Ok. The issue is MacOS vs. Linux. Symlinks in Linux have always lrwxrwxrwx permissions and you can't change them, on MacOS - you can, even if that change has no effect. And we are removing group/other permissions to account for different umask - and on MacOS that also changes permissions on symlinks (on Linux it does not). And we are preparing .tar.gz packages on host, not in container.
It's actually quite surprising how difficult it is to get full reproducibility :). Every few months we learn something new .... I will fix it before the next release :) J. On Tue, Aug 5, 2025 at 9:59 PM Jens Scheffler <j_scheff...@gmx.de.invalid> wrote: > Hi @Ash, @Jarek, > > this is what diffoscope tells me as diff - is the file-mask something I > can influence or have "messed-up" in my local git tree? > > (airflow) jscheffl@hp860g9:~/Workspace/airflow$ diffoscope > /home/jscheffl/Workspace/asf-dist/dev/airflow/3.0.4rc1/apache-airflow-3.0.4-source.tar.gz > > /home/jscheffl/Workspace/airflow/dist/apache-airflow-3.0.4-source.tar.gz > --- > > /home/jscheffl/Workspace/asf-dist/dev/airflow/3.0.4rc1/apache-airflow-3.0.4-source.tar.gz > +++ > /home/jscheffl/Workspace/airflow/dist/apache-airflow-3.0.4-source.tar.gz > ├── apache-airflow-3.0.4-source.tar > │ ├── file list > │ │ @@ -802,15 +802,15 @@ > │ │ -rw------- 0 root (0) root (0) 1556 > 2025-08-02 18:41:37.000000 > > apache-airflow-3.0.4/airflow-core/src/airflow/example_dags/plugins/decreasing_priority_weight_strategy.py > │ │ -rw------- 0 root (0) root (0) 5619 > 2025-08-02 18:41:37.000000 > > apache-airflow-3.0.4/airflow-core/src/airflow/example_dags/plugins/event_listener.py > │ │ -rw------- 0 root (0) root (0) 1048 > 2025-08-02 18:41:37.000000 > > apache-airflow-3.0.4/airflow-core/src/airflow/example_dags/plugins/listener_plugin.py > │ │ -rw------- 0 root (0) root (0) 4327 > 2025-08-02 18:41:37.000000 > > apache-airflow-3.0.4/airflow-core/src/airflow/example_dags/plugins/workday.py > │ │ drwx------ 0 root (0) root (0) 0 > 2025-08-02 18:41:37.000000 > apache-airflow-3.0.4/airflow-core/src/airflow/example_dags/sql/ > │ │ -rw------- 0 root (0) root (0) 866 > 2025-08-02 18:41:37.000000 > apache-airflow-3.0.4/airflow-core/src/airflow/example_dags/sql/sample.sql > │ │ -rw------- 0 root (0) root (0) 889 > 2025-08-02 18:41:37.000000 > > apache-airflow-3.0.4/airflow-core/src/airflow/example_dags/sql/tutorial_taskflow_template.sql > │ │ -lrwx------ 0 root (0) root (0) 0 > 2025-08-02 18:41:37.000000 > apache-airflow-3.0.4/airflow-core/src/airflow/example_dags/standard -> > ../../../../providers/standard/src/airflow/providers/standard/example_dags > │ │ +lrwxrwxrwx 0 root (0) root (0) 0 > 2025-08-02 18:41:37.000000 > apache-airflow-3.0.4/airflow-core/src/airflow/example_dags/standard -> > ../../../../providers/standard/src/airflow/providers/standard/example_dags > │ │ -rw------- 0 root (0) root (0) 3912 > 2025-08-02 18:41:37.000000 > apache-airflow-3.0.4/airflow-core/src/airflow/example_dags/tutorial.py > │ │ -rw------- 0 root (0) root (0) 4168 > 2025-08-02 18:41:37.000000 > apache-airflow-3.0.4/airflow-core/src/airflow/example_dags/tutorial_dag.py > │ │ -rw------- 0 root (0) root (0) 4003 > 2025-08-02 18:41:37.000000 > > apache-airflow-3.0.4/airflow-core/src/airflow/example_dags/tutorial_objectstorage.py > │ │ -rw------- 0 root (0) root (0) 3088 > 2025-08-02 18:41:37.000000 > > apache-airflow-3.0.4/airflow-core/src/airflow/example_dags/tutorial_taskflow_api.py > │ │ -rw------- 0 root (0) root (0) 2777 > 2025-08-02 18:41:37.000000 > > apache-airflow-3.0.4/airflow-core/src/airflow/example_dags/tutorial_taskflow_api_virtualenv.py > │ │ -rw------- 0 root (0) root (0) 3552 > 2025-08-02 18:41:37.000000 > > apache-airflow-3.0.4/airflow-core/src/airflow/example_dags/tutorial_taskflow_templates.py > │ │ -rw------- 0 root (0) root (0) 19489 > 2025-08-02 18:41:37.000000 > apache-airflow-3.0.4/airflow-core/src/airflow/exceptions.py > > > Jens > > On 05.08.25 12:30, Jarek Potiuk wrote: > > +1 (binding): > > > > Done: > > > > * reproducible package check (passed - same as for Amog) > > * SVN checks > > * Docker checks > > * Licence checks > > * signatures > > * checksums > > * installed and run it with Breeze > > > > > > Few comments: > > > > * Jens - indeed reproducibility for tarball worked for me as well. I > think > > it would be great if you run `diffoscope` (you can run it with `uv tool > > install diffoscope`) on the two tarballs and share the difference (can be > > on Slack) so that we can take a look and fix it. It is likely some > > permission issue or sequence of adding files to tar - our process > attempts > > to make all that reproducible, but maybe something is only affecting your > > environment :). > > > > * I see my security model update > > https://github.com/apache/airflow/pull/54088 did not make it, it's > > already cherry-picked to v3-0-test and I can apply it after the release > (or > > Ash can do it when releasing docs) with our new tool where we can release > > docs with individual cherry-picks applied. > > > > Ash - is there any reason why we have no "Status of testing" issue > > generated? Was it failing maybe ? I feel a bit lost not seeing the issue > > where I see all the issues I should look like - it makes the manual > > verification part way easier. And I see the part where we generate it is > in > > the docs. Also I think it has a very good "collaboration" spirit where it > > allows people to encourage each other to do testing and report on their > > status. > > > > All looks good besides. > > > > > > J > > > > On Tue, Aug 5, 2025 at 11:37 AM Amogh Desai <amoghde...@apache.org> > wrote: > > > >> +1 binding. > >> > >> For both airflow-core and task-sdk: > >> - Checked reproducible package builds > >> - Performed SVN checks > >> - Checked Licenses > >> - Checked Signatures > >> - Checked SHA512 checksums > >> > >> Installed the RC with breeze, and tested my changes and also ran a > general > >> test of running dags from my test set. Looking good! > >> > >> Jens, I do not see a difference in the source tarball being different > when > >> I test it. > >> We also perform raw byte comparison between tarballs, so > >> I am not so sure why you see that error. > >> > >> Thanks & Regards, > >> Amogh Desai > >> > >> > >> On Tue, Aug 5, 2025 at 3:22 AM Jens Scheffler > <j_scheff...@gmx.de.invalid> > >> wrote: > >> > >>> Hi Ash! > >>> > >>> Tested 3.0.4RC1 with latest EdgeExecutor and Integration Test DAG and > >>> all looks good! > >>> > >>> Airflow-Core 3.0.4rc1: +1 (binding) - Checked SVN, Reproducible package > >>> build, Licenses, Signatures > >>> > >>> I am not sure why the source tarball is binary different when I build > >>> locally but inspecting the content it seems to be binary same content. > >>> So I assume some file order or unrelevant meta data is different from > >>> the packaging locally and from Ash. Maybe MacOS to Linux small diff in > >>> tar/gz? > >>> > >>> Task SDK 1.0.4RC1: +1 (binding) - Checked SVN, Reproducible package > >>> build, Licenses, Signatures > >>> > >>> Nit in Release Notes: > >>> > >>> The line `Flexible form use ReactMarkdown instead of default Markdown > >>> component (#54032) (#54040)` is duplicate in the list > >>> > >>> Thanks for driving the release! > >>> > >>> Jens > >>> > >>> On 04.08.25 19:28, Ash Berlin-Taylor wrote: > >>>> Hey fellow