[
https://issues.apache.org/jira/browse/RATIS-2639?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18101512#comment-18101512
]
Tsz-wo Sze commented on RATIS-2639:
-----------------------------------
[~adoroszlai], Although we can use reproducible-central or other tools to
reproduce some binary, such binary is not our release binary.
For verifying a release, I believe we should try to reproduce the exact binary.
Then, it shows the rc is good. Otherwise, a malicious release manager could
inject malware to an rc. Then, users can download and run the malware from an
official release.
Therefore, I believe we should provide a procedure to reproduce the exact rc
binary. It would be great if we could change make_rc.sh to run the entire
procedure (or at least some steps). What do you think?
> Make release .tar.gz files reproducible.
> ----------------------------------------
>
> Key: RATIS-2639
> URL: https://issues.apache.org/jira/browse/RATIS-2639
> Project: Ratis
> Issue Type: Improvement
> Components: build
> Reporter: Tsz-wo Sze
> Priority: Major
> Attachments: image-2026-08-03-11-26-40-659.png
>
>
> Currently, the [src|bin].tar.gz files generated by ./dev-support/make_rc.sh
> are not reproducible. According to Google, it is due to file ordering and
> metadata such user id. These problem can be fixed; see below:
> !image-2026-08-03-11-26-40-659.png|width=600!
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
