[Release] Update Release Management Guide to reflect changes in 21.0.0

[amoeba]

Describe the enhancement requested

In 21.0.0, a number of changes to the release process were made. We should update the Release Management Guide to reflect them.

Changes include:

• RC binary verification is now done automatically on GHA CI: [Release] Run binary RC verification jobs in apache/arrow #45675
  • New workflow: https://github.com/apache/arrow/blob/main/.github/workflows/verify_rc.yml
  • Automatically runs when we push an *-rc-* tag
• RC source archive is now signed on GHA: [Release][Packaging] Add support for Reproducible Builds for source archive #46336
• Remove Javascript tasks now that JS is moved out of the monorepo

We may also be able to remove some of the manualy-run scripts in dev/release.

cc @kou @raulcd @assignUser

Component(s)

Release

[kou]

Sorry for not updating it...

Can I update it while preparing an RC?

[amoeba]

No worries at all @kou. I'm happy to help but if you want to take notes and update it as you go that's totally fine too.

[kou]

Thanks.

I'll update it and create a PR. Could you review the PR when the PR is ready? (I hope that you clean up my English in the PR...)

[amoeba]

Of course, thanks @kou.

[amoeba]

Just to note a possible follow-on task, would it be helpful for other Arrow repos if we documented the steps to enable automated release signing? I imagine now that you've done all the hard work @kou other repos (like adbc) might want to.

[kou]

Good point. I'll do it in a PR for this issue or in separated issue/PR.

[raulcd]

@amoeba @kou I plan to work on this in preparation for the 22.0.0 release and as part of improvements to the release process.

I also wanted to ask if there are any follow up tasks related to reproducible builds / automated signing and/or other general improvements to the release for the main repository that you think we could tackle to follow up the work that was done at:

• [Release][Packaging] Add support for Reproducible Builds for source archive #46336

[kou]

Thanks! (And sorry for not working on this...)

I wanted to make Linux packages reproducible. We need to work on the followings for it:

• Moving Linux packages related tasks to apache/arrow: [CI][Crossbow] Use apache/arrow instead of separated repository (e.g. ursacomputing/crossbow) #46014
  • Because the signing key is set as secret in apache/arrow
• [CI][Crossbow][Dev] Automate Zulip and email notifications for CI: Extra run nightly #46669
• Make Linux packages reproducible
• Can we sign APT/Yum repositories automatically too...?