Implementation:Apache Airflow Reproducible Build Verification

Knowledge Sources	Apache Airflow
Domains	Release_Engineering, Verification
Last Updated	2026-02-08 00:00 GMT

Overview

Concrete tool for verifying release candidate artifacts provided by the reproducible_build.yaml metadata and breeze verification commands.

Description

The reproducible_build.yaml contains the release-notes-hash (MD5) and source-date-epoch (Unix timestamp) used for reproducible build verification. The breeze tool provides verification commands for provider packages and production images. The release process documentation (dev/README_RELEASE_AIRFLOW.md) details the complete verification procedure.

Usage

Follow the verification steps in README_RELEASE_AIRFLOW.md when evaluating a release candidate.

Code Reference

Source Location

• Repository: Apache Airflow
• File: reproducible_build.yaml (L1-3)
• File: dev/README_RELEASE_AIRFLOW.md (verification procedures)

Signature

# reproducible_build.yaml
release-notes-hash: "<md5-hash-of-release-notes>"
source-date-epoch: <unix-timestamp>

# Verification commands
# 1. Check SHA512
shasum -a 512 -c apache-airflow-3.1.0rc1.tar.gz.sha512

# 2. Verify GPG signature
gpg --verify apache-airflow-3.1.0rc1.tar.gz.asc apache-airflow-3.1.0rc1.tar.gz

# 3. Verify with breeze
breeze release-management verify-provider-packages

Import

# Download and verify RC artifacts
svn checkout https://dist.apache.org/repos/dist/dev/airflow/3.1.0rc1/
cd 3.1.0rc1
shasum -a 512 -c *.sha512
gpg --verify *.asc

I/O Contract

Inputs

Name	Type	Required	Description
RC artifacts	.tar.gz	Yes	Release candidate source distribution
Signatures	.asc	Yes	GPG detached signatures
Checksums	.sha512	Yes	SHA512 checksum files
reproducible_build.yaml	YAML	Yes	Build metadata for reproducibility

Outputs

Name	Type	Description
Verification result	Pass/Fail	Per-artifact verification status
Reproducibility check	Pass/Fail	Whether rebuild matches original

Usage Examples

Verify Release Candidate

# Download RC from SVN
svn checkout https://dist.apache.org/repos/dist/dev/airflow/3.1.0rc1/
cd 3.1.0rc1

# Verify checksums
shasum -a 512 -c *.sha512

# Verify signatures
for f in *.asc; do gpg --verify "$f"; done

# Test build
tar xzf apache-airflow-3.1.0rc1.tar.gz
cd apache-airflow-3.1.0rc1
pip install .

Related Pages

Implements Principle

• Principle:Apache_Airflow_RC_Verification