This vote email has been called off, please refer to the new vote thread. https://lists.apache.org/thread/o31pnwyd5h502kcmfcopr67vp3sc0kqy
On Wed, 23 Sept 2026 at 14:06, YuanSheng Wang <[email protected]> wrote: > > +0 (binding) > > I verified the Apache APISIX 3.19.0 release candidate. > > The following checks passed: > > 1. All release links were reachable. > 2. The SHA512 checksum matched. > 3. The GPG signature was valid and was made by [email protected]. > 4. LICENSE and NOTICE were present. > 5. No compiled binary files were found. > 6. All 387 Lua files passed LuaJIT syntax checks. > > However, I cannot vote +1 because the source archive does not match > the announced release commit 40989f1b859174dc613a41a2b3022b0287f0b94c. > > Five packaged files differ from that commit: > > - CHANGELOG.md > - Makefile > - apisix/init.lua > - apisix/plugins/traffic-split.lua > - apisix/upstream.lua > > The last three are runtime source files. Their changes come from the > later commit 51d3d6527, while the packaged changelog is closer to > commit 3c066c03f. In fact, 410 of the 411 packaged files match > 3c066c03f; the remaining file, Makefile, contains an additional > signer-specific modification: > > --local-user "[email protected]" > > I could not find this Makefile modification in the checked Git > history. Therefore, the release source archive cannot be reproduced > from the announced release commit and appears to have been generated > from a working tree containing later commits and a local modification. > > I recommend regenerating the release candidate from a clean, fully > committed tree and publishing the exact corresponding release commit > before proceeding. > > A full build was not completed because the verification host did not > have OpenResty or a running Docker daemon. > > Verified on Darwin 25.6.0 arm64, GPG 2.5.21, shasum 6.02. > > Regards, > Yuansheng Wang > > > On Mon, Sep 21, 2026 at 4:12 PM Abhishek Choudhary < > [email protected]> wrote: > > > Hello, Community, > > > > This is a call for the vote to release Apache APISIX version > > > > Release notes: > > > > https://github.com/apache/apisix/blob/release/3.19/CHANGELOG.md#3190 > > > > The release candidates: > > > > https://dist.apache.org/repos/dist/dev/apisix/3.19.0/ > > > > Release Commit ID: > > > > > > https://github.com/apache/apisix/commit/40989f1b859174dc613a41a2b3022b0287f0b94c > > > > Keys to verify the Release Candidate: > > > > https://dist.apache.org/repos/dist/dev/apisix/KEYS > > > > Steps to validating the release: > > > > 1. Download the release > > > > wget > > https://dist.apache.org/repos/dist/dev/apisix/3.19.0/apache-apisix-3.19.0-src.tgz > > > > 2. Checksums and signatures > > > > wget https://dist.apache.org/repos/dist/dev/apisix/KEYS > > > > wget > > https://dist.apache.org/repos/dist/dev/apisix/3.19.0/apache-apisix-3.19.0-src.tgz.asc > > > > wget > > https://dist.apache.org/repos/dist/dev/apisix/3.19.0/apache-apisix-3.19.0-src.tgz.sha512 > > > > gpg --import KEYS > > > > shasum -c apache-apisix-3.19.0-src.tgz.sha512 > > > > gpg --verify apache-apisix-3.19.0-src.tgz.asc apache-apisix-3.19.0-src.tgz > > > > 3. Unzip and Check files > > > > tar zxvf apache-apisix-3.19.0-src.tgz > > > > 4. Build Apache APISIX: > > > > curl -sL > > https://raw.githubusercontent.com/apache/apisix/release/3.19/utils/install-dependencies.sh > > | APISIX_RUNTIME=1.3.18 bash - > > > > export PATH=$PATH:/usr/local/openresty/bin/ > > > > luarocks install apisix-master-0.rockspec --tree deps --only-deps > > > > 4.1 To build Apache APISIX from GitHub source code, please refer to: > > > > > > https://github.com/apache/apisix/blob/release/3.19/docs/en/latest/building-apisix.md#building-apisix-from-source > > > > The vote will be open for at least 72 hours or until the necessary number > > of > > votes are reached. > > > > Please vote accordingly: > > > > [ ] +1 approve > > [ ] +0 no opinion > > [ ] -1 disapprove with the reason > > > > > -- > > *MembPhis* > My GitHub: https://github.com/membphis > Apache APISIX: https://github.com/apache/apisix
