[GitHub] [airflow] mik-laj commented on issue #19569: The latest docker image is not the "latest"

[GitBox <gi...@apache.org>]

mik-laj commented on issue #19569:
URL: https://github.com/apache/airflow/issues/19569#issuecomment-967872440


   > Though I know airflow is quite a complex (and mature) project, I was thought the release process should be done by something like Github Actions.
   
   Yes. This applies to all Apache releases.
   
   > # MUST RELEASES BE BUILT ON HARDWARE OWNED AND CONTROLLED BY THE COMMITTER?
   > Strictly speaking, releases must be verified on hardware owned and controlled by the committer. That means hardware the committer has physical possession and control of and exclusively full administrative/superuser access to. That's because only such hardware is qualified to hold a PGP private key, and the release should be verified on the machine the private key lives on or on a machine as trusted as that.
   > 
   > Practically speaking, when a release consists of anything beyond an archive (e.g., tarball or zip file) of a source control tag, the only practical way to validate that archive is to build it locally; manually inspecting generated files (especially binary files) is not feasible. So, basically, "Yes".
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org