ci: reproducible builds with SOURCE_DATE_EPOCH

[andreahlert]

Part of #715

Problem

Our build artifacts are not reproducible. Building the same source twice may produce different checksums due to timestamps embedded in the tarball/wheel metadata. This makes voter verification harder and prevents bit-for-bit comparison of locally rebuilt packages against the RC artifacts.

Solution

Set SOURCE_DATE_EPOCH to the timestamp of the tagged commit before building. This ensures all file timestamps inside the archive are deterministic.

Airflow does this in their release tooling and it allows voters to rebuild from source and binary-compare against the SVN artifacts.

Implementation

• In scripts/apache_release.py, before calling hatch build or python -m build:

  import subprocess
  epoch = subprocess.check_output(["git", "log", "-1", "--format=%ct", tag]).strip()
  os.environ["SOURCE_DATE_EPOCH"] = epoch.decode()

• Document in scripts/README.md that builds are reproducible
• Add a test that rebuilds from a tagged commit and compares checksums

References

• Python reproducible builds
• PEP 552 (deterministic .pyc)
• Airflow's implementation in breeze release-management prepare-airflow-distributions

[andreahlert]

@skrawcz @elijahbenizzy @pjfanning the build currently uses flit build for sdist. we just need to set SOURCE_DATE_EPOCH from the tagged commit timestamp before building so artifacts are reproducible. voters would then be able to rebuild from source and get identical checksums. I can pick this up if you're aligned.

[pjfanning]

ASF Infra team will only provide signing keys that can be used for automated releases (eg on GitHub CI) if you have reproducible builds. So this is a good step. Is this the src distribution also reproducible? That is, are the file stamps set to a standardised datetime? The datetime of the last git commit in the release is a good one to use.

[andreahlert]

@pjfanning good to know about the ASF Infra signing keys requirement, that's extra motivation.

to answer your question: right now neither the source tarball nor the sdist/wheel are reproducible. git archive gives deterministic file content but the gzip header still has the current timestamp. sdist and wheel via flit build use filesystem timestamps entirely.

the fix would be setting SOURCE_DATE_EPOCH from the tagged commit before all builds, and for the git archive either piping through gzip --no-name or using --format=tar and compressing separately. I'll include both in the implementation.

@skrawcz @elijahbenizzy Am I right?