sbp commented on issue #751: URL: https://github.com/apache/tooling-trusted-releases/issues/751#issuecomment-4719701380
From #1264: > I resolved the merge errors, but I am questioning the need for this, at least at present. This PR is a solution to the following requirement that I wrote in the original post of #751: > > > We have to check that the files being promoted are the same as those that were voted on. > > The solution in this PR is to check that there has been no intervening revision, but as @alitheg pointed out, that cannot ever work because we _always_ create a new revision after voting. There can also be subsequent revisions later in the finish phase. > > We have three sets of files: 1. the staged third party distribution artifacts, 2. the artifacts in the vote revision on ATR, 3. the production release third party distribution artifacts. We'd like to know that all of these are the same. If they're not the same they _might_ still be secure, but we can't guarantee it through ATR. To know whether the files are the same, we need the hashes of the files. Some platforms make hashes available in metadata files, so a first step would be to figure out which ones make those available. Then we would need to figure out a workflow for this, because we need to know where we would perform this check. We also need to figure out what we want the results of the check to be. > > Overall, though, I don't think that we should be working on this feature before we even have remote promotion implemented. That's the core, MVP of #751: allowing a user on ATR to press a button to promote an artifact remotely, if possible. The big questions are what platforms support this, which we've already investigated, and what credentials are required. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
