You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@asyncband.apache.org by "tisonkun (via GitHub)" <gi...@apache.org> on 2026/09/15 12:14:23 UTC
[PR] ci: add a signed source release workflow for ATR [asyncband]
tisonkun opened a new pull request, #319:
URL: https://github.com/apache/asyncband/pull/319
## Summary
Add `release-compose.yml` to build a source release from a reviewed commit, generate its SHA-512 checksum, sign it with the ASF project key, and upload the three release files through [apache/tooling-actions/upload-to-atr](https://github.com/apache/tooling-actions/blob/fa721a0b176d713807b574da721b96545b587eea/upload-to-atr/README.md).
Manual runs take a full `candidate` commit SHA and a `dry_run` boolean, which defaults to `true`. Pull requests changing this workflow or `.asf.yaml` also run the unsigned reproducibility checks. The final package version is read from the candidate's manifest and used as the ATR version.
## Design Notes
- Linux and macOS independently archive the same commit and compare the complete archive, checksum, and commit record. Git archive permissions and gzip metadata are fixed; both use Python 3.12's gzip implementation because system gzip produced different compressed bytes in local testing.
- A separate signing job imports `GPG_SECRET_KEY` into a temporary keyring, signs the verified archive, checks the expected fingerprint, and removes the keyring. It executes no candidate code and has no OIDC permission.
- Only the upload job has `id-token: write`. It downloads the exact signed artifact by ID and uploads `.tar.gz`, `.tar.gz.asc`, and `.tar.gz.sha512`. The workflow uses read-only repository permission and runs signing/upload only for manual, non-dry-run executions on `apache/asyncband` main.
- `.asf.yaml` trusts only this compose workflow on main. Retry an upload failure using the existing signed artifact after checking ATR's state; the workflow does not start votes or finish releases.
For the [ASF Trusted Publishing setup](https://releases.apache.org/docs/trusted-publishing#how-to-set-up-trusted-publishing), request reproducibility confirmation and an automated signing key with a UID such as `Asyncband Automated Release Signing <pr...@asyncband.apache.org>`. Configure:
- Repository secret `GPG_SECRET_KEY`: the ASCII-armored private key, provisioned by ASF Infrastructure.
- Repository variable `SOURCE_SIGNING_FINGERPRINT`: the full uppercase primary-key fingerprint.
- Optional secret `GPG_PASSPHRASE`: the passphrase if the supplied key is protected.
Publish the public key through the existing project `KEYS` management and confirm ATR imports it and applies the compose policy. The unsigned PR checks and manual dry-run can provide evidence before the key is provisioned.
Validation: local macOS/Linux archives match byte-for-byte; encrypted temporary-key signing, signature/checksum verification, wrong-fingerprint rejection, candidate ancestry/ref checks, differing-archive rejection, and partial-rerun artifact comparison pass. `actionlint`, the ASF action allowlist and project schema, `cargo x lint`, and `git diff --check` pass. Actual ATR upload awaits the project signing key and live trust configuration.