Airflowers, > >>>> > >>>> The release candidates for *Apache Airflow 3.0.4rc1 *and *Task SDK > >>> 1.0.4rc1* are now available for testing! > >>>> This email is calling for a vote on the release, which will last at > >>> least until 7th August (72 hours from now) and until 3 binding +1 votes > >>> have been received. > >>>> Consider this my +1 binding vote. > >>>> > >>>> Airflow 3.0.4rc1 is available at: > >>>> https://dist.apache.org/repos/dist/dev/airflow/3.0.4rc1/ > >>>> > >>>> "apache-airflow" Meta package: > >>>> > >>>> - *apache-airflow-3.0.4-source.tar.gz* is a source release that comes > >>> with INSTALL instructions. > >>>> - *apache-airflow-3.0.4.tar.gz* is the binary Python "sdist" release. > >>>> - *apache_airflow-3.0.4-py3-none-any.whl* is the binary Python wheel > >>> "binary" release. > >>>> > >>>> "apache-airflow-core" package > >>>> > >>>> - *apache_airflow_core-3.0.4.tar.gz* is the binary Python “sdist" > >>> release. > >>>> - *apache_airflow_3.0.4-py3-none-any.whl* is the binary Python wheel > >>> "binary" release. > >>>> > >>>> Task SDK 1.0.4rc1 is available at: > >>>> https://dist.apache.org/repos/dist/dev/airflow/task-sdk/1.0.4rc1/ > >>>> > >>>> "apache-airflow-task-sdk" package > >>>> > >>>> - *apache_airflow_task_sdk-1.0.4.tar.gz* is the binary Python “sdist" > >>> release. > >>>> - *apache_airflow_task_sdk-1.0.4-py3-none-any.whl* is the binary > Python > >>> wheel "binary" release. > >>>> Public keys are available at: > >>>> https://dist.apache.org/repos/dist/release/airflow/KEYS > >>>> > >>>> Please vote accordingly: > >>>> > >>>> [ ] +1 approve > >>>> [ ] +0 no opinion > >>>> [ ] -1 disapprove with the reason > >>>> > >>>> Only votes from PMC members are binding, but all members of the > >>> community are encouraged to test the release and vote with > >> "(non-binding)". > >>>> The test procedure for PMC members is described in: > >>>> > >> > https://github.com/apache/airflow/blob/main/dev/README_RELEASE_AIRFLOW.md#verify-the-release-candidate-by-pmc-members > >>>> The test procedure for contributors and members of the community who > >>> would like to test this RC is described in: > >> > https://github.com/apache/airflow/blob/main/dev/README_RELEASE_AIRFLOW.md#verify-the-release-candidate-by-contributors > >>>> Please note that the version number excludes the 'rcX' string, so it's > >>> now simply 3.0.4 for Airflow package and 1.0.4 for Task SDK. This will > >>> allow us to rename the artifact without modifying the artifact > checksums > >>> when we actually release. > >>>> *Docs* (for preview): > >>>> https://airflow.staged.apache.org/docs/apache-airflow/3.0.4 > >>>> *Release Notes*: > >>>> j > >>>> - https://github.com/apache/airflow/blob/3.0.4rc1/RELEASE_NOTES.rst > >>>> - > >> > https://airflow.staged.apache.org/docs/apache-airflow/3.0.4/release_notes.html > >>> (Rendered HTML) > >>>> *Testing Instructions using PyPI*: > >>>> > >>>> You can build a virtualenv that installs this and other required > >> packages > >>>> (e.g. task sdk), like this: > >>>> > >>>> ``` > >>>> uv venv > >>>> uv pip install -U apache-airflow==3.0.4rc1 --pre > >>>> ``` > >>>> > >>>> Constraints files are at > >>>> https://github.com/apache/airflow/tree/constraints-3.0.4rc1 > >>>> > >>>> Cheers, > >>>> Ash > >>> --------------------------------------------------------------------- > >>> To unsubscribe, e-mail: dev-unsubscr...@airflow.apache.org > >>> For additional commands, e-mail: dev-h...@airflow.apache.org > >>> > >>> > > --------------------------------------------------------------------- > To unsubscribe, e-mail: dev-unsubscr...@airflow.apache.org > For additional commands, e-mail: dev-h...@airflow.apache.org > >
