Recalling. Fixes to the artifact issues are proposed in https://github.com/apache/airflow/pull/69582
Please feel free to take a look before it goes in so we can fix issues directly without going through an extra RC. Otherwise I plan to cut RC3 tomorrow after merging the PR. Thanks a lot for the help to verify things! TP > On Jul 7, 2026, at 22:02, Jarek Potiuk <[email protected]> wrote: > > -1: (binding) -> because of gradlew embedding in source package (see below) > > Also technically, we do not "vote" on convenience packages distributed > elsewhere and not placed in the "dist" SVN, but I still think it's worth > fixing convenience binary issues. > >> Licenses: source package is fine (LICENSE, NOTICE, headers), but the > staged >> jars have no LICENSE/NOTICE under META-INF. > > Yeah - https://www.apache.org/legal/release-policy.html#what -> > LICENCE/NOTICE should be present in the convenience binary packages as well > - if they are missing - we should add them - we should not release artifact > without it. > >> Reproducibility: local build matches the staged jars content-wise, but not >> byte-for-byte (zip timestamps), which should be solved by setting >> appropriate flags. Do we generally aim for byte-reproducibility? > > Reproducibility is optional "formally" - but it's also quite easy to > achieve in Maven: > https://maven.apache.org/guides/mini/guide-reproducible-builds.html has > all the instructions. And it's a prerequisite for using Github driven > publishing (coming soon I hope finally) and the sooner we enable and test > it the better we will be able to fix all small issues with it (it took > quite a while to get reproducibility issues solved for other artifacts, so > might be good idea to at least attempt it now > . >> 2. Regarding gradle - the SHA256 you posted is the wrapper.jar checksum, > not the bin.zip one, so ./gradlew fails verification on a clean machine. > > Actually that's one of the things that makes me vote -1 for the source > release. > > We are not supposed to have binaries in our source releases - not even the > commonly used gradlew for Maven that is customarily put in the repo. It's > ok to keep gradlew in the repo, but not ok to release it as part of our > "source" release - we need to exclude it (via gitattributes). > > This is a legal matter that has many nuances—unfortunately. There were > loooong discussions about it in "legal-discuss" of the ASF. The last > discussion > is here: https://lists.apache.org/thread/07y5nj2mkhkq1gq1k9q5y6g2k6hjr61v. > The conclusion is that you should either describe in the README how to > download gradlew using the source script + a way to verify it (Shasum), or > describe how to do it in the README. Adding binaries to the source code > release is not allowed. We can only have "sources" in the source release. > > J, > > > > > On Tue, Jul 7, 2026 at 9:26 PM Shahar Epstein <[email protected]> wrote: > >> Thanks for running this, TP! >> >> I went through the release verification process, and got some questions >> before voting: >> >> Checksums: no issues. >> Signatures: no issues. >> SVN: no issues. >> >> Licenses: source package is fine (LICENSE, NOTICE, headers), but the staged >> jars have no LICENSE/NOTICE under META-INF. >> ASF policy requires them in every distributed artifact. Would this be fixed >> in a following RC, or before GA? >> >> Reproducibility: local build matches the staged jars content-wise, but not >> byte-for-byte (zip timestamps), which should be solved by setting >> appropriate flags. Do we generally aim for byte-reproducibility? >> >> Build and all 63 tests pass otherwise. >> >> Few more notes: >> 1. Nexus also stages airflow-sdk-jpl and airflow-sdk-gradle-plugin, which >> aren't in the vote email's artifact list - worth including in the >> [RESULT]/announce (?) >> 2. Regarding gradle - the SHA256 you posted is the wrapper.jar checksum, >> not the bin.zip one, so ./gradlew fails verification on a clean machine. >> The right value is >> f1771298a70f6db5a29daf62378c4e18a17fc33c9ba6b14362e0cdf40610380d. >> 3. Do you plan to publish official release verification instructions on >> GitHub anytime soon? >> >> >> Shahar >> >> >> On Tue, Jul 7, 2026 at 7:33 PM Tzu-ping Chung <[email protected]> wrote: >> >>> Hello, >>> >>> I would like to call a vote to release Apache Airflow Java SDK >>> 1.0.0-beta1, based on release candidate 1.0.0-beta1-rc2. >>> >>> This is a beta release. It is intended for testing and early adoption by >>> users and developers outside the project; APIs may still change before >> the >>> 1.0.0 general-availability release. It is a full, formal ASF release >>> (source package + convenience binaries), not a snapshot or nightly build. >>> >>> Changes since rc1: <SUMMARY OF WHAT CHANGED IN rc2 -- e.g. review >> feedback >>> addressed from the rc1 thread; add PR links if helpful, or delete this >> line> >>> >>> The release candidate contains the following Maven artifacts, all under >>> group id org.apache.airflow: >>> >>> - airflow-sdk >>> - airflow-sdk-jul >>> - airflow-sdk-log4j2 >>> - airflow-sdk-processor >>> - airflow-sdk-slf4j >>> - airflow-sdk-bom >>> >>> Git tag / commit being voted on: >>> >>> - Tag: java-sdk/1.0.0-beta1-rc2 >>> - Commit: 8f9a17ddeac523bf46a0544b95201eb57184fc31 >>> - >>> >> https://github.com/apache/airflow/releases/tag/java-sdk%2F1.0.0-beta1-rc2 >>> >>> Source release (the artifact being voted on), signatures and checksums: >>> https://dist.apache.org/repos/dist/dev/airflow/java-sdk/1.0.0-beta1-rc2/ >>> >>> Convenience binaries: staged in the ASF Nexus repository: >>> >> https://repository.apache.org/content/repositories/orgapacheairflow-1006/ >>> >>> KEYS file (public keys used to sign the release): >>> https://downloads.apache.org/airflow/KEYS >>> >>> There’s no changelogs since this is the first ever release. See the Java >>> SDK’s README for a list of features currently provided. >>> https://github.com/apache/airflow/tree/java-sdk/1.0.0-beta1-rc2/java-sdk >>> >>> There are no functionality changes compared to RC1; this candidate >>> includes fixes to the release process scripts so the artifacts are of the >>> correct formats. >>> >>> Please review and vote. The vote will remain open for at least 72 hours, >>> until <YYYY-MM-DD HH:MM UTC>, or until the necessary number of binding >>> votes is reached. >>> >>> [ ] +1 Release this package as Apache Airflow Java SDK 1.0.0-beta1 >>> [ ] +0 No opinion >>> [ ] -1 Do not release, because ... >>> >>> Only votes from Airflow PMC members are binding, but everyone is welcome >>> and encouraged to test the release and vote. >>> >>> Here is how you can verify the release before voting: >>> >>> - Download the source package, its .asc signature and .sha512 checksum >>> from the dist/dev URL above. >>> - Verify the checksum: shasum -a 512 -c >>> apache-airflow-java-sdk-1.0.0-beta1-src.tar.gz.sha512 >>> - Import the KEYS file and verify the signature: gpg --import KEYS gpg >>> --verify apache-airflow-java-sdk-1.0.0-beta1-src.tar.gz.asc >>> - Unpack the source and build/test it with a locally installed Gradle >> (the >>> source package is source-only and does not bundle the Gradle wrapper >> JAR): >>> gradle build >>> - Optionally, resolve the staged convenience binaries from the Nexus URL >>> above and smoke-test them in a sample project. >>> >>> For more details on ASF release verification, see: >>> https://www.apache.org/info/verification.html >>> >>> Best, >>> TP >>> --------------------------------------------------------------------- >>> To unsubscribe, e-mail: [email protected] >>> For additional commands, e-mail: [email protected] >>> >>> >>
