Fuzz: Exclude seed corpus from release tarball

Exclude fuzz/fuzz_seeds from git archive release tarballs via
.gitattributes export-ignore. Add assertions in create-tarball.sh,
verify-release-candidate.sh, and the license CI workflow to verify
the seed corpus is not packaged into source release archives.

.gitattributes

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..53b258e
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,19 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Exclude fuzz seed corpus from release tarball
+fuzz/fuzz_seeds export-ignore

.github/workflows/license.yml

diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml
index f4524f6..031e214 100644
--- a/.github/workflows/license.yml
+++ b/.github/workflows/license.yml
@@ -38,3 +38,9 @@
           python-version: 3.8
       - name: Audit licenses
         run: ./dev/release/run-rat.sh .
+      - name: Verify release tarball excludes fuzz seeds
+        run: |
+          if git archive HEAD | tar -tf - | grep -q 'fuzz/fuzz_seeds'; then
+            echo "Error: fuzz/fuzz_seeds found in git archive release tarball"
+            exit 1
+          fi

dev/release/create-tarball.sh

diff --git a/dev/release/create-tarball.sh b/dev/release/create-tarball.sh
index 5196501..862a268 100755
--- a/dev/release/create-tarball.sh
+++ b/dev/release/create-tarball.sh
@@ -117,6 +117,11 @@
 mkdir -p ${distdir}
 (cd "${SOURCE_TOP_DIR}" && git archive ${release_hash} --prefix ${release}/ | gzip > ${tarball})
 
+if tar -tf ${tarball} | grep -q 'fuzz/fuzz_seeds'; then
+    echo "Error: fuzz/fuzz_seeds found in release tarball ${tarball}"
+    exit 1
+fi
+
 echo "Running rat license checker on ${tarball}"
 ${SOURCE_DIR}/run-rat.sh ${tarball}
 

dev/release/verify-release-candidate.sh

diff --git a/dev/release/verify-release-candidate.sh b/dev/release/verify-release-candidate.sh
index 4e97c6e..ffec088 100755
--- a/dev/release/verify-release-candidate.sh
+++ b/dev/release/verify-release-candidate.sh
@@ -124,6 +124,12 @@
   cargo build
   cargo test --all-features
 
+  # Ensure fuzz seed corpus is not packaged into the release tarball
+  if [ -d "fuzz/fuzz_seeds" ]; then
+    echo "fuzz/fuzz_seeds should not be included in the release tarball"
+    exit 1
+  fi
+
   if ( find . -iname 'Cargo.toml' | xargs grep SNAPSHOT ); then
     echo "Cargo.toml version should not contain SNAPSHOT for releases"
     exit 1