Hi all,
Thank you all for the detailed verification and the votes — the
builds from source, Kerberos smoke tests, Helm checks and license
reviews are exactly what this vote needs.
Here is a summary of the follow-up items raised in this thread,
with their status:
1. Binary LICENSE: jersey containers listed under AL-2.0 while
Jersey is EPL 2.0, and jersey-core missing (Jiwon, adding to
Xu Bai's list)
Tracked as #4381 and already fixed on master by #4382
("Fix and extend third-party license documentation in
LICENSE-binary", merged 2026-09-20). Thanks Jiwon for the
quick PR. Since it postdates the RC10 tag, the corrected
LICENSE-binary will be included in the next release.
2. Frontend third-party license files under amoro-web/licenses
are not propagated into the binary distribution (Xu Bai)
Agreed this should be improved. I will open a tracking issue
and extend the binary assembly so the frontend license
metadata is carried into the distribution, targeting the
next release.
3. Pushing an RC tag publishes images to the public Docker Hub
repository and overwrites apache/amoro:latest (Xu Bai)
Confirmed — this also happened during this cycle. I will fix
the docker-images workflow to ignore *-rc* tags (publishing
only on final release tags) before the official release is
finalized, and re-check that latest points at the last
released version afterwards.
4. Website https://amoro.apache.org/docs/latest/ fails to load
(Tao Wang)
I can reproduce it and will investigate on the site
repository, where the fix will be filed and tracked. This
does not affect the release artifacts themselves.
5. [jdk17] java.security.jgss does not export
sun.security.krb5 to unnamed module (Tao Wang)
Tracked as #4384. To be fixed for the next release; in the
meantime JDK 11 remains the recommended runtime for the
binary distribution, as documented.
None of the above blocks this vote, so unless objections arise
I will send the [RESULT][VOTE] shortly and then move the
candidate to the IPMC vote on [email protected].
Thanks again for helping push 0.9.0 forward.
Best regards,
czy006 (Conrad Jam)
tao wang <[email protected]> 于2026年9月20日周日 18:15写道：
> Hi,
>
> Thanks for the work!
>
> +1 (binding)
>
> I verified the RC10 candidate with the following results:
>
> - The source tag and release artifacts are consistent.
> - SHA-512 checksums and PGP signatures are valid.
> - The source archive has a single top-level directory.
> - LICENSE, NOTICE, and DISCLAIMER are present, and the Amoro NOTICE
> copyright year is 2024-2026.
> - Apache RAT check passed.
> - Maven validation passed.
> - The project builds successfully from the source artifact with JDK 11, 17.
> - launch the hadoop2 package with jdk11 in server
> - configure a kerberos hms as iceberg catalog
> - configure a kerberos hms as mixed_iceberg catalog
>
> i found two small issues which does not block the release:
> 1、office web site can't load correctly when access
> https://amoro.apache.org/docs/latest/
> 2、 [jdk17]java.security.jgss does not export sun.security.krb5 to unnamed
> module (#4384 <https://github.com/apache/amoro/issues/4384>)
>
> Jiwon Park <[email protected]> 于2026年9月18日周五 15:53写道：
>
> > +1 (non-binding)
> >
> > Verified rc10:
> > - Checksums/signatures valid; source matches tag v0.9.0-rc10 (a9e69a6),
> no
> > binaries.
> > - LICENSE/NOTICE/DISCLAIMER present; RAT passed.
> > - Built from source (JDK 11, incl. dashboard); V3 guard tests pass.
> > - hadoop3 binary: local Iceberg V2 table compacted by optimizer; V3 table
> > correctly skipped by the #4375 guard.
> > - helm lint passes; staging artifacts spot-checked.
> >
> > One note on the binary LICENSE, adding to Xu Bai's list:
> > org.glassfish.jersey.containers:jersey-* is listed under Apache License
> > 2.0,
> > but Jersey is EPL 2.0, and org.glassfish.jersey.core:* is not listed.
> > Not blocking my vote; tracked in an issue and I'll send a PR.
> >
> > Thanks for the release work.
> >
> > Best regards,
> > Jiwon
> >
> >
> > > 2026. 9. 18. 오후 12:04, Jinsong Zhou <[email protected]> 작성:
> > >
> > > Hi,
> > >
> > > Thanks for the work to push forward the new release!
> > >
> > > +1 (binding)
> > >
> > > I verified the RC10 candidate with the following results:
> > >
> > > - The source tag and release artifacts are consistent.
> > > - SHA-512 checksums and PGP signatures are valid.
> > > - The source archive has a single top-level directory.
> > > - LICENSE, NOTICE, and DISCLAIMER are present, and the Amoro NOTICE
> > > copyright year is 2024-2026.
> > > - Apache RAT check passed.
> > > - Maven validation passed.
> > > - The project builds successfully from the source artifact with JDK 11,
> > 17.
> > >
> > > Best，
> > > Jinsong
> > >
> > >> On Thu, Sep 17, 2026 at 10:14 AM Xavier Bai <[email protected]> wrote:
> > >>
> > >> +1 (binding)
> > >>
> > >> I verified the RC10 candidate with the following results:
> > >>
> > >> - The source tag and release artifacts are consistent.
> > >> - SHA-512 checksums and PGP signatures are valid.
> > >> - The source archive has a single top-level directory.
