Conversation
| cargo x --help | ||
| cargo x source --help |
There was a problem hiding this comment.
This should not exist in the shell script? They seem to be information query, rather than the one that would be executed.
| gpg --armor --detach-sign --local-user "${ASF_GPG_FINGERPRINT}" \ | ||
| "${SOURCE_DIR}.tar.gz" |
There was a problem hiding this comment.
I suppose we should let cargo x source do the signing job as well? Or else we may not need a cargo x source command.
You may please read the output of agent.
| pull_request: | ||
| paths: | ||
| - .github/workflows/source.yml | ||
| - xtask/** | ||
| - Cargo.toml | ||
| - Cargo.lock | ||
| - .agents/skills/release/** | ||
| workflow_dispatch: | ||
| inputs: | ||
| sign: | ||
| description: Sign with the Infra-managed key (requires ASF Security approval) | ||
| type: boolean | ||
| default: false |
There was a problem hiding this comment.
Who would trigger the workflow_dispatch event?
There was a problem hiding this comment.
I suppose we may leverage some ATR actions to just upload the package files there.
| cargo x --help | ||
| cargo x source --help |
There was a problem hiding this comment.
Ditto. --help should not be included in the exuecting script.
| // Git owns the committed file inventory, modes, symlinks, and timestamps. | ||
| let mut archive = find_command("git"); | ||
| archive | ||
| .args(["-c", "tar.umask=0022", "archive", "--format=tar"]) |
There was a problem hiding this comment.
As we use git already, having something like git archive --format=tar.gz would package tar.gz without introducing the large flate2 dependency.
tisonkun
left a comment
tisonkun
left a comment
There was a problem hiding this comment.
Let's just drop cargo x source and use shell commands.
I found Rust is very weak in this area.
2 participants
Summary
Prepare Asyncband's source-signing workflow for an ASF Infra-managed
GPG_SECRET_KEYrequest and ASF Security review, following the automated release signing procedure. Related to #303.A single trusted job packages the committed source with
git archive --format=tar.gz -9, writes its SHA-512 checksum withshasum, and optionally signs and verifies the archive with GPG. PRs and default manual runs produce unsigned artifacts. After provisioning, the release manager manually runs Source candidate onapache/asyncband'smainbranch with sign enabled and downloads thesigned-sourceGitHub Actions artifact. ATR upload is a follow-up integration; this workflow does not stage candidates, start votes, create tags, or publish releases.The release instructions require independent byte-for-byte reproduction with Git and
cmpon trusted hardware against the actual staged archive before publication. Before signing is enabled, ASF Security must approve the workflow, Infra must installGPG_SECRET_KEY, and the public key andSOURCE_SIGNING_FINGERPRINTmust be configured. The signing command expects an empty passphrase on the Infra-managed key.Reproducibility evidence
Verified commit
6a6e8901215c2ea82326ed44104f3277ff832482. The archive downloaded from Source candidate run 34992337603 on Ubuntu 24.04 (Git 2.55.0) matches the archive independently reproduced from a fresh checkout on macOS Apple Silicon (Apple Git 2.54.0). The documented reproduction commands passed against the downloaded CI archive, includingcmp.SHA-512 of
apache-asyncband-0.7.2-incubating-src.tar.gz:The shell checks rejected tracked edits, output-directory reuse, and a modified downloaded archive. Production signing remains untested until Infra provisions the key. Each future candidate still requires independent reproduction against its actual staged bytes.