Release archive contain additional files

[ruudbleeker]

I'm in the process of automating the Krew install on our workstations and found that at least the latest Krew release archive (v0.4.5) contains some MacOS specific files that IMHO should not be there. I haven't checked the archives for older versions yet.

If it's appreciated, I could make some changes to https://github.com/kubernetes-sigs/krew/blob/master/hack/make-release-artifacts.sh and create a pull request, so that cleaner archives are created in the future.

[ahmetb]

What files specifically are you seeing?

[ruudbleeker]

$ tar tzvf krew-linux_amd64.tar.gz 
-rw-r--r-- ckim/staff      163 2000-01-01 01:00 ./._LICENSE
tar: Ignoring unknown extended header keyword 'LIBARCHIVE.xattr.com.apple.provenance'
-rw-r--r-- ckim/staff    11358 2000-01-01 01:00 ./LICENSE
-rwxr-xr-x ckim/staff      163 2000-01-01 01:00 ./._krew-linux_amd64
tar: Ignoring unknown extended header keyword 'LIBARCHIVE.xattr.com.apple.provenance'
-rwxr-xr-x ckim/staff 13952477 2000-01-01 01:00 ./krew-linux_amd64

It's the files starting with ._ (dot + underscore), which are macOS specific files and a way to save extended filesystem attributes on file systems that don't actually support them. The errors thrown by GNU tar also pertain to macOS specific extended attributes. These can be turned off by using --no-xattrs when creating the archive.

[ruudbleeker]

I was thinking something along the lines below. It also includes a way of backdating the files which is a little less jarring than setting all timestamps to Jan 1st 2000.

diff --git a/hack/make-release-artifacts.sh b/hack/make-release-artifacts.sh
index dcaf6db..12e1276 100755
--- a/hack/make-release-artifacts.sh
+++ b/hack/make-release-artifacts.sh
@@ -41,8 +41,9 @@ while IFS= read -r -d $'\0' f; do
   (
     cd "${archive_dir}"
     # consistent timestamps for files in archive dir to ensure consistent checksums
-    TZ=UTC touch -t "0001010000" ./*
-    tar --use-compress-program "gzip --no-name" -cvf "${SCRIPTDIR}/../out/${archive}" ./*
+    # use the date of the latest release tag to backdate the files
+    TZ=UTC touch --date="$(git show --no-patch --format=%ci $(git describe --tags --abbrev=0))" ./*
+    tar --use-compress-program="gzip --no-name" --no-xattrs --exclude=".*" -cvf "${SCRIPTDIR}/../out/${archive}" *
   )
 
   # create sumfile

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[ruudbleeker]

/remove-lifecycle rotten

I still thinks the release artifact for krew can be improved upon, see my diff in #892 (comment). I am however not allowed to do a pull request without signing the CLA, which I'm not allowed to do in my professional capacity. I'm hopeful someone else can implement the fix.