This is an automated email from the ASF dual-hosted git repository. Cole-Greer pushed a commit to branch reproducible-build in repository https://gitbox.apache.org/repos/asf/tinkerpop.git
commit d78d25356c28faa9ebae167097a261e1aa2d3d2b Author: Cole Greer <[email protected]> AuthorDate: Tue Jul 21 15:57:08 2026 -0700 Document reproducible-build validation in changelog and release docs --- CHANGELOG.asciidoc | 2 ++ docs/src/dev/developer/release.asciidoc | 16 ++++++++++++++++ 2 files changed, 18 insertions(+) diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc index 5e54133fcc..9da08693e8 100644 --- a/CHANGELOG.asciidoc +++ b/CHANGELOG.asciidoc @@ -32,6 +32,8 @@ image::https://raw.githubusercontent.com/apache/tinkerpop/master/docs/static/ima * Fixed conjoin has incorrect null handling. * Expanded `gremlin-python` CI matrix to test against Python 3.9, 3.10, 3.11, 3.12, and 3.13. * Add Node 26 support for `gremlin-javascript` and `gremlint`. +* Enabled reproducible builds by setting `project.build.outputTimestamp`, allowing release distributions to be rebuilt bit-for-bit from a tagged commit. +* Added `bin/reproduce-distribution.sh` to independently validate published release artifacts against a clean rebuild from source in a pinned Docker toolchain. [[release-3-7-6]] === TinkerPop 3.7.6 (Release Date: April 1, 2026) diff --git a/docs/src/dev/developer/release.asciidoc b/docs/src/dev/developer/release.asciidoc index f6374fda9a..45fb1b69a2 100644 --- a/docs/src/dev/developer/release.asciidoc +++ b/docs/src/dev/developer/release.asciidoc @@ -247,6 +247,22 @@ for generating javadoc. . Submit for `[VOTE]` at `[email protected]` (see email template below) . *Wait for vote acceptance* (72 hours) +=== Reproducible Build Validation + +After a release is published, maintainers on trusted hardware can independently verify that the binary distributions +match a clean rebuild from the tagged source: + +[source,bash] +---- +bin/reproduce-distribution.sh xx.yy.zz +---- + +This script builds from the tag inside a pinned Docker container (Eclipse Temurin JDK 11 + Maven 3.9.6) and compares +the resulting distribution artifacts entry-by-entry against those published on `dist.apache.org`. It establishes trust +independently of the release manager's own checksums and signatures. + +NOTE: Docker must be installed and running to use this script. + == Release & Promote NOTE: Certain steps can only be performed by a PMC member. If you are a committer, please enlist
