GitHub user mengw15 added a comment to the discussion: Build reproducibility for automated release signing
Results from my side (Apple Silicon host; BuildKit v0.33.1, GNU tar 1.35). Commit `9ac8c5d5a`, `SOURCE_DATE_EPOCH=1791491650` (commit time), `PACKAGE_SNAPSHOT=2026-10-08`, `--platform linux/amd64`, built exactly per `bin/README.md`: ``` bash .github/scripts/create-release-tarballs.sh 9ac8c5d5a4ef6389b546b344f0a91209f26a55f5 1.3.0-reprotest docker.io/apache 1.3.0-reprotest out docker buildx build --platform linux/amd64 \ --build-arg SOURCE_DATE_EPOCH --build-arg PACKAGE_SNAPSHOT=2026-10-08 \ --output type=oci,dest=<name>.tar,rewrite-timestamp=true \ -f bin/dockerfiles/<name>.dockerfile . ``` Everything is deterministic locally (tarballs and a re-built image byte-identical across repeat runs; jOOQ = 223 files, matching yours). Tarballs: ``` 486ecd7606ada49d8c57c6691832ef83228f5f332d5a033aa2e365489c21d77a4edd4b0b1c5e6df7475423be0fad1cca610a1b6ac5b885dd371dc6afe0f36d9a apache-texera-1.3.0-reprotest-src.tar.gz bdc5882b36675bd0df68c4deb45e7b97739de4ccdd8c88e293a8dfb9b7f50aea24aa7d55ab26b2c5a1d057e784d4721fcb53d96618ae3906048fef01edb397df apache-texera-1.3.0-reprotest-docker-compose.tar.gz ``` Images (two columns: config digest short12 — what `docker images` shows as IMAGE ID — and the OCI manifest digest): | image | config digest (short) | OCI manifest digest | | --- | --- | --- | | texera-access-control-service | `05f519e63c6d` | `sha256:d4cf48eff8fc5e0ef6acb0466f7772d775d18662554f018d478cbd538edcafe2` | | texera-agent-service | `cdceeaadc6a0` | `sha256:594d2ed6c185f052954512e065dc4eb6782e547fae980424d7fe47034d715447` | | texera-config-service | `ce07f59b66bf` | `sha256:bd01aa0a7be88814022d11071c680591301b545c70252e2ad8651f5c50ee5b97` | | texera-dashboard-service | `8e5bb792bd55` | `sha256:9833b3a6b21772adf6fcd2fe65491e46cd4ee2ffa014ea36703858d1fe734a5f` | | texera-file-service | `aafd59d22f8b` | `sha256:a0b089f5a68bfeb01c9dd7075eb93f3a47fd3301ad78798fab459c3fb8365b92` | | texera-jupyter | `6de48c14e4fb` | `sha256:31c86b04d1359798afa333656485a74981533cd99f7c9b5c4b3383d47664a9f2` | | texera-mounter | `45e96b51168b` | `sha256:4921af0332562cdc6a0e055fe7128dcad739f6eb584a7ef5ce118fe979ca4d3a` | | texera-notebook-migration-service | `8ea30e49d44f` | `sha256:f6754786bcccf79248b53cc92b930ae48cee9810fc41e91b6ed748475d0ed59b` | | texera-workflow-compiling-service | `c95f102428b0` | `sha256:82e39fc586957a6cf577d4eae2403cf8e2cf03053d063ebcb1fbb45b230947c9` | | texera-workflow-computing-unit-managing-service | `aa5de77eeff6` | `sha256:0eea7702ba7fa6961cc105417acdc10a25b9ccb587881924d50471aae6ccfcb2` | | texera-workflow-execution-coordinator | `3cc022d6097b` | `sha256:17301301784e0c3bbb9c716bca1c38733763b9630538288ea98f0388b4b7e09d` | | texera-workflow-execution-runner | `825520e0ba7a` | `sha256:dcac676ffc0d4824c709806f4a1c6a207dfd17a90be854fc4843d86984a3be77` | | y-websocket-server | `fd215376b08c` | `sha256:ef114c30309c8b0a97c40ae62fd65a4b03b7879c0817294590708817cd10713a` | None of these match your values in either column, so I suspect we built or hashed differently rather than hit real non-determinism. Could you share the exact command you ran and which kind of hash your values are? Then we can line the two sides up. GitHub link: https://github.com/apache/texera/discussions/8807#discussioncomment-18841659 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected]
