GitHub user parshimers added a comment to the discussion: Build reproducibility for automated release signing
I think this follows even for the docker images, or maybe especially for them. So, it isn't just constrained to the source tarball and compose files. Rather, it should be that you can produce absolutely everything from that source tarball. https://reproducible-builds.org/docs/jvm/ has some good reference regarding this. It seems sbt has some tooling available already. Another important thing, is that for release branches (and honestly I think for main as well), everything external that is depended on needs to be at a version. It can't be latest, a nightly, or a snapshot. However I'm less sure about NPM and the JS ecosystem in general. If someone with more expertise in that area could chime in about that, it would be appreciated. GitHub link: https://github.com/apache/texera/discussions/8807#discussioncomment-18703305 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected]
