-1 (binding)
Reason: the convenience wheel bundles 130 third-party npm packages and
its LICENSE names one of them. Details in (A) below. Everything else I
checked passes, and the provenance story is the best I've seen from
this podling so far -- so this is a narrow objection with a mechanical
fix, not a rejection of the RC's substance.
What I verified (all green):
[x] All 9 expected files present; SHA-512 matches on all three
artifacts.
[x] GPG signatures valid on all three, key
3959450E4AA899911547112F25CA7FC34D7C68C1 (Jernej Frank
<[email protected]>), present in the published KEYS file and
at people.apache.org/keys/committer/jernejfrank.asc. jernejfrank
is a PPMC member per public_ldap_projects.json.
[x] Source tarball is byte-identical to the git tree at
v0.43.0-incubating-RC0 (36d144c3e5153bd0d12d0c8aa94ae1da8d793544,
confirmed against the GitHub API): 988/988 entries match on
content, mode and symlinks. Zero differences.
[x] sdist is a strict subset of the source tarball -- all 387 shared
files byte-identical.
[x] Wheel: all 92 .py files byte-identical to the source tarball.
[x] Wheel UI bundle is exactly reproducible. `npm ci && npm run build`
from the voted source tarball (Node 26.4.0, npm 11.17.0) produced
all 7 files in burr/tracking/server/build/ byte-identical to the
released wheel, including the content-hashed filenames
index-D6PAStjx.js and index-CCnzmWxs.css. Together with the .py
check, 100% of the wheel is now accounted for from the voted
source. Nice work -- this is not common.
[x] LICENSE/NOTICE/DISCLAIMER present in all three artifacts;
NOTICE, DISCLAIMER and LICENSE-wheel byte-identical across them.
DISCLAIMER is the standard incubator text.
[x] Apache RAT 0.18 with the project's .rat-excludes: 0 unapproved,
0 unknown. An independent header sweep of every text source file
found only 5 without an ASF header, all GitHub issue/PR
templates. All 14 third-party source files carry correct MIT
attribution matching LICENSE.
[x] No compiled binaries, no node_modules, no .git, no pre-built UI
in source or sdist. BentoBurr submodule dir empty, as expected.
[x] No Category X licenses anywhere.
[x] No telemetry or analytics endpoints in the built UI bundle.
[x] Tests from the source tarball: 687 passed, 4 skipped (see (1)).
[x] Wheel installs clean in a fresh Python 3.12 venv with [learn];
UI serves, demo projects load, API responds.
[x] 0.43.0 correctly not yet on PyPI. Downloads page follows release
policy (closer.lua mirror, downloads.apache.org for .asc/.sha512,
KEYS, archive link).
(A) BLOCKER: LICENSE-wheel does not cover the bundled npm code
burr/tracking/server/build/assets/index-D6PAStjx.js (1,758,543 bytes)
is the only non-source content in the wheel. I enumerated exactly what
goes into it from the build sourcemap: 130 distinct npm packages, in
five license families.
113 (+2 nested) MIT
9 ISC -- @ungap/structured-clone, d3-color,
d3-dispatch, d3-drag, d3-interpolate,
d3-selection, d3-timer, d3-transition,
d3-zoom
3 Apache-2.0 -- @react-aria/focus,
@react-aria/interactions,
@react-aria/utils
2 BSD-3-Clause -- [email protected],
[email protected]
1 PSF -- [email protected]
dist-info/licenses/LICENSE-wheel is ALv2 plus a single third-party
section, the deep-researcher MIT text. None of the above is listed.
BSD-3-Clause in particular requires the copyright notice be reproduced
in redistributions.
Two things sharpen this. First, it was raised on the 0.42.0 RC3 thread
(2026-04-29, point 2) and hasn't been acted on. Second, the CRA -> Vite
migration (#793) dropped the webpack-emitted main.*.js.LICENSE.txt
sidecar, so 0.43.0 ships strictly less third-party license information
than 0.42.0 did.
