Lab 01 — Release Checklist Engine
What You'll Build
A validator that checks a release artifact against the mandatory Apache Release Policy checklist — GPG signatures, SHA-512 hashes, LICENSE, NOTICE, and absence of binary blobs.
Concepts
| Check | Why it matters |
|---|---|
| GPG signature | Allows downloaders to verify the artifact came from an ASF committer whose key is in the KEYS file |
| SHA-512 checksum | Detects transport corruption; SHA-512 required since Apache phased out MD5/SHA-1 |
| LICENSE file | Every release artifact must carry an Apache 2.0 LICENSE |
| NOTICE file | Attributions required by ALv2 §4(d) |
| No binary artifacts | ASF releases must be source-only; pre-built binaries belong in a separate convenience distribution |
Running
mvn test
Expected: 11 tests, 0 failures.
Key Classes
| Class | Role |
|---|---|
ReleaseArtifact | Value object — name + 5 boolean flags; built with a fluent builder |
ChecklistItem | Enum of the 5 policy checks |
ChecklistResult | Outcome of a single check (item + passed + message) |
ReleaseValidator | Validates an artifact against all 5 checks |
Interview Angle
Be ready to recite the 5 mandatory items from the Apache Release Policy and explain why binary blobs in source releases are forbidden.