Related to #303.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For additional commands, e-mail: commits-help@asyncband.apache.org
Re: [PR] ci: compose signed source releases from RC tags [asyncband]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #319:
URL: https://github.com/apache/asyncband/pull/319#discussion_r4047983113
##########
.github/workflows/release-compose.yml:
##########
@@ -0,0 +1,145 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Compose source release
+
+on:
+ push:
+ tags: [ "v*.*.*-rc.*" ]
+ pull_request:
+ paths:
+ - .github/workflows/release-compose.yml
+ - .asf.yaml
+
+permissions:
+ contents: read
+ id-token: write
+
+defaults:
+ run:
+ shell: bash
+
+env:
+ LC_ALL: C
+
+concurrency:
+ group: source-release-${{ github.event_name == 'pull_request' && github.event.number || 'compose' }}
+ cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+ compose:
+ name: Compose source release
+ runs-on: ubuntu-24.04
Review Comment:
I would run it in the `release` environment, which forces a review from @jbonofre, @Xuanwo, @PragmaTwice or you to sign on the release:
```suggestion
runs-on: ubuntu-24.04
environment:
name: release
url: https://releases.apache.org/projects/asyncband
```
##########
.github/workflows/release-compose.yml:
##########
@@ -0,0 +1,145 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Compose source release
+
+on:
+ push:
+ tags: [ "v*.*.*-rc.*" ]
+ pull_request:
+ paths:
+ - .github/workflows/release-compose.yml
+ - .asf.yaml
+
+permissions:
+ contents: read
+ id-token: write
+
+defaults:
+ run:
+ shell: bash
+
+env:
+ LC_ALL: C
+
+concurrency:
+ group: source-release-${{ github.event_name == 'pull_request' && github.event.number || 'compose' }}
+ cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+ compose:
+ name: Compose source release
+ runs-on: ubuntu-24.04
+ timeout-minutes: 10
+ steps:
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ fetch-depth: 0
+ persist-credentials: false
+ - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+ with:
+ python-version: "3.12"
+ - id: source
+ name: Archive the release candidate
+ run: |
+ set -euo pipefail
+ commit="$(git rev-parse HEAD)"
+ package_version="$(git show "${commit}:asyncband/Cargo.toml" | python3 -c 'import sys, tomllib; print(tomllib.loads(sys.stdin.read())["package"]["version"])')"
+ if [[ "${GITHUB_EVENT_NAME}" == push ]]; then
+ if [[ ! "${GITHUB_REF_NAME}" =~ ^v([0-9]+\.[0-9]+\.[0-9]+)-rc\.([1-9][0-9]*)$ ]]; then
+ echo "::error::Expected an RC tag named vX.Y.Z-rc.N with a positive RC number."
+ exit 1
+ fi
+ version="${BASH_REMATCH[1]}"
+ if [[ "${version}" != "${package_version}" ]]; then
+ echo "::error::Tag ${GITHUB_REF_NAME} does not match package version ${package_version}."
+ exit 1
+ fi
+ test "$(git rev-parse "${GITHUB_REF}^{commit}")" = "${commit}"
+ git merge-base --is-ancestor "${commit}" origin/main
+ else
+ version="${package_version}"
+ fi
+ if [[ ! "${version}" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+ echo "::error::The package must have a stable X.Y.Z version."
+ exit 1
+ fi
+ source="apache-asyncband-${version}-incubating-src"
+ mkdir "${RUNNER_TEMP}/source"
+ git -c core.attributesFile=/dev/null -c tar.umask=0022 archive \
+ --format=tar --prefix="${source}/" "${commit}" \
+ | gzip -n -9 > "${RUNNER_TEMP}/source/${source}.tar.gz"
+ cd "${RUNNER_TEMP}/source"
+ shasum -a 512 "${source}.tar.gz" > "${source}.tar.gz.sha512"
+ echo "commit=${commit}" >> "${GITHUB_OUTPUT}"
+ echo "version=${version}" >> "${GITHUB_OUTPUT}"
+ echo "archive=${source}.tar.gz" >> "${GITHUB_OUTPUT}"
+ {
+ echo "Source ref: ${GITHUB_REF}"
+ echo "Source commit: ${commit}"
+ echo
+ cat "${source}.tar.gz.sha512"
+ } >> "${GITHUB_STEP_SUMMARY}"
+ - id: sign
+ name: Sign with the ASF project key
+ if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'apache/asyncband' }}
+ env:
+ ARCHIVE: ${{ steps.source.outputs.archive }}
+ SIGNING_KEY: ${{ secrets.GPG_SECRET_KEY }}
+ SIGNING_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+ SIGNING_FINGERPRINT: ${{ vars.SOURCE_SIGNING_FINGERPRINT }}
Review Comment:
[`crazy-max/ghaction-import-gpg`](https://github.com/crazy-max/ghaction-import-gpg), which is allowlisted by the ASF, might be an easier way to ensure that the key isn't left on the (ephemeral) GitHub runner VM.
