GitHub user parshimers added a comment to the discussion: Build reproducibility for automated release signing
I suppose it all lies in how you interpret this, from the automated signing documentation: > The release process contains a validation step where all artifacts are > reproduced and validated on [trusted > hardware](https://www.apache.org/legal/release-policy.html#owned-controlled-hardware) > (i.e. not GitHub Actions) before publication to pages intended for end > users. This means rebuilding the artifacts from source and validating the > resulting artifacts are bit-by-bit identical to those staged for release. The way I interpret that is: Whatever is released, signed or not, has to be bit-for-bit reproducible if you want to release it through hardware that isn't owned by you, personally, as a committer. Otherwise there's no way to tell if something has been done to the artifact to compromise it on this hardware that you don't have full control over. GitHub link: https://github.com/apache/texera/discussions/8807#discussioncomment-18705230 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected]
