dave2wave commented on PR #37: URL: https://github.com/apache/tooling-actions/pull/37#issuecomment-5744818410
You need to listen to what I'm describing as checks that are **already** in ATR's compose phase. 1. Source releases must have no files that do not match the files in the repository. Nothing unexpected is injected. 2. Source releases must have no binaries / compiled code. The source repository may have binaries / compiled code. 3. Source releases are not required to match the whole of the repository. This PR is making an assumption which is incorrect. We allow CI if the release has reproducible builds. Builds are by definition convenience binaries. The agreement is that PMC members do their own builds. SWHID is a way to compare without having bit by bit comparison. Instructions on how to perform these tests are the responsibility of the PMC. Let's wait until Monday for further discussion after we survey what PMCs that are enabled to do reproducible build are actually doing. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
