[PR] fix(release): make source archives reproducible [paimon-cpp]

["zjw1111 (via GitHub)" <gi...@apache.org>]

zjw1111 opened a new pull request, #177:
URL: https://github.com/apache/paimon-cpp/pull/177

   ### Purpose
   
   Linked issue: N/A
   
   Make source release archives reproducible across macOS and Linux and ensure that the artifact tested by GitHub Actions is the exact artifact signed and staged by the release manager.
   
   The previous packaging flow allowed platform gzip implementations to produce different compressed bytes. It also created the release-manager artifact separately from the workflow artifact. This change requires GNU gzip with fixed options, makes the workflow artifact canonical, downloads and signs those exact bytes, and verifies byte-for-byte reproducibility from the signed RC tag.
   
   The verifier now reuses an isolated KEYS keyring for both artifact and tag signatures, including unsigned CI artifacts. Focused tests cover gzip selection, inherited gzip options, signed-tag verification, and inherited Git signing configuration.
   
   ### Tests
   
   - `python3 -m unittest discover -s scripts/releasing/tests -v`
   - Signed-tag regression test with `commit.gpgSign=true` and `gpg.format=ssh`
   - `pre-commit run --files .github/workflows/release_candidate.yaml scripts/releasing/README.md scripts/releasing/create_source_release.sh scripts/releasing/release_rc.sh scripts/releasing/tests/test_release_tools.py scripts/releasing/verify_release_candidate.sh`
   - `bash -n scripts/releasing/create_source_release.sh scripts/releasing/release_rc.sh scripts/releasing/verify_release_candidate.sh`
   - `scripts/releasing/release_rc.sh --version 0.4.0 --rc 1 --signing-key TEST --remote upstream --dry-run`
   - `git diff --check`
   
   ### API and Format
   
   No public API, storage format, or protocol changes.
   
   ### Documentation
   
   Updated the release documentation with the GNU gzip prerequisite and canonical workflow-artifact flow.
   
   ### Generative AI tooling
   
   Generated-by: OpenAI Codex (GPT-5)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(release): make source archives reproducible [paimon-cpp]

["SteNicholas (via GitHub)" <gi...@apache.org>]

SteNicholas merged PR #177:
URL: https://github.com/apache/paimon-cpp/pull/177


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org