Source tarball ownership normalization breaks GitHub release signature verification #5679

Description

The detached signatures attached to dotnet/dotnet releases do not verify against GitHub’s automatically generated source tarballs.

Related report: dotnet/dotnet#10452

Reproduction

version=10.0.114

curl -fLO "https://github.com/dotnet/dotnet/archive/refs/tags/v$version.tar.gz"
curl -fLO "https://github.com/dotnet/dotnet/releases/download/v$version/dotnet-$version.tar.gz.sig"

gpg --verify "dotnet-$version.tar.gz.sig" "v$version.tar.gz"

With the [release public key](https://dot.net/release-key-2023) imported, this reports:

gpg: BAD signature from "onnxcoredev@microsoft.com" [unknown]

Root cause

The build-generated source archives normalize tar ownership to UID/GID 2001:2001 and clear owner/group names, while GitHub-generated archives use 0:0 and root:root. The signatures cover the build-generated archives, not the different bytes downloaded from GitHub.