> > >> - The top-level site/ directory is excluded, while docs/ is retained.
> > >> - LICENSE, NOTICE, and DISCLAIMER are present, and the Amoro NOTICE
> > >> copyright year is 2024-2026.
> > >> - Apache RAT check passed.
> > >> - Maven validation passed.
> > >> - The project builds successfully from the source artifact with JDK
> 11,
> > 17.
> > >> - The dashboard build passed.
> > >> - The Helm chart unit tests passed: 87 tests in 8 suites.
> > >> - The shaded Spark runtime JARs contain the corrected Amoro NOTICE.
> > >>
> > >> I also noticed two follow-up items:
> > >>
> > >> 1. The frontend third-party license files under amoro-web/licenses are
> > not
> > >> propagated into the binary distribution. The binary licensing
> metadata
> > >> should be reviewed and improved for the next candidate/release.
> > >> 2. Pushing an RC tag currently publishes images to the public Docker
> Hub
> > >> repository and overwrites apache/amoro:latest. The Docker publishing
> > >> workflow should exclude release-candidate tags.
> > >>
> > >> I do not consider these issues blocking for my vote, but I recommend
> > >> tracking
> > >> and addressing them promptly.
> > >>
> > >> Best,
> > >> Xu Bai
> > >>
> > >> ConradJam <[email protected]> 于2026年9月16日周三 16:06写道：
> > >>
> > >>> Hello Amoro community,
> > >>>
> > >>> This is the tenth release candidate for Apache Amoro (incubating)
> > >>> 0.9.0-incubating.
> > >>>
> > >>> This vote supersedes and cancels the RC8 vote opened on Sep 9, which
> > >>> received no votes. It also supersedes the RC9 candidate, which I
> > retired
> > >>> before opening its vote after Jiwon Park reported a pre-vote blocker
> > >>> (#4375): with Iceberg 1.8.1, writers could omit the next-row-id
> > property
> > >>> when committing to V3 format-version tables, making those tables
> > >>> unreadable by Iceberg 1.9+ readers. The fix (#4376) is included in
> this
> > >>> RC.
> > >>>
> > >>> Changes since RC8:
> > >>>
> > >>> * [AMORO-4375][Iceberg] Prevent automatic changes to unsupported V3
> > >>> tables (#4376)
> > >>> * [AMORO-4350][catalog] Fix Hive view handling in table management
> > >>> (#4351)
> > >>> * [AMORO-4368][Dashboard] Fix Tables menu navigation after viewing
> Hive
> > >>> tables (#4369)
> > >>> * [AMORO-4353] Set standby node state to FOLLOWER after base services
> > >>> start (#4371)
> > >>> * [AMORO-4357][Docs] Document the table. prefix requirement for
> > >>> catalog-level table properties (#4358)
> > >>> * [Hotfix] Remove NOTICE/LICENSE filter from shade filters (#4370)
> > >>> * [web-console][dependency] Upgrade frontend to Vue 3.5 and Vite 8
> > >>> toolchain, lazy-load monaco (#4340)
> > >>> * [hotfix][Metrics] Iterate a locked table-runtime snapshot in gauges
> > >>> (#4326)
> > >>> * [AMORO-4359][AMS] Support AWS Secrets Manager as a ConfigShade
> > (#4360)
> > >>>
> > >>> The RC tag is v0.9.0-rc10, cut from master.
> > >>>
> > >>> Release artifacts:
> > >>>
> > >>>
> > >>
> >
> https://dist.apache.org/repos/dist/dev/incubator/amoro/0.9.0-incubating-RC10/
> > >>>
> > >>> KEYS:
> > >>> https://downloads.apache.org/incubator/amoro/KEYS
> > >>>
> > >>> Maven staging repository:
> > >>>
> > https://repository.apache.org/content/repositories/orgapacheamoro-1087/
> > >>>
> > >>> Git tag:
> > >>> https://github.com/apache/amoro/tree/v0.9.0-rc10
> > >>>
> > >>> Website:
> > >>> https://amoro.apache.org/
> > >>>
> > >>> ====================================== VOTE
> > >>> ======================================
> > >>>
> > >>> This vote will be open for at least 72 hours and passes if at least
> > >>> three Amoro PPMC members vote +1 and no binding -1 is cast.
> > >>>
> > >>> [ ] +1 Release this package as Apache Amoro (incubating)
> > 0.9.0-incubating
> > >>> [ ] +0
> > >>> [ ] -1 Do not release this package (please explain why)
> > >>>
> > >>> =========================== HOW TO VERIFY THE RELEASE
> > >>> ===========================
> > >>>
> > >>> * Check the download links above are valid.
> > >>> * Verify checksums and signatures of the artifacts against the KEYS
> > >>> file; all artifacts are signed with PGP key 84027FCC19B0D30B
> > >>> (Apache ID: czy006).
> > >>> * Check LICENSE, NOTICE, and DISCLAIMER are present, and that the
> > >>> source release contains no unexpected binaries.
> > >>> * Check all source files have Apache license headers.
> > >>> * Build the project from source: mvn clean package -DskipTests
> > >>> (JDK 11).
> > >>> * Spot-check the Maven staging repository for the expected artifacts.
> > >>>
> > >>> Thanks,
> > >>> czy006 (Conrad Jam)
> > >>>
> > >>
> >
>
