potiuk commented on PR #37: URL: https://github.com/apache/tooling-actions/pull/37#issuecomment-5740911960
> Yes, binaries are out-of-scope, because they are ecosystem-specific. Agreed, Let's do it gradually and once we get sources figured out, we can do next steps for binaries. There is no need to solve **all** of that - there are projects (like Magpie) which only release source packages. Step-by-step. I think also if we make the bash script into a portable python script with it's own tests and pyproject toml, this adds the necessary step for local verification. I think creating reproducible sources solves only **one** part of the reproducibility - part of the reproducibility check is that PMC members prepare the same source packafe locally - from the same commit and see if it's binary identical to the one in ATR. If you extract the "preparation" script into a portable python project runnable with `uv run` or `hatch run` or any other way people run Python projects in portable way recently, we could also have a separate script to download the ATR binary, build one locally and compare - in purely deterministic way. It could be a simple process described in the "release" instructions or it could be embedded in Magpie release / release-verify SKILL. Bash has this problem (and I've been bitten by it many times) - that MacOS by default has very, very, old version of bash - and it's readablity is **bad**. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
