Remember to create a [Result][Vote] subject email with that summary. Either reply to this one and change it, or create a new email with the result. I guess we should standardize on which one. Perhaps the former is the simpler one?
On Sun, Aug 16, 2026 at 1:30 AM Jernej Frank <[email protected]> wrote: > Hi all, > > adding my +1 as well. > > The vote to release Apache Burr (Incubating) 0.43.0 RC1 has passed. > > The vote result is: > +1: 3 binding > - Stefan Krawczyk > - Jarek Potiuk > - Elijah ben Izzy > - Jernej Frank > > +1: 1 non-binding > - Viquar Khan > > +0: 0 > -1: 0 > > Vote thread: > https://lists.apache.org/thread/okv20r6v8f31qobgqvpqvqvgn1h5kj5c > > Thank you to everyone who reviewed and voted. I will now request approval > from the Incubator PMC. > > On behalf of the Apache Burr PPMC, > Jernej Frank > > On Sat, Aug 15, 2026 at 5:42 PM vaquar khan <[email protected]> > wrote: > > > +1 (non-binding) > > > > *Validated from source:* > > > > - Release branch and RC tag point at the same clean commit, no drift > > past what was put up for vote. > > - Source tree is clean: no node_modules, no built UI assets, no stray > > binaries or archives. The single burr/example symlink is tracked in > git > > and > > legitimate. > > - LICENSE, NOTICE, and DISCLAIMER are present. LICENSE-wheel carries > the > > generated third-party section covering the bundled npm packages, and > the > > license-generation check runs in CI, so the list won't drift silently > on > > the next dependency bump. This addresses the RC0 blocker. > > > > I did not re-verify the artifact checksums or GPG signatures; the binding > > voters have already covered that. > > > > Regards, > > Viquar Khan > > > > On Fri, Aug 14, 2026 at 11:38 PM Elijah ben Izzy < > > [email protected]> wrote: > > > > > +1 (binding) > > > > > > Checked: > > > - 9 artifacts, SHA512 + GPG all verify (Jernej's key, in KEYS) > > > - Source matches tag v0.43.0-incubating-RC1 (971a3530); RAT 0 > unapproved > > on > > > src > > > - LICENSE / NOTICE / DISCLAIMER present in src, sdist, wheel > > > - Re-checked the RC0 blocker: LICENSE-wheel covers all 130 npm packages > > in > > > the Vite bundle, all Cat-A (MIT/BSD-3/ISC/Apache-2.0/PSF), no Cat-X. > > > Independently spot-verified Jarek's 4 "legit absence" claims > > > (micromark-util-symbol, highlight.js, prismjs, reactflow sub-packages) > > plus > > > the top-20 by prominence -- all accounted for. MPL/CC-BY hits in > > > LICENSE-wheel are attribution text inside react-icons' own MIT license; > > no > > > react-icons subpackage is imported in the UI src and zero Ci*/Fa* hits > in > > > the shipped bundle. Not distributed. > > > - generate_wheel_license.py --check runs in release-validation.yml -- > > won't > > > drift silently on next dep bump. > > > - Fresh venv install of the wheel works: import burr, burr --help, > > tracking > > > server serves the Vite bundle (index-D7mZX6DE.js + index-CCnzmWxs.css) > at > > > HTTP 200. > > > > > > Non-blocking follow-ups for a later release (nothing here needs a new > > RC): > > > - Sdist filename apache-burr-0.43.0-incubating-sdist.tar.gz breaks the > > > PEP-517 <name>-<version>.tar.gz convention -- pip install <url> won't > > infer > > > the version. Worth reverting or calling out in the announce. > > > - Sdist ships without .rat-excludes -- RAT on sdist flags 21 demo > > log.jsonl > > > + 2 already-MIT-attributed deep-researcher .py. Ship .rat-excludes in > > sdist > > > next time, or add headers. > > > - burr.__version__ attribute missing; only > > > importlib.metadata.version("apache-burr") works. Minor DX. > > > - 3 duplicate "opentelemetry ... already instrumented" warnings on > server > > > start. Cosmetic. > > > > > > Stefan's #882 covers the earlier non-blockers. > > > > > > Thanks Jernej -- good turnaround on RC0. > > > > > > Elijah > > > > > > On Thu, Aug 13, 2026 at 4:03 AM Jarek Potiuk <[email protected]> wrote: > > > > > > > Hello Jernej, > > > > > > > > [X] +1 Release this as Apache Burr 0.43.0 (binding) > > > > [ ] +0 > > > > [ ] -1 Do not release this package because... (reason required) > > > > > > > > Checklist: > > > > [X] Download links are valid > > > > [X] Checksums and signatures are valid > > > > [X] LICENSE/NOTICE/DISCLAIMER files exist and are correct > > > > [X] No