[Release] Revisit reproducible source archive verification

[kou]

Describe the enhancement requested

Note that reproducible source archive is checked when we create a source archive:

arrow/.github/workflows/release_candidate.yml

Lines 88 to 90 in 45f562a

	sudo reprotest \
	"dev/release/utils-create-release-tarball.sh ${VERSION} ${RC_NUM}" \
	apache-arrow-${VERSION}.tar.gz

This focus on RC verification process.

The current approach:

1. Check reproducible source archive on Linux by GitHub Acitons
2. Check reproducible source archive on macOS by GitHub Acitons
3. Check reproducible source archive on PMC members' machine

1./3. worked. (Note that 3. is only by me for now.) 2. didn't work.

Proposed approach 1:

1. Check reproducible source archive on Linux by GitHub Actions
2. Check reproducible source archive on macOS by GitHub Actions
3. Don't check reproducible source archive on PMC members' machine because it's already checked by GitHub Actions

Proposed approach 2:

1. Check reproducible source archive on Linux by GitHub Actions
2. Don't check reproducible source archive on macOS by GitHub Actions
3. Don't check reproducible source archive on PMC members' machine because it's already checked by GitHub Actions

Component(s)

Release

[amoeba]

I understand the goal of doing reproducible builds was primarily so we could do Automated Release Signing (i.e., sign release on GHA).

Therefore I think (at at minimum) we only really need to do one test (Proposed approach 2) since presumably everyone verifying the release will be doing a reproducibility check (stipulation 3 on https://infra.apache.org/release-signing.html#automated-release-signing). However, testing reproducibility in more environments on CI before putting out a release for a vote would help us avoid failing release votes.

Can you clarify what "Check reproducible source archive on PMC members' machine" is here? Is that a manually step the release manager takes or were you referring to verifying releases during a vote?

[assignUser]

I think checking on GHA + during verification. I don't think the check on GHA takes a long time or anything so checking cross OSes makes sense to avoid unnecessary rc bumps?

[kou]

Can you clarify what "Check reproducible source archive on PMC members' machine" is here? Is that a manually step the release manager takes or were you referring to verifying releases during a vote?

Yes. I meant the latter: "were you referring to verifying releases during a vote?"