This is an automated email from the ASF dual-hosted git repository. Cole-Greer pushed a commit to branch reproducible-build in repository https://gitbox.apache.org/repos/asf/tinkerpop.git
commit e40b3b44839031eefc452d15a334906e2934b11d Author: Cole Greer <[email protected]> AuthorDate: Thu Jul 23 10:34:04 2026 -0700 Skip GPG signing when reproducing so validation needs no signing key --- bin/reproduce-distribution.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/bin/reproduce-distribution.sh b/bin/reproduce-distribution.sh index ddd24f1458..65488c16a3 100755 --- a/bin/reproduce-distribution.sh +++ b/bin/reproduce-distribution.sh @@ -372,12 +372,16 @@ echo " OK" BUILD_LOG="${WORK_DIR}/mvn-build.log" info "building from source inside Docker (this may take a while) ..." +# -Papache-release is retained because it activates the source-release assembly that produces the +# src zip we compare. GPG signing is skipped (-Dgpg.skip=true) because signatures are detached +# .asc files that are not part of the compared artifacts and would otherwise require the release +# manager's private signing key, which a validator must not need. docker run --rm \ -v "${SOURCE_DIR}:/build:rw" \ -v "${WORK_DIR}/m2-repo:/root/.m2/repository:rw" \ -w /build \ "$DOCKER_TAG" \ - mvn clean install -Papache-release -DskipTests -DskipImageBuild \ + mvn clean install -Papache-release -DskipTests -DskipImageBuild -Dgpg.skip=true \ > "$BUILD_LOG" 2>&1 || { echo " FAILED (see ${BUILD_LOG})" echo ""
