[PR] fix(dev): make source release archives reproducible [opendal]

["Xuanwo (via GitHub)" <gi...@apache.org>]

Xuanwo opened a new pull request, #8232:
URL: https://github.com/apache/opendal/pull/8232

   # Which issue does this PR close?
   
   Related discussion: https://github.com/apache/opendal/discussions/8231
   
   # Rationale for this change
   
   Source archives currently inherit checkout timestamps, ownership and filesystem permissions. Identical source contents can therefore produce different `.tar.gz` bytes, preventing independent reproduction of release candidates.
   
   # What changes are included in this PR?
   
   Normalize tar metadata, sort paths, preserve Git executable bits and symbolic links, and explicitly finish compression before calculating checksums. Add unsigned packaging and a package inventory command for independent verification.
   
   The verification script rebuilds the complete source package set in two checkouts with different timestamps, permissions and timezones. The odev workflow runs it on Linux and macOS and compares their SHA-512 manifests. The release guide documents how to compare downloaded candidate archives with a trusted local rebuild.
   
   # Are there any user-facing changes?
   
   Source release archives have normalized metadata and different checksums. Their package contents and names are preserved. Reproduction requires the same source revision, Git file modes and locked packaging dependencies, with checkout line-ending conversion disabled.
   
   # AI Usage Statement
   
   AI assisted the implementation, regression tests and documentation. Local verification covers all source archives on macOS; the new CI comparison is needed to confirm Linux/macOS equivalence. This PR does not enable automated signing or change the release cadence.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@opendal.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] feat(release): reproduce source archives and prepare ATR candidates [opendal]

["Xuanwo (via GitHub)" <gi...@apache.org>]

Xuanwo merged PR #8232:
URL: https://github.com/apache/opendal/pull/8232


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@opendal.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org