Update Release notes to use verification scripts

[jonnybot0]

This adds a port of the release verification scripts that @cbmarcum created for Groovy (see https://lists.apache.org/thread/684b33z83fmycgm3sl2k4lh2dn668pf7) to Geb and updates the RELEASING.md files to match their use.

I have tested out the verification script (verify.sh) against the 8.0.1 release (see https://dist.apache.org/repos/dist/release/groovy/geb/8.0.1/) with this command: etc/bin/verify.sh release 8.0.1. I haven't rigorously tested fail states, though I can attest that the scripts do fail for non-existent releases in dev & release.

Part of the motivation here is to demonstrate to the ASF that we have a process for verifying releases as well as reproducible builds. With that, we should be able to setup a more automated release process, similar to what Grails has.

I would love for someone to test out the changes to the RELEASING.md docs in particular. I realize you may have to do a "dry run" of some of the steps, since you won't be running against a real release, but some validation that the new steps make sense to someone who isn't me would be appreciated. :)

[Copilot]

Pull request overview

Adds end-to-end release verification tooling under etc/bin/ and updates the release documentation to use these scripts, aiming to strengthen ASF release verification and reproducible-build evidence for Geb.

Changes:

• Introduces bash scripts to download and verify release artifacts (checksums, GPG sigs, required files) and run RAT.
• Adds a script to test build reproducibility by rebuilding jars twice and diffing SHA-256s.
• Updates RELEASING.md to document the new verification steps and git-ignores reproducible build results.

Reviewed changes

Copilot reviewed 1 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
etc/bin/verify.sh	Orchestrates KEYS download, artifact download, source verification, and RAT run.
etc/bin/download-release-artifacts.sh	Downloads source zip + signature + checksum files from ASF dist.
etc/bin/verify-source-distribution.sh	Verifies SHA-256 + GPG signature, unzips, checks required files.
etc/bin/test-reproducible-builds.sh	Performs two clean jar builds and compares checksums, preserving diffs.
RELEASING.md	Documents using the new verification scripts during staging/vote.
.gitignore	Ignores etc/bin/results output from reproducible-build testing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[cbmarcum]

Hi @jonnybot0 , Thanks for your work on this! The scripts look good to me. I like all the comments you've added.
My only question is on the README.md step 15. The copilot review is assuming you are describing what the reproducible test script is doing and I thought you might mean the staging repository.

Also, does the success output of verify.sh step 2 and 3 coincide with this step 15?

Next steps for manual verification:
  1. Review the extracted source
  2. Run the reproducible build test:
       /Users/carl/dev-git/groovy-geb/etc/bin/test-reproducible-builds.sh
  3. Build the project from the extracted source and compare jar checksums

The build and tests failed due to groovy-lang.org being down. I reran them and all is good.

[jonnybot0]

Hey, @cbmarcum - thanks for your review. To answer these questions:

My only question is on the README.md step 15. The copilot review is assuming you are describing what the reproducible test script is doing and I thought you might mean the staging repository.

Also, does the success output of verify.sh step 2 and 3 coincide with this step 15?

Next steps for manual verification:
  1. Review the extracted source
  2. Run the reproducible build test:
       /Users/carl/dev-git/groovy-geb/etc/bin/test-reproducible-builds.sh
  3. Build the project from the extracted source and compare jar checksums

I've updated the README and the script comments to be a bit clearer on these two notes. You're right that the echo'd out tips in verify.sh correspond to step 15 in the RELEASING.md file.

[cbmarcum]

Looks good with the latest changes!