Two things make it cheaper to fix than it looks. None of the 130
bundled packages ships a NOTICE file, so the wheel's NOTICE needs no
changes at all -- this is LICENSE-only. And the list is mechanically
derivable: `vite build --sourcemap`, parse the sources array, map each
node_modules path to its package.json license. That can run in CI so
it never drifts again. rollup-plugin-license does the same job as a
build step if you'd rather not hand-roll it.
Worth noting separately that .rat-excludes skips
burr/tracking/server/build/** along with METADATA/WHEEL/RECORD, so
"RAT on the wheel: 0 issues" doesn't actually inspect the only content
the wheel adds over the sdist.
Non-blocking observations:
(1) `pytest tests/` from the source release aborts at collection.
tests/integrations/test_bip0042_bedrock.py:24 does
`from botocore.exceptions import ClientError` before the
`pytest.importorskip("boto3")` guard on line 29, so the guard is
dead code. boto3 is only in the [bedrock] extra, not [tests], so
a voter following scripts/README.md gets "Interrupted: 1 error
during collection" and zero tests run. CI doesn't catch it
because python-package.yml passes
--ignore=tests/integrations/test_bip0042_bedrock.py. With boto3
installed, 687 pass / 4 skip. Moving the botocore import below
the importorskip fixes it. This is the same shape as the RC2
blocker on 0.42.0, so it may be worth a CI job that runs the
documented voter workflow verbatim.
(2) GET /api/v0/version returns 500 on a clean install.
burr/tracking/server/run.py:345 imports pkg_resources, which
isn't a declared dependency, isn't present in modern venvs, and
is removed in setuptools >= 81. No UI component calls it, so it's
invisible in normal use, but it is a public endpoint and is in
the generated OpenAPI client. importlib.metadata.version() is the
drop-in replacement.
(3) npm advisories in production dependencies. A fresh npm ci from
the shipped lockfile reports 16 advisories, 7 of them (1 moderate,
6 high) with --omit=dev. I checked each against the build
sourcemap; two actually reach users:
- [email protected], high, GHSA-qwww-vcr4-c8h2 (RSC mode CSRF
bypass). The UI is a static client-side SPA with no RSC or
server actions, so I don't think this is exploitable here,
but the pinned version is inside the advisory range and
reviewers will keep hitting it.
- [email protected], moderate, unsanitized class
attribute. 28 modules in the bundle, reachable via
react-markdown, which renders trace and chat content. This
one has a plausible runtime path and deserves a look.
postcss, minimatch, glob and brace-expansion are build-time only
-- confirmed 0 modules each in the shipped bundle. Given the
changelog line "Resolve npm security vulnerabilities", it's worth
making clear which of these are considered accepted.
(4) website/public/logos/taskhuman.svg is a third-party company mark
shipped in the voted source archive with no provenance or
permission recorded and no LICENSE entry. RAT skips it because
**/*.svg is excluded. Same class: the four
docs/_static/video_*_thumbnail.jpg YouTube thumbnails.
(5) Condition.safe_expr: the sandbox itself holds up well -- I
confirmed __import__, dunder traversal, lambdas, comprehensions
and open() are all rejected at construction time, with a
reject-by-default generic_visit. But ** and * are unbounded:
`2 ** 2 ** 30` and `'a' * 10 ** 9` both validate happily. Since
the docstring recommends safe_expr specifically for input from "a
dashboard rule editor... or any user input", a DoS caveat in the
docs (or an operand cap) would be worth adding.
(6) .rat-excludes justifies excluding burr-redirect/** on the grounds
that it "is not part of the ASF source release" -- but it is in
the voted src tarball. I checked its five files by hand and they
all carry ASF headers, so there's no live defect, just a
rationale that would hide a future regression.
(7) Housekeeping: dist/release/incubator/burr still holds both 0.41.0
and 0.42.0. Superseded releases should come off
downloads.apache.org and live at archive.apache.org, which the
project's own Downloads page already links to.
Happy to re-verify quickly on an RC1 -- everything above is scripted
on my end, so the turnaround is short. Thanks for putting the RC
together, and for the release tooling; the reproducible wheel in
particular made this much easier to check.
Jarek Potiuk
