zjw1111 opened a new pull request, #178: URL: https://github.com/apache/paimon-cpp/pull/178
### Purpose Backport of #177 to `release-0.3`. Make source release archives reproducible across macOS and Linux and ensure that the artifact tested by GitHub Actions is the exact artifact signed and staged by the release manager. The packaging flow previously allowed platform gzip implementations to produce different compressed bytes. This backport requires GNU gzip with fixed options, makes the workflow artifact canonical, downloads and signs those exact bytes, and verifies byte-for-byte reproducibility from the signed RC tag. The verifier also reuses an isolated KEYS keyring for both artifact and tag signatures, including unsigned CI artifacts. Focused tests cover gzip selection, inherited gzip options, signed-tag verification, and inherited Git signing configuration. ### Tests - `python3 -m unittest discover -s scripts/releasing/tests -v` - Signed-tag regression test with `commit.gpgSign=true` and `gpg.format=ssh` - `pre-commit run --files .github/workflows/release_candidate.yaml scripts/releasing/README.md scripts/releasing/create_source_release.sh scripts/releasing/release_rc.sh scripts/releasing/tests/test_release_tools.py scripts/releasing/verify_release_candidate.sh` - `bash -n scripts/releasing/create_source_release.sh scripts/releasing/release_rc.sh scripts/releasing/verify_release_candidate.sh` - `scripts/releasing/release_rc.sh --version 0.3.0 --rc 3 --signing-key TEST --remote upstream --release-branch release-0.3 --dry-run` - `git diff upstream/release-0.3..HEAD --check` ### API and Format No public API, storage format, or protocol changes. ### Documentation Updated the release documentation with the GNU gzip prerequisite and canonical workflow-artifact flow. ### Generative AI tooling Generated-by: OpenAI Codex (GPT-5) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
