Handling Release Artifact Integrity Errors at the ASF

This page will help you resolve release distribution policy errors that our Download Integrity Checker discovers. Each reported error has an accompanying error code (CHKxx). The code will help you resolve issues by using the matrix below:

Error Code	Error Description	How to Address the Issue
CHK01	Key used for signing artifact is missing from the KEYS file	Make sure the key that signed the release was expected. Update your KEYS file to include the key. Remember to move your updated KEYS file from /dev/ to /release/ on dist.apache.org when releasing with new keys.
CHK02	Weak or missing checksum file(s)	If the release artifact has a valid signature, generate a conforming checksum and add it. You can leave the old hash file. Otherwise, see CHK05.
CHK03	No KEYS file was found in the project's distribution directory	Make sure the project directory has at least one KEYS file containing all signing keys used for distribution. Projects may have more than one KEYS file (per-component, per-version, etc.) but they MUST be called KEYS and exist within the project's dist directory.
CHK04	The signature used for signing expired before signing the file	It’s possible the expiry has been changed. Make sure the KEYS file is updated. If the key has really expired treat the file as if it has no signature (CHK05).
CHK05	No (or invalid) signature found for the release artifact	Check: Is there a signature file for this artifact?: If the signature is valid but has the wrong file name or extension, rename it to the appropriate .asc file name. If the signature is invalid, see handling invalid or missing signatures. If there is no signature file at all, see handling invalid or missing signatures.
CHK06	Checksum mismatch	Try to spot what the problem was (why are you generating the wrong checksum?): If the file has a valid signature (no CHK04 or CHK05 errors for this file), generate a conforming checksum, add it, and remove the broken one. Otherwise: treat as if CHK05.

Handling invalid or missing signatures

In case of an invalid or missing signature for a release artifact, the project MUST choose one of the following actions:

• Remove the artifact(s)
• Re-assert that the artifact is valid, sign and upload the correct .asc signature file (and fix any missing/invalid checksum files)

In either case, the project MUST inform the ASF Infrastructure and Security Team at private@infra.apache.org and security@apache.org of their action, with clear evidence that the action has been discussed and agreed upon (a link to a lists.apache.org thread will suffice).

If you have questions about the error reports, this page, or our release distribution polices in general, feel free to reach out to us at users@infra.apache.org.