All,
I've been thinking about further increasing the automation we use the
build releases. There are various drivers for this including:
- potentially more frequent releases (in response to the volume of AI
security issues)
- easier for any committer to roll a release (no need to set up eSigner
access)
- reduced cost (each additional eSigner user costs the ASF $39/month)
I believe all the components we would need to build releases via a
GitHub action are in place.
With reproducible builds, we can fully validate that the binaries built
by automation are not subverted.
If there is general agreement to head in this direction, my thinking was
that we could work out a high-level plan between now and CoC Glasgow and
then work on this in the hackathon.
Thoughts?
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
