I am verifying the rc3. Question: How to verify if the binary is reproducible? - I rebuilt the tarball. However, the resulting binary was different since my generated jars were signed by my signatures. - Also tried the diffoscope tool recommended by [1] but it showed a lot of difference (due to the signatures?).
Tsz-Wo [1] https://reproducible-builds.org/tools/ On Sun, Mar 22, 2026 at 2:12 AM Attila Doroszlai <[email protected]> wrote: > > I’m calling a vote for Apache Ratis Release 3.2.2 rc3. > > https://github.com/apache/ratis/tree/ratis-3.2.2-rc3 > > https://dist.apache.org/repos/dist/dev/ratis/3.2.2/rc3 > > https://repository.apache.org/content/repositories/orgapacheratis-1178 > > +1 > > - Verified checksums, signatures, git hash > - Compared source tarball contents to git repo > - Built from source > - Ozone CI mostly passed (except a single test) with staged Maven artifacts > > Thanks Xinyu for the RC (and fixing issues with previous RCs). > > -Attila >
