ci: prepare reproducible source archives for automated signing

.agents/skills/release/references/candidate.md

@@ -68,16 +68,20 @@ Wait for the `Release` GitHub Actions workflow to pass. The workflow validates t
 
 ## Build and verify the source archive
 
-For a new candidate, build the source archive from the verified RC tag. Reuse existing signed artifacts for a retry of the same candidate. The `incubating` marker is required in the filename, and `gzip -n` keeps the gzip header independent of the local build time.
+For a new candidate, build the source archive from the verified RC tag. Reuse existing signed artifacts for a retry of the same candidate. Use Git to package the committed source with the required `incubating` filename, `shasum` to calculate its SHA-512 checksum, and GPG to sign it.
 
 ```shell
+set -eu
 RC_TAG="v${VERSION}-rc.${RC}"
 SOURCE_DIR="apache-asyncband-${VERSION}-incubating-src"
 ARTIFACT_DIR="${RELEASE_DIR}/dist"
-mkdir -p "${ARTIFACT_DIR}"
 git verify-tag "${RC_TAG}"
-git archive --format=tar --prefix="${SOURCE_DIR}/" "${RC_TAG}" \
-  | gzip -n -9 > "${ARTIFACT_DIR}/${SOURCE_DIR}.tar.gz"
+test "$(git rev-parse HEAD)" = "$(git rev-parse "${RC_TAG}^{commit}")"
+git diff --quiet HEAD --
+mkdir "${ARTIFACT_DIR}"
+git -c tar.umask=0022 archive --format=tar.gz -9 \
+  --prefix="${SOURCE_DIR}/" \
+  --output="${ARTIFACT_DIR}/${SOURCE_DIR}.tar.gz" "${RC_TAG}^{commit}"
 (
   cd "${ARTIFACT_DIR}"
   shasum -a 512 "${SOURCE_DIR}.tar.gz" > "${SOURCE_DIR}.tar.gz.sha512"
@@ -86,6 +90,8 @@ git archive --format=tar --prefix="${SOURCE_DIR}/" "${RC_TAG}" \
 )
 ```
 
+The optional [CI source signing workflow](infrastructure.md#ci-source-signing) uses the same packaging command. Its signed bundle is a preparation artifact; download and verify it before staging a candidate.
+
 Verify the existing artifacts with the [candidate-verification guide](verification.md), directly or through `release_verifier`. Supply the candidate identity, signing-key fingerprint, repository root, and absolute artifact paths. Keep the signed archive unchanged throughout verification.
 
 For the separate `license-audit` review, provide the original source archive, the extracted source, and the Cargo package produced by verification, together with `RELEASE_COMMIT`. Discuss its evidence and suggestions with the release manager. Keep the verification directory available until both reviews finish; then remove that disposable directory.

.agents/skills/release/references/infrastructure.md

@@ -32,3 +32,44 @@ Trusted Publishing is already configured for `asyncband`: repository `apache/asy
 Candidates are staged under `https://dist.apache.org/repos/dist/dev/incubator/asyncband/`; approved releases are promoted to `https://dist.apache.org/repos/dist/release/incubator/asyncband/`. The public verification key list is `https://downloads.apache.org/incubator/asyncband/KEYS`.
 