##########
.github/workflows/release-compose.yml:
##########
@@ -0,0 +1,145 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Compose source release
+
+on:
+ push:
+ tags: [ "v*.*.*-rc.*" ]
+ pull_request:
+ paths:
+ - .github/workflows/release-compose.yml
+ - .asf.yaml
Review Comment:
Why is this also triggered by `pull_request`? Or is this temporary just to test this workflow?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For additional commands, e-mail: commits-help@asyncband.apache.org
Re: [PR] ci: compose signed source releases from RC tags [asyncband]
Posted by "tisonkun (via GitHub)" <gi...@apache.org>.
tisonkun commented on code in PR #319:
URL: https://github.com/apache/asyncband/pull/319#discussion_r4048053361
##########
.github/workflows/release-compose.yml:
##########
@@ -0,0 +1,145 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Compose source release
+
+on:
+ push:
+ tags: [ "v*.*.*-rc.*" ]
+ pull_request:
+ paths:
+ - .github/workflows/release-compose.yml
+ - .asf.yaml
+
+permissions:
+ contents: read
+ id-token: write
+
+defaults:
+ run:
+ shell: bash
+
+env:
+ LC_ALL: C
+
+concurrency:
+ group: source-release-${{ github.event_name == 'pull_request' && github.event.number || 'compose' }}
+ cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+ compose:
+ name: Compose source release
+ runs-on: ubuntu-24.04
+ timeout-minutes: 10
+ steps:
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ fetch-depth: 0
+ persist-credentials: false
+ - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+ with:
+ python-version: "3.12"
+ - id: source
+ name: Archive the release candidate
+ run: |
+ set -euo pipefail
+ commit="$(git rev-parse HEAD)"
+ package_version="$(git show "${commit}:asyncband/Cargo.toml" | python3 -c 'import sys, tomllib; print(tomllib.loads(sys.stdin.read())["package"]["version"])')"
+ if [[ "${GITHUB_EVENT_NAME}" == push ]]; then
+ if [[ ! "${GITHUB_REF_NAME}" =~ ^v([0-9]+\.[0-9]+\.[0-9]+)-rc\.([1-9][0-9]*)$ ]]; then
+ echo "::error::Expected an RC tag named vX.Y.Z-rc.N with a positive RC number."
+ exit 1
+ fi
+ version="${BASH_REMATCH[1]}"
+ if [[ "${version}" != "${package_version}" ]]; then
+ echo "::error::Tag ${GITHUB_REF_NAME} does not match package version ${package_version}."
+ exit 1
+ fi
+ test "$(git rev-parse "${GITHUB_REF}^{commit}")" = "${commit}"
+ git merge-base --is-ancestor "${commit}" origin/main
+ else
+ version="${package_version}"
+ fi
+ if [[ ! "${version}" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+ echo "::error::The package must have a stable X.Y.Z version."
+ exit 1
+ fi
+ source="apache-asyncband-${version}-incubating-src"
+ mkdir "${RUNNER_TEMP}/source"
+ git -c core.attributesFile=/dev/null -c tar.umask=0022 archive \
+ --format=tar --prefix="${source}/" "${commit}" \
+ | gzip -n -9 > "${RUNNER_TEMP}/source/${source}.tar.gz"
+ cd "${RUNNER_TEMP}/source"
+ shasum -a 512 "${source}.tar.gz" > "${source}.tar.gz.sha512"
+ echo "commit=${commit}" >> "${GITHUB_OUTPUT}"
+ echo "version=${version}" >> "${GITHUB_OUTPUT}"
+ echo "archive=${source}.tar.gz" >> "${GITHUB_OUTPUT}"
+ {
+ echo "Source ref: ${GITHUB_REF}"
+ echo "Source commit: ${commit}"
+ echo
+ cat "${source}.tar.gz.sha512"
+ } >> "${GITHUB_STEP_SUMMARY}"
+ - id: sign
+ name: Sign with the ASF project key
+ if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'apache/asyncband' }}
+ env:
+ ARCHIVE: ${{ steps.source.outputs.archive }}
+ SIGNING_KEY: ${{ secrets.GPG_SECRET_KEY }}
+ SIGNING_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+ SIGNING_FINGERPRINT: ${{ vars.SOURCE_SIGNING_FINGERPRINT }}
Review Comment:
OK. Let me integrate it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For additional commands, e-mail: commits-help@asyncband.apache.org
Re: [PR] ci: compose signed source releases from RC tags [asyncband]
Posted by "tisonkun (via GitHub)" <gi...@apache.org>.
