GitHub user mengw15 added a comment to the discussion: Build reproducibility for automated release signing
Thanks Ian, good point on the images.. Two questions: 1. For the signing precondition, is it enough that the artifacts we actually sign and vote on — the source tarball and the compose bundle — are bit-reproducible? They reference images but don't contain them, and the images are convenience binaries outside the signed set. 2. Who decides that for us? Is it something you or the IPMC would weigh in on, or does it get settled when we write to security@ for the CI signing key? GitHub link: https://github.com/apache/texera/discussions/8807#discussioncomment-18703886 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected]
