-1: (binding) -> because of gradlew embedding in source package (see below)
Also technically, we do not "vote" on convenience packages distributed elsewhere and not placed in the "dist" SVN, but I still think it's worth fixing convenience binary issues. > Licenses: source package is fine (LICENSE, NOTICE, headers), but the staged > jars have no LICENSE/NOTICE under META-INF. Yeah - https://www.apache.org/legal/release-policy.html#what -> LICENCE/NOTICE should be present in the convenience binary packages as well - if they are missing - we should add them - we should not release artifact without it. > Reproducibility: local build matches the staged jars content-wise, but not > byte-for-byte (zip timestamps), which should be solved by setting > appropriate flags. Do we generally aim for byte-reproducibility? Reproducibility is optional "formally" - but it's also quite easy to achieve in Maven: https://maven.apache.org/guides/mini/guide-reproducible-builds.html has all the instructions. And it's a prerequisite for using Github driven publishing (coming soon I hope finally) and the sooner we enable and test it the better we will be able to fix all small issues with it (it took quite a while to get reproducibility issues solved for other artifacts, so might be good idea to at least attempt it now . > 2. Regarding gradle - the SHA256 you posted is the wrapper.jar checksum, not the bin.zip one, so ./gradlew fails verification on a clean machine. Actually that's one of the things that makes me vote -1 for the source release. We are not supposed to have binaries in our source releases - not even the commonly used gradlew for Maven that is customarily put in the repo. It's ok to keep gradlew in the repo, but not ok to release it as part of our "source" release - we need to exclude it (via gitattributes). This is a legal matter that has many nuances—unfortunately. There were loooong discussions about it in "legal-discuss" of the ASF. The last discussion is here: https://lists.apache.org/thread/07y5nj2mkhkq1gq1k9q5y6g2k6hjr61v. The conclusion is that you should either describe in the README how to download gradlew using the source script + a way to verify it (Shasum), or describe how to do it in the README. Adding binaries to the source code release is not allowed. We can only have "sources" in the source release. J, On Tue, Jul 7, 2026 at 9:26 PM Shahar Epstein <[email protected]> wrote: > Thanks for running this, TP! > > I went through the release verification process, and got some questions > before voting: > > Checksums: no issues. > Signatures: no issues. > SVN: no issues. > > Licenses: source package is fine (LICENSE, NOTICE, headers), but the staged > jars have no LICENSE/NOTICE under META-INF. > ASF policy requires them in every distributed artifact. Would this be fixed > in a following RC, or before GA? > > Reproducibility: local build matches the staged jars content-wise, but not > byte-for-byte (zip timestamps), which should be solved by setting > appropriate flags. Do we generally aim for byte-reproducibility? > > Build and all 63 tests pass otherwise. > > Few more notes: > 1. Nexus also stages airflow-sdk-jpl and airflow-sdk-gradle-plugin, which > aren't in the vote email's artifact list - worth including in the > [RESULT]/announce (?) > 2. Regarding gradle - the SHA256 you posted is the wrapper.jar checksum, > not the bin.zip one, so ./gradlew fails verification on a clean machine. > The right value is > f1771298a70f6db5a29daf62378c4e18a17fc33c9ba6b14362e0cdf40610380d. > 3. Do you plan to publish official release verification instructions on > GitHub anytime soon? > > > Shahar > > > On Tue, Jul 7, 2026 at 7:33 PM Tzu-ping Chung <[email protected]> wrote: > > > Hello, > > > > I would like to call a vote to release Apache Airflow Java SDK > > 1.0.0-beta1, based on release candidate 1.0.0-beta1-rc2. > > > > This is a beta release. It is intended for testing and early adoption by > > users and developers outside the project; APIs may still change before > the > > 1.0.0 general-availability release. It is a full, formal ASF release > > (source package + convenience binaries), not a snapshot or nightly build. > > > > Changes since rc1: <SUMMARY OF WHAT CHANGED IN rc2 -- e.g. review > feedback > > addressed from the rc1 thread; add PR links if helpful, or delete this > line> > > > > The release candidate contains the following Maven artifacts, all under > > group id org.apache.airflow: > > > > - airflow-sdk > > - airflow-sdk-jul > > - airflow-sdk-log4j2 > > - airflow-sdk-processor > > - airflow-sdk-slf4j > > - airflow-sdk-bom > > > > Git tag / commit being voted on: > > > > - Tag: java-sdk/1.0.0-beta1-rc2 > > - Commit: 8f9a17ddeac523bf46a0544b95201eb57184fc31 > > - > > > https://github.com/apache/airflow/releases/tag/java-sdk%2F1.0.0-beta1-rc2 > > > > Source release (the artifact being voted on), signatures and checksums: > > https://dist.apache.org/repos/dist/dev/airflow/java-sdk/1.0.0-beta1-rc2/ > > > > Convenience binaries: staged in the ASF Nexus repository: > > > https://repository.apache.org/content/repositories/orgapacheairflow-1006/ > > > > KEYS file (public keys used to sign the release): > > https://downloads.apache.org/airflow/KEYS > > > > There’s no changelogs since this is the first ever release. See the Java > > SDK’s README for a list of features currently provided. > > https://github.com/apache/airflow/tree/java-sdk/1.0.0-beta1-rc2/java-sdk > > > > There are no functionality changes compared to RC1; this candidate > > includes fixes to the release process scripts so the artifacts are of the > > correct formats. > > > > Please review and vote. The vote will remain open for at least 72 hours, > > until <YYYY-MM-DD HH:MM UTC>, or until the necessary number of binding > > votes is reached. > > > > [ ] +1 Release this package as Apache Airflow Java SDK 1.0.0-beta1 > > [ ] +0 No opinion > > [ ] -1 Do not release, because ... > > > > Only votes from Airflow PMC members are binding, but everyone is welcome > > and encouraged to test the release and vote. > > > > Here is how you can verify the release before voting: > > > > - Download the source package, its .asc signature and .sha512 checksum > > from the dist/dev URL above. > > - Verify the checksum: shasum -a 512 -c > > apache-airflow-java-sdk-1.0.0-beta1-src.tar.gz.sha512 > > - Import the KEYS file and verify the signature: gpg --import KEYS gpg > > --verify apache-airflow-java-sdk-1.0.0-beta1-src.tar.gz.asc > > - Unpack the source and build/test it with a locally installed Gradle > (the > > source package is source-only and does not bundle the Gradle wrapper > JAR): > > gradle build > > - Optionally, resolve the staged convenience binaries from the Nexus URL > > above and smoke-test them in a sample project. > > > > For more details on ASF release verification, see: > > https://www.apache.org/info/verification.html > > > > Best, > > TP > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: [email protected] > > For additional commands, e-mail: [email protected] > > > > >
