Remove instructions to append the public key to the dev KEYS and change verification steps to fetch KEYS fromdownloads.apache.orginstead of the dev directory.What's changed?
website/community/release/release-version.mdand its zh-cn translation: section "3.1 KEYS File" now instructs appending the public key only to the release repository (https://dist.apache.org/repos/dist/release/incubator/fesod), dropping the dev repository. Added a note under Notes that the KEYS file is maintained only in the release directory (single source of truth) and must not be duplicated in the dev directory.website/community/release/verify-release.mdand its zh-cn translation: signature verification now downloads KEYS fromhttps://downloads.apache.org/incubator/fesod/KEYSinstead ofhttps://dist.apache.org/repos/dist/dev/incubator/fesod/KEYS; removed the now-inaccurate "includes KEYS file" comment on the SVN checkout step.This is a documentation-only change; no build logic or tests are affected.
Checklist
https://fesod.apache.org/community/contribution/.