This is an automated email from the ASF dual-hosted git repository. czy006 pushed a commit to branch issues/AMORO-4387 in repository https://gitbox.apache.org/repos/asf/amoro.git
commit 9a456f4ec7eb419843ad2706da8a60d73c3a0524 Author: ConradJam <[email protected]> AuthorDate: Wed Sep 23 10:49:27 2026 +0800 [AMORO-4387] Exclude macOS AppleDouble entries from the source release archive The 0.9.0-rc10 source tarball shipped 3,119 AppleDouble (._*) entries: macOS bsdtar serializes extended attributes as ._<name> sidecar members, and on Linux the build failed because Checkstyle parsed ._*.java files as Java sources (binding -1 in the IPMC vote). Protection layers in create_source_release.sh: - export COPYFILE_DISABLE=1 so bsdtar/rsync stop emitting AppleDouble data - rsync additionally excludes ._* - tar additionally excludes ._ * and .DS_Store - after creating the archive, inspect the raw entry names with Python's tarfile module and abort before signing if any ._*, __MACOSX or .DS_Store entry is found (macOS `tar -t` hides ._ entries by folding them back into metadata, so it cannot be used for this check) - verify python3 (stdlib tarfile) is available before any side effects, so a missing interpreter cannot leave a half-built release directory or a blocking temporary clone --- tools/releasing/create_source_release.sh | 54 +++++++++++++++++++++++++++++--- 1 file changed, 50 insertions(+), 4 deletions(-) diff --git a/tools/releasing/create_source_release.sh b/tools/releasing/create_source_release.sh index 70fd14d33..7bbf6929b 100644 --- a/tools/releasing/create_source_release.sh +++ b/tools/releasing/create_source_release.sh @@ -46,18 +46,44 @@ else SHASUM="sha512sum" fi +# macOS tools encode extended attributes / resource forks as AppleDouble +# (._*) entries: bsdtar writes them into archives it creates and rsync may +# materialize them as sidecar files. They made the 0.9.0-rc10 source release +# unbuildable on Linux (Checkstyle parsed ._*.java as Java sources), so keep +# them out of the archive and verify afterwards. Harmless on Linux. +export COPYFILE_DISABLE=1 + +# The post-archive verification needs Python 3 (macOS `tar -t` folds ._* +# entries back into metadata instead of listing them, so the raw entry names +# must be inspected). Check before any side effects so a missing interpreter +# cannot leave a half-built release directory or a blocking temp clone. +if ! python3 -c "import tarfile" > /dev/null 2>&1; then + echo "ERROR: python3 (with the standard-library tarfile module) is required" \ + "to verify the source archive. Please install Python 3 first." + exit 1 +fi + ########################### cd .. AMORO_DIR=`pwd` RELEASE_DIR=${AMORO_DIR}/tools/releasing/release -CLONE_DIR=${RELEASE_DIR}/amoro-tmp-clone echo "Creating source package" mkdir -p ${RELEASE_DIR} +# Clone into a per-run exclusive directory: concurrent runs must not share +# a clone path, and this run's cleanup must never delete a clone belonging +# to another (still running) invocation. +CLONE_PARENT=$(mktemp -d "${RELEASE_DIR}/amoro-clone.XXXXXX") +CLONE_DIR=${CLONE_PARENT}/amoro-tmp-clone + +# Remove this run's temporary directory no matter how the script exits, so +# failed runs do not leave clone directories piling up in release/. +trap 'rm -rf "${CLONE_PARENT}"' EXIT + # create a temporary git clone to ensure that we have a pristine source release git clone ${AMORO_DIR} ${CLONE_DIR} cd ${CLONE_DIR} @@ -65,14 +91,34 @@ cd ${CLONE_DIR} rsync -a \ --exclude ".git" --exclude ".gitignore" \ --exclude ".github" --exclude "/site/" --exclude "target" \ - --exclude ".idea" --exclude "*.iml" --exclude ".DS_Store" \ + --exclude ".idea" --exclude "*.iml" --exclude ".DS_Store" --exclude "._*" \ --exclude "*/dependency-reduced-pom.xml" \ . amoro-$RELEASE_VERSION -tar czf ${RELEASE_DIR}/apache-amoro-${RELEASE_VERSION}-src.tar.gz amoro-$RELEASE_VERSION +tar czf ${RELEASE_DIR}/apache-amoro-${RELEASE_VERSION}-src.tar.gz \ + --exclude='._*' --exclude='.DS_Store' \ + amoro-$RELEASE_VERSION + +# Verify the archive carries no macOS metadata entries. Do not use +# `tar -t` for this: on macOS bsdtar converts ._ entries back to metadata +# instead of listing them, hiding exactly the pollution we are checking for. +# The raw entry names must be inspected instead. +MACOS_METADATA_COUNT=$(python3 -c " +import tarfile +names = tarfile.open('${RELEASE_DIR}/apache-amoro-${RELEASE_VERSION}-src.tar.gz').getnames() +print(sum(1 for n in names + if '/._' in n or n.startswith('._') + or '__MACOSX' in n or n.endswith('.DS_Store'))) +") +if [ "${MACOS_METADATA_COUNT}" != "0" ]; then + echo "ERROR: source archive contains ${MACOS_METADATA_COUNT} macOS metadata " \ + "entries (._* AppleDouble, __MACOSX or .DS_Store); aborting." + exit 1 +fi + gpg --armor --detach-sig ${RELEASE_DIR}/apache-amoro-$RELEASE_VERSION-src.tar.gz cd ${RELEASE_DIR} $SHASUM apache-amoro-$RELEASE_VERSION-src.tar.gz > apache-amoro-$RELEASE_VERSION-src.tar.gz.sha512 cd ${CURR_DIR} -rm -rf ${CLONE_DIR} \ No newline at end of file +rm -rf "${CLONE_PARENT}" \ No newline at end of file
