Repository: apache/arrow
File: dev/release/02-source-test.rb (Ruby)

Code before:
      QUERY
    }
    response = Net::HTTP.post(uri,
                              n_issues_query.to_json,
                              "Content-Type" => "application/json",
                              "Authorization" => "Bearer #{github_token}")
    n_resolved_issues = JSON.parse(response.body)["data"]["search"]["issueCount"]
    github_repository = ENV["GITHUB_REPOSITORY"] || "apache/arrow"
    github_api_url = "https://api.github.com"
    verify_prs = URI("#{github_api_url}/repos/#{github_repository}/pulls" +
                     "?state=open" +
                     "&head=apache:release-#{@release_version}-rc0")
    verify_pr_url = nil
    headers = {
      "Accept" => "application/vnd.github+json",
    }

    if github_token
      headers["Authorization"] = "Bearer #{github_token}"
    end
    verify_prs.open(headers) do |response|
      verify_pr_url = (JSON.parse(response.read)[0] || {})["html_url"]
    end
    output = source("VOTE")
    # Extract the tarball hash from the output
    tarball_hash = output[/\[11\]: ([a-f0-9]+)/, 1]
    assert_equal(<<-VOTE.strip, output[/^-+$(.+?)^-+$/m, 1].strip)
To: dev@arrow.apache.org
Subject: [VOTE] Release Apache Arrow #{@release_version} - RC0

Hi,

I would like to propose the following release candidate (RC0) of Apache
Arrow version #{@release_version}. This is a release consisting of #{n_resolved_issues}
resolved GitHub issues[1].

This release candidate is based on commit:
#{@current_commit} [2]

The source release rc0 is hosted at [3].
The binary artifacts are hosted at [4][5][6][7][8][9].
The changelog is located at [10].

Please download, verify checksums and signatures, run the unit tests,
and vote on the release. See [11] for the SHA-512 checksum for this RC and [12]
for how to validate a release candidate.

See also a verification result on GitHub pull request [13].

The vote will be open for at least 72 hours.


Review comment (security):
How about computing it from the tar ball?

```suggestion
    tarball_hash = Digest::SHA512.file(@archive_name).to_s
```

We need additional `require` for it:

```diff
diff --git a/dev/release/02-source-test.rb b/dev/release/02-source-test.rb
index fe2c7b7759..3cab5b0b0e 100644
--- a/dev/release/02-source-test.rb
+++ b/dev/release/02-source-test.rb
@@ -15,6 +15,8 @@
 # specific language governing permissions and limitations
 # under the License.
 
+require "digest"
+
 class SourceTest < Test::Unit::TestCase
   include GitRunnable
   include VersionDetectable
```

Code after:
                 type: ISSUE) {
            issueCount
          }
        }
      QUERY
    }
    response = Net::HTTP.post(uri,
                              n_issues_query.to_json,
                              "Content-Type" => "application/json",
                              "Authorization" => "Bearer #{github_token}")
    n_resolved_issues = JSON.parse(response.body)["data"]["search"]["issueCount"]
    github_repository = ENV["GITHUB_REPOSITORY"] || "apache/arrow"
    github_api_url = "https://api.github.com"
    verify_prs = URI("#{github_api_url}/repos/#{github_repository}/pulls" +
                     "?state=open" +
                     "&head=apache:release-#{@release_version}-rc0")
    verify_pr_url = nil
    headers = {
      "Accept" => "application/vnd.github+json",
    }

    if github_token
      headers["Authorization"] = "Bearer #{github_token}"
    end
    verify_prs.open(headers) do |response|
      verify_pr_url = (JSON.parse(response.read)[0] || {})["html_url"]
    end
    output = source("VOTE")
    tarball_hash = Digest::SHA512.file("artifacts/#{@archive_name}").to_s
    assert_equal(<<-VOTE.strip, output[/^-+$(.+?)^-+$/m, 1].strip)
To: dev@arrow.apache.org
Subject: [VOTE] Release Apache Arrow #{@release_version} - RC0

Hi,

I would like to propose the following release candidate (RC0) of Apache
Arrow version #{@release_version}. This is a release consisting of #{n_resolved_issues}
resolved GitHub issues[1].

This release candidate is based on commit:
#{@current_commit} [2]

The source release rc0 is hosted at [3].
The binary artifacts are hosted at [4][5][6][7][8][9].
The changelog is located at [10].

Please download, verify checksums and signatures, run the unit tests,
and vote on the release. See [11] for the SHA-512 checksum for this RC and [12]
for how to validate a release candidate.

See also a verification result on GitHub pull request [13].