 The release manager uses an ASF-associated signing key published in the existing project `KEYS` file. For a new signing key, follow the [ASF release signing guide](https://infra.apache.org/release-signing.html), verify the fingerprint through an independent channel, and add the public key while preserving existing keys. Reuse established distribution areas and signing configuration; investigate a reported access or verification failure before proposing infrastructure changes.
+
+## CI source signing
+
+`.github/workflows/source.yml` prepares a source archive and optionally signs it in one job. Pull requests and default manual runs produce unsigned artifacts. Signing runs only on an explicit manual dispatch from `apache/asyncband`'s `main` branch with `sign=true`; the secret is passed to that step. Packaging and signing share one trusted environment. The signing step imports the Infra-managed key into a temporary GPG home, checks the primary fingerprint, signs the expected source archive, and verifies the signature. The workflow uploads the resulting bundle once as a GitHub Actions artifact. It has read-only repository access and no OIDC permission; it does not stage, vote, create tags, or publish.
+
+### Provisioning
+
+Request a project signing key from ASF Infra and submit this workflow plus reproducibility evidence to ASF Security. Obtain workflow approval before enabling signing. Follow the [ASF automated release signing procedure](https://infra.apache.org/release-signing.html#automated-release-signing). Infra generates and installs the private key; project members must not export a personal key or request delivery of this private key.
+
+| Configuration                | Value or owner                                                                                                                |
+| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
+| Repository                   | `apache/asyncband`                                                                                                             |
+| Repository secret            | `GPG_SECRET_KEY`, installed by Infra; the signing command expects the Infra key to have an empty passphrase                     |
+| Repository variable          | `SOURCE_SIGNING_FINGERPRINT`, the full uppercase primary fingerprint supplied by Infra                                          |
+| Public key                   | Add to the existing Asyncband `KEYS`, preserving other keys and the current KEYS management mode                                |
+| Suggested primary UID        | `Apache Asyncband Automated Release Signing <[email protected]>`; confirm the committee association with Infra/Tooling |
+
+Once approval, provisioning, and public-key publication are complete, the release manager opens GitHub Actions and manually runs **Source candidate** on `main` with **sign** enabled. Record the run URL, full source commit, checksum, and signing fingerprint. Download the `signed-source` artifact and retain the archive, checksum, and signature as the candidate bytes. A retry should reuse an existing signed bundle when available. This workflow has no schedule; ATR upload is a separate integration to add after key provisioning.
+
+### Reproduce before staging and voting
+
+The release manager must reproduce the source archive on trusted hardware outside GitHub Actions, using a fresh checkout of the exact commit printed in the workflow summary. Compare against the actual downloaded archive, not merely its checksum file. Git produces the tar.gz archive with compression level 9 and a fixed archive umask; `shasum` produces the checksum and `cmp` compares the archive bytes. Run the following from that clean checkout, after setting `DOWNLOADED_ARCHIVE` to the absolute path of the downloaded `.tar.gz`:
+
+```shell
+set -eu
+git diff --quiet HEAD --
+RELEASE_COMMIT="$(git rev-parse --verify 'HEAD^{commit}')"
+VERSION="$(sed -n 's/^version = "\(.*\)"$/\1/p' asyncband/Cargo.toml)"
+SOURCE_DIR="apache-asyncband-${VERSION}-incubating-src"
+REPRO_DIR="$(mktemp -d "${TMPDIR:-/tmp}/asyncband-reproduce.XXXXXX")"
+git -c tar.umask=0022 archive --format=tar.gz -9 \
+  --prefix="${SOURCE_DIR}/" \
+  --output="${REPRO_DIR}/${SOURCE_DIR}.tar.gz" "${RELEASE_COMMIT}"
+cmp "${REPRO_DIR}/${SOURCE_DIR}.tar.gz" "${DOWNLOADED_ARCHIVE}"
+shasum -a 512 "${DOWNLOADED_ARCHIVE}"
+git --version
+```
+
+`cmp` fails on any byte difference, including gzip headers or compression differences. Do not accept merely equivalent extracted contents as evidence for automated signing. If the output differs, check the source commit, Git versions, compression settings, and Git configuration before accepting the candidate. Do not use local Git attribute or archive-compressor overrides in the reproduction checkout. Untracked files are not part of `git archive`; tracked edits are rejected.
+
+After staging, download the candidate again and repeat the comparison and signature verification against the published `KEYS`. Record the candidate revision, source commit, SHA-512, tool versions, and result in the vote evidence. Reviewers independently reproduce these same bytes on trusted hardware before publication. CI generation, a valid automated signature, and a passing build do not replace this check. The existing source-content, build, licensing, PPMC/IPMC voting, and final publication requirements still apply. No compiled binaries or crates.io packages are signed by this workflow.

.agents/skills/release/references/verification.md

@@ -36,6 +36,8 @@ Establish which checks are requested and which inputs are available. Continue in
 
 For example, use `git -C "${REPO_ROOT}" rev-parse "${RC_TAG}^{commit}"` to resolve a candidate and `git -C "${REPO_ROOT}" verify-tag "${RC_TAG}"` to inspect its signature. Run `shasum -a 512 --check` from the artifact directory and `gpg --verify` with the explicitly supplied signature and archive. Inspect checksum filenames before using the checksum file so it checks the intended artifact.
 
