+1 (binding)
I downloaded and verified apache-burr-0.43.0-incubating-RC0: - Download links: all 9 expected files present (src/sdist/wheel + .asc/.sha512 each) - SHA512 checksums: valid for all 3 artifacts - GPG signatures: valid, signed by Jernej Frank's key present in the published KEYS file - LICENSE/NOTICE/DISCLAIMER: present and correct in src, sdist, and wheel - No unexpected binaries: only expected doc/example images (png/svg/gif/ico); no compiled artifacts, node_modules, or .git in the source archive - ASF headers: ran Apache RAT (0.18) against src, sdist, and wheel — 0 license issues across 1107/433/207 files respectively - Compiled from source: built the UI (npm) and wheel (flit) from the voted source tarball; twine check passed; the resulting wheel is content-identical to the released wheel - Git tag v0.43.0-incubating-RC0 matches the released source tarball content - Installed the wheel, ran a basic Burr application smoke test successfully, and ran the test suite from source (666 passed, 4 skipped, 0 failed) One non-blocking note for the release scripts: `scripts/verify_apache_artifacts.py all`'s reproducible-build check rebuilds the sdist from the extracted src.tar.gz, but flit's VCS-based file inclusion needs a `.git` directory to honor the [tool.flit.sdist] include list — since src.tar.gz intentionally excludes `.git`, that rebuild silently drops tests/examples/docs assets and reports a checksum mismatch. I confirmed this is a script bug, not a release defect: rebuilding the sdist from the actual `v0.43.0-incubating-RC0` git tag via `scripts/apache_release.py sdist` produces a file that is byte-for-byte content-identical to the released sdist. Might be worth a follow-up fix to the verify script (e.g. rebuild from the git tag instead of the extracted src.tar.gz). Thanks for putting together the RC! Cheers, Stefan On Sun, Jul 26, 2026 at 2:07 PM [email protected] < [email protected]> wrote: > Hi all, > > I propose the following RC to be released as the official Apache Burr > 0.43.0 release. > > The artifacts for this release candidate can be found at: > https://dist.apache.org/repos/dist/dev/incubator/burr/0.43.0-incubating-RC0 > > The PyPI convenience package will be released from the same tag upon > succesful release. > > The Git tag to be voted upon is: > v0.43.0-incubating-RC0 > > Release artifacts are signed with the release manager's GPG key. The KEYS > file is available at: > https://downloads.apache.org/incubator/burr/KEYS > > Notable changes since 0.42.0: > - Add Langfuse tracing integration (LangfuseBridge) (#844) > - Migrate telemetry UI from Create React App to Vite (#793) > - Add dark mode to Burr UI with system preference and toggle (#830) > - Add Condition.safe_expr for opt-in restricted AST evaluation (#820) > - Allow plain dict yields in single-step streaming actions (#779) > - Add optional module allowlist to the pydantic serde deserializer (#794) > - Add burr-redirect package for the legacy burr PyPI name (#827) > - Fix tracking UI graph view freeze on dense state machines (#834) > - Use timezone-aware UTC for S3 log partitions (#811) > - Resolve npm security vulnerabilities (#773 plus dependabot updates) > - Restructure Burr UI documentation into a dedicated section (#815) > - Add Downloads page per ASF release policy (#771) > > Please download, verify, and test the release candidate. > > For detailed step-by-step instructions on how to verify this release, > please see the > "For Voters: Verifying a Release" section in the scripts/README.md file > within the > source archive. > > The vote will run for a minimum of 72 hours and close no earlier than: > 2026-07-29 20:32 UTC > > Please vote: > > [ ] +1 Release this as Apache Burr 0.43.0 > [ ] +0 > [ ] -1 Do not release this package because... (reason required) > > Only PPMC members have binding votes, but community votes are encouraged. > > Checklist for reference: > [ ] Download links are valid > [ ] Checksums and signatures are valid > [ ] LICENSE/NOTICE files exist > [ ] No unexpected binary files in source > [ ] All source files have ASF headers > [ ] Can compile from source > > On behalf of the Apache Burr PPMC, > Jernej Frank >
