zjw1111 opened a new pull request, #177: URL: https://github.com/apache/paimon-cpp/pull/177
### Purpose Linked issue: N/A Make source release archives reproducible across macOS and Linux and ensure that the artifact tested by GitHub Actions is the exact artifact signed and staged by the release manager. The previous packaging flow allowed platform gzip implementations to produce different compressed bytes. It also created the release-manager artifact separately from the workflow artifact. This change requires GNU gzip with fixed options, makes the workflow artifact canonical, downloads and signs those exact bytes, and verifies byte-for-byte reproducibility from the signed RC tag. The verifier now reuses an isolated KEYS keyring for both artifact and tag signatures, including unsigned CI artifacts. Focused tests cover gzip selection, inherited gzip options, signed-tag verification, and inherited Git signing configuration. ### Tests - `python3 -m unittest discover -s scripts/releasing/tests -v` - Signed-tag regression test with `commit.gpgSign=true` and `gpg.format=ssh` - `pre-commit run --files .github/workflows/release_candidate.yaml scripts/releasing/README.md scripts/releasing/create_source_release.sh scripts/releasing/release_rc.sh scripts/releasing/tests/test_release_tools.py scripts/releasing/verify_release_candidate.sh` - `bash -n scripts/releasing/create_source_release.sh scripts/releasing/release_rc.sh scripts/releasing/verify_release_candidate.sh` - `scripts/releasing/release_rc.sh --version 0.4.0 --rc 1 --signing-key TEST --remote upstream --dry-run` - `git diff --check` ### API and Format No public API, storage format, or protocol changes. ### Documentation Updated the release documentation with the GNU gzip prerequisite and canonical workflow-artifact flow. ### Generative AI tooling Generated-by: OpenAI Codex (GPT-5) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
