Release archive contain additional files

[ruudbleeker]

I'm in the process of automating the Krew install on our workstations and found that at least the latest Krew release archive (v0.4.5) contains some MacOS specific files that IMHO should not be there. I haven't checked the archives for older versions yet.

If it's appreciated, I could make some changes to https://github.com/kubernetes-sigs/krew/blob/master/hack/make-release-artifacts.sh and create a pull request, so that cleaner archives are created in the future.

[ahmetb]

What files specifically are you seeing?

[ruudbleeker]

$ tar tzvf krew-linux_amd64.tar.gz 
-rw-r--r-- ckim/staff      163 2000-01-01 01:00 ./._LICENSE
tar: Ignoring unknown extended header keyword 'LIBARCHIVE.xattr.com.apple.provenance'
-rw-r--r-- ckim/staff    11358 2000-01-01 01:00 ./LICENSE
-rwxr-xr-x ckim/staff      163 2000-01-01 01:00 ./._krew-linux_amd64
tar: Ignoring unknown extended header keyword 'LIBARCHIVE.xattr.com.apple.provenance'
-rwxr-xr-x ckim/staff 13952477 2000-01-01 01:00 ./krew-linux_amd64

It's the files starting with ._ (dot + underscore), which are macOS specific files and a way to save extended filesystem attributes on file systems that don't actually support them. The errors thrown by GNU tar also pertain to macOS specific extended attributes. These can be turned off by using --no-xattrs when creating the archive.

[ruudbleeker]

I was thinking something along the lines below. It also includes a way of backdating the files which is a little less jarring than setting all timestamps to Jan 1st 2000.

diff --git a/hack/make-release-artifacts.sh b/hack/make-release-artifacts.sh
index dcaf6db..12e1276 100755
--- a/hack/make-release-artifacts.sh
+++ b/hack/make-release-artifacts.sh
@@ -41,8 +41,9 @@ while IFS= read -r -d $'\0' f; do
   (
     cd "${archive_dir}"
     # consistent timestamps for files in archive dir to ensure consistent checksums
-    TZ=UTC touch -t "0001010000" ./*
-    tar --use-compress-program "gzip --no-name" -cvf "${SCRIPTDIR}/../out/${archive}" ./*
+    # use the date of the latest release tag to backdate the files
+    TZ=UTC touch --date="$(git show --no-patch --format=%ci $(git describe --tags --abbrev=0))" ./*
+    tar --use-compress-program="gzip --no-name" --no-xattrs --exclude=".*" -cvf "${SCRIPTDIR}/../out/${archive}" *
   )
 
   # create sumfile