Re: Create a GitHub action to build releases

On Mon, Aug 17, 2026 at 10:20 AM Mark Thomas <[email protected]> wrote:
>
>
>
> On 16/08/2026 18:05, Rémy Maucherat wrote:
> > On Sun, Aug 16, 2026 at 4:39 PM Mark Thomas <[email protected]> wrote:
> >>
> >> All,
> >>
> >> I've been thinking about further increasing the automation we use the
> >> build releases. There are various drivers for this including:
> >> - potentially more frequent releases (in response to the volume of AI
> >>     security issues)
> >> - easier for any committer to roll a release (no need to set up eSigner
> >>     access)
> >> - reduced cost (each additional eSigner user costs the ASF $39/month)
> >>
> >> I believe all the components we would need to build releases via a
> >> GitHub action are in place.
> >>
> >> With reproducible builds, we can fully validate that the binaries built
> >> by automation are not subverted.
> >>
> >> If there is general agreement to head in this direction, my thinking was
> >> that we could work out a high-level plan between now and CoC Glasgow and
> >> then work on this in the hackathon.
> >>
> >> Thoughts?
> >
> > I'm not sure, I thought the ASF wanted us to use their new tool
> > instead.
>
> Good point. Using a GitHub action was just an implementation detail. We
> could (should) look at what Apache Trusted Releases provides / will provide.
>
> > Also this would make us 100% dependent on GH ...
>
> That is certainly a concern. I wouldn't want us to be in that position.
> I've seen too many instances of either GitHub actions being down or
> (more often) one ASF project hogging all the runners for an extended
> period of time. It should be possible to construct this in such a way
> that it can run on a CI system or locally. That does mean we'd need
> access to valid ssl.com credentials (I'm confident that is a problem
> that can be solved) or - in extremis - we release with the Windows
> installer unsigned.
>
> What able the general idea of getting the releases to a point where we
> have the option to use automation to produce the releases and, in normal
> circumstances, use it?

I think it's great if you experiment, so +1. However, the thing I am
most worried about is a supply chain attack, and this probably makes
us more vulnerable to that, right ?

Rémy

> Mark
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>