+0 (binding) I verified the Apache APISIX 3.19.0 release candidate.
The following checks passed: 1. All release links were reachable. 2. The SHA512 checksum matched. 3. The GPG signature was valid and was made by [email protected]. 4. LICENSE and NOTICE were present. 5. No compiled binary files were found. 6. All 387 Lua files passed LuaJIT syntax checks. However, I cannot vote +1 because the source archive does not match the announced release commit 40989f1b859174dc613a41a2b3022b0287f0b94c. Five packaged files differ from that commit: - CHANGELOG.md - Makefile - apisix/init.lua - apisix/plugins/traffic-split.lua - apisix/upstream.lua The last three are runtime source files. Their changes come from the later commit 51d3d6527, while the packaged changelog is closer to commit 3c066c03f. In fact, 410 of the 411 packaged files match 3c066c03f; the remaining file, Makefile, contains an additional signer-specific modification: --local-user "[email protected]" I could not find this Makefile modification in the checked Git history. Therefore, the release source archive cannot be reproduced from the announced release commit and appears to have been generated from a working tree containing later commits and a local modification. I recommend regenerating the release candidate from a clean, fully committed tree and publishing the exact corresponding release commit before proceeding. A full build was not completed because the verification host did not have OpenResty or a running Docker daemon. Verified on Darwin 25.6.0 arm64, GPG 2.5.21, shasum 6.02. Regards, Yuansheng Wang On Mon, Sep 21, 2026 at 4:12 PM Abhishek Choudhary < [email protected]> wrote: > Hello, Community, > > This is a call for the vote to release Apache APISIX version > > Release notes: > > https://github.com/apache/apisix/blob/release/3.19/CHANGELOG.md#3190 > > The release candidates: > > https://dist.apache.org/repos/dist/dev/apisix/3.19.0/ > > Release Commit ID: > > > https://github.com/apache/apisix/commit/40989f1b859174dc613a41a2b3022b0287f0b94c > > Keys to verify the Release Candidate: > > https://dist.apache.org/repos/dist/dev/apisix/KEYS > > Steps to validating the release: > > 1. Download the release > > wget > https://dist.apache.org/repos/dist/dev/apisix/3.19.0/apache-apisix-3.19.0-src.tgz > > 2. Checksums and signatures > > wget https://dist.apache.org/repos/dist/dev/apisix/KEYS > > wget > https://dist.apache.org/repos/dist/dev/apisix/3.19.0/apache-apisix-3.19.0-src.tgz.asc > > wget > https://dist.apache.org/repos/dist/dev/apisix/3.19.0/apache-apisix-3.19.0-src.tgz.sha512 > > gpg --import KEYS > > shasum -c apache-apisix-3.19.0-src.tgz.sha512 > > gpg --verify apache-apisix-3.19.0-src.tgz.asc apache-apisix-3.19.0-src.tgz > > 3. Unzip and Check files > > tar zxvf apache-apisix-3.19.0-src.tgz > > 4. Build Apache APISIX: > > curl -sL > https://raw.githubusercontent.com/apache/apisix/release/3.19/utils/install-dependencies.sh > | APISIX_RUNTIME=1.3.18 bash - > > export PATH=$PATH:/usr/local/openresty/bin/ > > luarocks install apisix-master-0.rockspec --tree deps --only-deps > > 4.1 To build Apache APISIX from GitHub source code, please refer to: > > > https://github.com/apache/apisix/blob/release/3.19/docs/en/latest/building-apisix.md#building-apisix-from-source > > The vote will be open for at least 72 hours or until the necessary number > of > votes are reached. > > Please vote accordingly: > > [ ] +1 approve > [ ] +0 no opinion > [ ] -1 disapprove with the reason > -- *MembPhis* My GitHub: https://github.com/membphis Apache APISIX: https://github.com/apache/apisix
