Hi Xinyu, What is the jdk version you used to build the RCs?
Extracted the jars and then compared the class file. However, the class files are different. I probably need to use the exact jdk to reproduce the binaries. % from the bin tarball MD5 (/Users/szetszwo/ratis/release/3.2.2/rc3/apache-ratis-3.2.2-bin/tmp/jars/ratis-common-3.2.2/org/apache/ratis/conf/RaftProperties.class) = faf62bea5c84206da70dfa626b03b004 % generated locally using make_rc.sh MD5 (jars/ratis-common-3.2.2/org/apache/ratis/conf/RaftProperties.class) = 7a35e5b500c4cf6283ce705f4bbf31a3 Tsz-Wo On Thu, Mar 26, 2026 at 8:16 PM Tsz Wo Sze <[email protected]> wrote: > I am verifying the rc3. > > Question: How to verify if the binary is reproducible? > - I rebuilt the tarball. However, the resulting binary was different > since my generated jars were signed by my signatures. > - Also tried the diffoscope tool recommended by [1] but it showed a lot of > difference (due to the signatures?). > > Tsz-Wo > [1] https://reproducible-builds.org/tools/ > > On Sun, Mar 22, 2026 at 2:12 AM Attila Doroszlai <[email protected]> > wrote: > >> > I’m calling a vote for Apache Ratis Release 3.2.2 rc3. >> > https://github.com/apache/ratis/tree/ratis-3.2.2-rc3 >> > https://dist.apache.org/repos/dist/dev/ratis/3.2.2/rc3 >> > https://repository.apache.org/content/repositories/orgapacheratis-1178 >> >> +1 >> >> - Verified checksums, signatures, git hash >> - Compared source tarball contents to git repo >> - Built from source >> - Ozone CI mostly passed (except a single test) with staged Maven >> artifacts >> >> Thanks Xinyu for the RC (and fixing issues with previous RCs). >> >> -Attila >> >
