On Wed, Oct 2, 2024 at 2:00 AM PJ Fanning <fannin...@apache.org> wrote: > https://dist.apache.org/repos/dist/dev/pekko/GRPC-1.1.0-RC1/ > https://github.com/apache/pekko-grpc/tree/v1.1.0-RC1 > Git commit ID: a3b8987aa5d26f243dc240a204738be8f25dd382 > [x] Download links are valid. > [x] Checksums and signatures. > [x] LICENSE/NOTICE files exist > [x] No unexpected binary files > [x] All source files have ASF headers > [x] Can compile from source > [ ] Can verify the binary build > > To verify the binary build, please refer to: > > https://github.com/apache/pekko-site/wiki/Pekko-Release-Process#verifying-the-binary-build
Checking reproducibility is made more difficult because of multiple jars in the scalapb-protoc-plugin and codegen subprojects, crossPaths=false for the maven and gradle plugins, and the sbt plugin. The runtime artifacts successfully reproduced, and I have manually reproduced the codegen, maven-plugin, sbt-plugin and scalapb-protoc-plugin jars. I did not manage to verify the gradle plugin. the codegen-assembly jar does not appear to be published. The 2.13 scalapb-protoc-plugin-assembly has minor unreproducibilities (looks like timestamps). Filed issues #376 through #379. I have not tested the artifacts in any project. This is my +1 -- Arnout Engelen ASF Security Response Apache Pekko PMC member, ASF Member NixOS Committer Independent Open Source consultant --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@pekko.apache.org For additional commands, e-mail: dev-h...@pekko.apache.org