tisonkun merged PR #319:
URL: https://github.com/apache/asyncband/pull/319
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For additional commands, e-mail: commits-help@asyncband.apache.org
Re: [PR] ci: compose signed source releases from RC tags [asyncband]
Posted by "tisonkun (via GitHub)" <gi...@apache.org>.
tisonkun commented on code in PR #319:
URL: https://github.com/apache/asyncband/pull/319#discussion_r4048056120
##########
.github/workflows/release-compose.yml:
##########
@@ -0,0 +1,145 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Compose source release
+
+on:
+ push:
+ tags: [ "v*.*.*-rc.*" ]
+ pull_request:
+ paths:
+ - .github/workflows/release-compose.yml
+ - .asf.yaml
+
+permissions:
+ contents: read
+ id-token: write
+
+defaults:
+ run:
+ shell: bash
+
+env:
+ LC_ALL: C
+
+concurrency:
+ group: source-release-${{ github.event_name == 'pull_request' && github.event.number || 'compose' }}
+ cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+ compose:
+ name: Compose source release
+ runs-on: ubuntu-24.04
Review Comment:
Sounds good. Let me try to integrate this idea.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For additional commands, e-mail: commits-help@asyncband.apache.org
Re: [PR] ci: compose signed source releases from RC tags [asyncband]
Posted by "tisonkun (via GitHub)" <gi...@apache.org>.
tisonkun commented on PR #319:
URL: https://github.com/apache/asyncband/pull/319#issuecomment-5732123507
> You can split the workflow into a compose job and a sign-and-upload job. The first job would not require privileges. You can even generate a build attestation for the first job and upload it in the second.
This is possible. I merge the previous three jobs into one in https://github.com/apache/asyncband/pull/319/changes/db215e72b6f085fb48083a554b953989167d50a7 because I'd prefer to avoid upload/download-artifacts back and forth. But limiting privileges can be a good argument for splitting jobs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For additional commands, e-mail: commits-help@asyncband.apache.org
Re: [PR] ci: compose signed source releases from RC tags [asyncband]
Posted by "tisonkun (via GitHub)" <gi...@apache.org>.
tisonkun commented on PR #319:
URL: https://github.com/apache/asyncband/pull/319#issuecomment-5715729403
INFRA ticket link - https://issues.apache.org/jira/browse/INFRA-28407
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For additional commands, e-mail: commits-help@asyncband.apache.org
Re: [PR] ci: compose signed source releases from RC tags [asyncband]
Posted by "tisonkun (via GitHub)" <gi...@apache.org>.
tisonkun commented on code in PR #319:
URL: https://github.com/apache/asyncband/pull/319#discussion_r4048047568
##########
.github/workflows/release-compose.yml:
##########
@@ -0,0 +1,145 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Compose source release
+
+on:
+ push:
+ tags: [ "v*.*.*-rc.*" ]
+ pull_request:
+ paths:
+ - .github/workflows/release-compose.yml
+ - .asf.yaml
Review Comment:
This tests the packaging steps work well and it would not upload anything.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For additional commands, e-mail: commits-help@asyncband.apache.org
Re: [PR] ci: compose signed source releases from RC tags [asyncband]
Posted by "tisonkun (via GitHub)" <gi...@apache.org>.
tisonkun commented on PR #319:
URL: https://github.com/apache/asyncband/pull/319#issuecomment-5732359433
@ppkarwasz Your comments are address. PTAL.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@asyncband.apache.org
For additional commands, e-mail: commits-help@asyncband.apache.org