This is an automated email from the ASF dual-hosted git repository.
zhoujinsong pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/amoro.git
The following commit(s) were added to refs/heads/master by this push:
new 65b24e102 [AMORO-4387] Exclude macOS AppleDouble entries from the
source release archive (#4390)
65b24e102 is described below
commit 65b24e102cadaaec889ea0589929a29bdf490c55
Author: ConradJam <[email protected]>
AuthorDate: Wed Sep 23 11:58:04 2026 +0800
[AMORO-4387] Exclude macOS AppleDouble entries from the source release
archive (#4390)
The 0.9.0-rc10 source tarball shipped 3,119 AppleDouble (._*) entries:
macOS bsdtar serializes extended attributes as ._<name> sidecar members,
and on Linux the build failed because Checkstyle parsed ._*.java files
as Java sources (binding -1 in the IPMC vote).
Protection layers in create_source_release.sh:
- export COPYFILE_DISABLE=1 so bsdtar/rsync stop emitting AppleDouble data
- rsync additionally excludes ._*
- tar additionally excludes ._ * and .DS_Store
- after creating the archive, inspect the raw entry names with Python's
tarfile module and abort before signing if any ._*, __MACOSX or
.DS_Store entry is found (macOS `tar -t` hides ._ entries by folding
them back into metadata, so it cannot be used for this check)
- verify python3 (stdlib tarfile) is available before any side effects,
so a missing interpreter cannot leave a half-built release directory
or a blocking temporary clone
---
tools/releasing/create_source_release.sh | 54 +++++++++++++++++++++++++++++---
1 file changed, 50 insertions(+), 4 deletions(-)
diff --git a/tools/releasing/create_source_release.sh
b/tools/releasing/create_source_release.sh
index 70fd14d33..7bbf6929b 100644
--- a/tools/releasing/create_source_release.sh
+++ b/tools/releasing/create_source_release.sh
@@ -46,18 +46,44 @@ else
SHASUM="sha512sum"
fi
+# macOS tools encode extended attributes / resource forks as AppleDouble
+# (._*) entries: bsdtar writes them into archives it creates and rsync may
+# materialize them as sidecar files. They made the 0.9.0-rc10 source release
+# unbuildable on Linux (Checkstyle parsed ._*.java as Java sources), so keep
+# them out of the archive and verify afterwards. Harmless on Linux.
+export COPYFILE_DISABLE=1
+
+# The post-archive verification needs Python 3 (macOS `tar -t` folds ._*
+# entries back into metadata instead of listing them, so the raw entry names
+# must be inspected). Check before any side effects so a missing interpreter
+# cannot leave a half-built release directory or a blocking temp clone.
+if ! python3 -c "import tarfile" > /dev/null 2>&1; then
+ echo "ERROR: python3 (with the standard-library tarfile module) is required"
\
+ "to verify the source archive. Please install Python 3 first."
+ exit 1
+fi
+
###########################
cd ..
AMORO_DIR=`pwd`
RELEASE_DIR=${AMORO_DIR}/tools/releasing/release
-CLONE_DIR=${RELEASE_DIR}/amoro-tmp-clone
echo "Creating source package"
mkdir -p ${RELEASE_DIR}
+# Clone into a per-run exclusive directory: concurrent runs must not share
+# a clone path, and this run's cleanup must never delete a clone belonging
+# to another (still running) invocation.
+CLONE_PARENT=$(mktemp -d "${RELEASE_DIR}/amoro-clone.XXXXXX")
+CLONE_DIR=${CLONE_PARENT}/amoro-tmp-clone
+
+# Remove this run's temporary directory no matter how the script exits, so
+# failed runs do not leave clone directories piling up in release/.
+trap 'rm -rf "${CLONE_PARENT}"' EXIT
+
# create a temporary git clone to ensure that we have a pristine source release
git clone ${AMORO_DIR} ${CLONE_DIR}
cd ${CLONE_DIR}
@@ -65,14 +91,34 @@ cd ${CLONE_DIR}
rsync -a \
--exclude ".git" --exclude ".gitignore" \
--exclude ".github" --exclude "/site/" --exclude "target" \
- --exclude ".idea" --exclude "*.iml" --exclude ".DS_Store" \
+ --exclude ".idea" --exclude "*.iml" --exclude ".DS_Store" --exclude "._*" \
--exclude "*/dependency-reduced-pom.xml" \
. amoro-$RELEASE_VERSION
-tar czf ${RELEASE_DIR}/apache-amoro-${RELEASE_VERSION}-src.tar.gz
amoro-$RELEASE_VERSION
+tar czf ${RELEASE_DIR}/apache-amoro-${RELEASE_VERSION}-src.tar.gz \
+ --exclude='._*' --exclude='.DS_Store' \
+ amoro-$RELEASE_VERSION
+
+# Verify the archive carries no macOS metadata entries. Do not use
+# `tar -t` for this: on macOS bsdtar converts ._ entries back to metadata
+# instead of listing them, hiding exactly the pollution we are checking for.
+# The raw entry names must be inspected instead.
+MACOS_METADATA_COUNT=$(python3 -c "
+import tarfile
+names =
tarfile.open('${RELEASE_DIR}/apache-amoro-${RELEASE_VERSION}-src.tar.gz').getnames()
+print(sum(1 for n in names
+ if '/._' in n or n.startswith('._')
+ or '__MACOSX' in n or n.endswith('.DS_Store')))
+")
+if [ "${MACOS_METADATA_COUNT}" != "0" ]; then
+ echo "ERROR: source archive contains ${MACOS_METADATA_COUNT} macOS metadata
" \
+ "entries (._* AppleDouble, __MACOSX or .DS_Store); aborting."
+ exit 1
+fi
+
gpg --armor --detach-sig
${RELEASE_DIR}/apache-amoro-$RELEASE_VERSION-src.tar.gz
cd ${RELEASE_DIR}
$SHASUM apache-amoro-$RELEASE_VERSION-src.tar.gz >
apache-amoro-$RELEASE_VERSION-src.tar.gz.sha512
cd ${CURR_DIR}
-rm -rf ${CLONE_DIR}
\ No newline at end of file
+rm -rf "${CLONE_PARENT}"
\ No newline at end of file