unexpected binary files in source > > > > [X] All source files have ASF headers > > > > [X] Can build and test from source > > > > > > > > I gave a binding -1 on RC0 over the wheel's LICENSE not accounting > for > > > the > > > > npm packages bundled into the compiled tracking UI. RC1 fixes that > > > > properly, > > > > so I am +1 here. > > > > > > > > On the LICENSE fix specifically, since it was the blocker: > > > > > > > > - LICENSE-wheel now carries a generated "THIRD-PARTY COMPONENTS > BUNDLED > > > IN > > > > THIS BINARY DISTRIBUTION" section listing 130 npm packages with > their > > > > licenses and copyright lines. Licenses are Apache-2.0, > BSD-3-Clause, > > > ISC, > > > > MIT and PSF -- no Category X. > > > > - It is generated, not hand-maintained: > > scripts/generate_wheel_license.py > > > > derives the list from a `vite build --sourcemap` run, resolving > each > > > > node_modules source back to its owning package. That is the right > way > > > to > > > > do this, and it is the part that makes me confident it will not > > > silently > > > > drift on the next dependency bump. > > > > - `generate_wheel_license.py --check` runs in CI > > > > (.github/workflows/release-validation.yml), so a stale list fails > the > > > > build rather than costing another RC. > > > > - All 130 listed entries match telemetry/ui/package-lock.json > versions > > > > exactly, and none of them is a dev-only dependency. > > > > - I spot-checked the packages that look like they *should* be in the > > list > > > > but are not -- micromark-util-symbol, highlight.js/lowlight, > prismjs, > > > > @floating-ui/core, reactflow, react-router-dom, character-entities > -- > > > by > > > > grepping the shipped minified bundle for their distinctive string > > > > literals. Each absence is legitimate: micromark ships > constant-folded > > > > builds so its symbol package contributes no code, the UI imports > > > > { Prism as SyntaxHighlighter } so the highlight.js path is > > tree-shaken > > > > out, and the rest are type-only or re-export-only. The list is > > > accurate, > > > > not merely plausible. > > > > > > > > The rest of my verification: > > > > > > > > - All three SHA-512 checksums verify, and all three detached > signatures > > > are > > > > good against the KEYS file at > > > > https://downloads.apache.org/incubator/burr/KEYS, signed by Jernej > > > > Frank, > > > > 3959 450E 4AA8 9991 1547 112F 25CA 7FC3 4D7C 68C1. > > > > - The signed tag v0.43.0-incubating-RC1 (object 30f4a9aa, commit > > > 971a3530) > > > > matches the tag on GitHub. The source tarball is byte-identical to > > that > > > > tag: 820 files, every SHA-256 equal. > > > > - No compiled objects, archives or built UI assets in the source > > > artifact. > > > > The single symlink (burr/examples -> ../examples) is present in git > > > too. > > > > - scripts/check_asf_headers.py reports clean. > > > > - `twine check` passes on the wheel and the sdist, and the project's > > own > > > > verify_apache_artifacts.py signatures/artifacts checks pass on all > > > three > > > > artifacts. > > > > - Python test suite from the source tarball on 3.12: 665 passed, 5 > > > skipped. > > > > The two Ray tests did not run in my sandbox (Ray wants /tmp/ray and > > > unix > > > > sockets); that is my environment, not the release. > > > > - The released wheel installs cleanly, reports 0.43.0, and the core, > > > > tracking and server modules import with the relevant extras. > > > > > > > > Two cosmetic follow-ups for a later release, on top of the ones > Stefan > > > > already raised in #882: > > > > > > > > - scripts/README.md's policy table says tests ship in the sdist, but > > the > > > > sdist has no tests/ directory. They are in the voting src.tar.gz, > so > > > the > > > > artifacts are fine -- it is the doc that is out of step. > > > > - verify_apache_artifacts.py's `signatures` command reports FAIL for > > > every > > > > non-artifact file that happens to sit in the directory it scans (it > > > > flagged the KEYS file I had downloaded alongside the artifacts as > > > > "missing .asc"). Worth filtering to the expected artifact names so > > > voters > > > > do not see spurious failures. > > > > > > > > Thanks for turning RC0 around quickly. > > > > > > > > Jarek > > > > > > > > > >
