parshimers commented on issue #8800: URL: https://github.com/apache/texera/issues/8800#issuecomment-6065243279
This is kind of a diversion from this topic, so we should probably take it to the main discussion, but I will diverge here: Yes, I think the missing piece is the docker images. The helm charts refer to these and aren't really useful without them. They are part of the release, effectively. The relevant quote from the release signing document: > The release process contains a validation step where all artifacts are reproduced and validated on [trusted hardware](https://www.apache.org/legal/release-policy.html#owned-controlled-hardware) (i.e. not GitHub Actions) before publication to pages intended for end users. This means rebuilding the artifacts from source and validating the resulting artifacts are bit-by-bit identical to those staged for release. https://www.apache.org/legal/release-policy.html#owned-controlled-hardware is also worth a read. The point is that you need to be able to verify (in the cryptographic sense) what you are releasing is actually a product of the source, and doesn't contain anything else. You can't be sure about that with something that was built on hardware you don't fully control. The only caveat to this, is if you can build a bit-for-bit identical version of that something locally from the same source. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