+For a CI-signed source archive, also follow [independent reproduction](infrastructure.md#reproduce-before-staging-and-voting) on trusted hardware. Rebuild with the documented `git archive` command and use `cmp` to compare the actual staged compressed archive byte for byte; logical source comparison alone is insufficient for automated signing.
+
 ## Verify the build and Cargo package
 
 Run these checks when the caller requests build and packaging verification. Read `cargo x --help` and the relevant subcommand help in the extracted source first. The archive test uses Cargo's `--locked` mode to check the shipped lockfile; `cargo x test` does not expose that option.

.github/workflows/source.yml

@@ -0,0 +1,104 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Source candidate
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/source.yml
+      - asyncband/Cargo.toml
+      - .gitattributes
+      - .agents/skills/release/**
+  workflow_dispatch:
+    inputs:
+      sign:
+        description: Sign with the Infra-managed key (requires ASF Security approval)
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: source-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  source:
+    name: Prepare source archive
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - name: Package committed source
+        shell: bash
+        run: |
+          set -euo pipefail
+          git diff --quiet HEAD --
+          revision="$(git rev-parse --verify 'HEAD^{commit}')"
+          version="$(sed -n 's/^version = "\(.*\)"$/\1/p' asyncband/Cargo.toml)"
+          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          source_dir="apache-asyncband-${version}-incubating-src"
+          mkdir "$RUNNER_TEMP/source"
+          git -c tar.umask=0022 archive --format=tar.gz -9 \
+            --prefix="${source_dir}/" \
+            --output="$RUNNER_TEMP/source/${source_dir}.tar.gz" "$revision"
+          cd "$RUNNER_TEMP/source"
+          shasum -a 512 "${source_dir}.tar.gz" > "${source_dir}.tar.gz.sha512"
+          {
+            printf 'Commit: %s\nVersion: %s\n' "$revision" "$version"
+            git --version
+            cat "${source_dir}.tar.gz.sha512"
+          } | tee -a "$GITHUB_STEP_SUMMARY"
+      - name: Sign and verify
+        id: sign
+        if: >-
+          github.event_name == 'workflow_dispatch' && inputs.sign &&
+          github.repository == 'apache/asyncband' && github.ref == 'refs/heads/main'
+        shell: bash
+        working-directory: ${{ runner.temp }}/source
+        env:
+          SIGNING_KEY: ${{ secrets.GPG_SECRET_KEY }}
+          SIGNING_FINGERPRINT: ${{ vars.SOURCE_SIGNING_FINGERPRINT }}
+          GNUPGHOME: ${{ runner.temp }}/source-gnupg
+        run: |
+          set -euo pipefail
+          test -n "$SIGNING_KEY"
+          [[ "$SIGNING_FINGERPRINT" =~ ^[0-9A-F]{40}$ ]]
+          shopt -s nullglob
+          archives=(*.tar.gz)
+          test "${#archives[@]}" -eq 1
+          archive="${archives[0]}"
+          [[ "$archive" =~ ^apache-asyncband-[0-9]+\.[0-9]+\.[0-9]+-incubating-src\.tar\.gz$ ]]
+
+          mkdir -m 700 "$GNUPGHOME"
+          trap 'gpgconf --kill all; rm -rf "$GNUPGHOME"' EXIT
+          printf '%s' "$SIGNING_KEY" | gpg --batch --import
+          fingerprint="$(gpg --batch --with-colons --list-secret-keys | awk -F: '$1 == "fpr" { print $10; exit }')"
+          test "$fingerprint" = "$SIGNING_FINGERPRINT"
+          gpg --batch --pinentry-mode loopback --passphrase '' \
+            --local-user "$SIGNING_FINGERPRINT!" --armor --detach-sign "$archive"
+          gpg --batch --verify "$archive.asc" "$archive"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ steps.sign.outcome == 'success' && 'signed-source' || 'unsigned-source' }}
+          path: ${{ runner.temp }}/source/
+          if-no-files-found: error