-1 (non-binding) for apache-airflow-providers-fab 3.8.1rc1. With the default signature verification enabled, this RC breaks Azure AD SSO for deployments that configure the tenant authority using a domain name (for example, `contoso.onmicrosoft.com`) or an uppercase tenant GUID.
The regression was introduced by #71735, which compares the configured tenant identifier directly with the canonical lowercase tenant GUID in the token issuer. A reproducer and proposed fix are available in: https://github.com/apache/airflow/pull/71920 Regards, Aaron On Thu, Aug 20, 2026 at 10:32 PM Jarek Potiuk <[email protected]> wrote: > +1 (binding) > > Verified the 2026-08-18 provider RC (29 providers) against the wave tag > providers/2026-08-18 -> e361f70cf5e9c7a9f1b1bb33cc6e4944cfc86a24: > > * SVN dev folder complete: 177 files = 29 x (whl + sdist + .asc + .sha512) > plus the source tarball trio. 59 .sha512 / 59 .asc, no stray > double-extension files. > * SHA512: 59/59 OK. > * GPG: 59/59 good signatures, all from your key > 750AFEC5987689E9B5A0AF7649123319D1045F49 (in KEYS, rsa4096, > expires 2027-08-18). > * Reproducible build: 59/59 byte-identical. Rebuilt all 29 wheels and > sdists from a clean checkout of the wave tag, plus the full source > tarball - every artifact matches the staged one bit for bit. > * Tags: all 29 rc tags and the wave tag on apache/airflow point at > e361f70, which is on main. > * Versions: all 29 pyproject versions match the top changelog entry. > * PyPI: all 29 rc packages resolve. > * RAT 0.18: 0 unapproved, 0 unknown (9962 files, all AL2.0). > > > Thanks for running the release, Hussein. > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
