ð On Sun, Aug 16, 2026 at 3:47â¯PM Jernej Frank <[email protected]> wrote:
> I changed the subject, is it not showing up in the email on your end? > > IMO option 1 with changing email subject keeps everything in one thread > and is easier navigate. > > > On 16 Aug 2026, at 21:22, Jernej Frank <[email protected]> wrote: > > > >  > > > > Regards, > > Jernej Frank > > > >>> On 16 Aug 2026, at 20:44, Stefan Krawczyk <[email protected]> > wrote: > >>> > >> Remember to create a [Result][Vote] subject email with that summary. > Either > >> reply to this one and change it, or create a new email with the result. > I > >> guess we should standardize on which one. Perhaps the former is the > simpler > >> one? > >> > >>> On Sun, Aug 16, 2026 at 1:30â¯AM Jernej Frank <[email protected]> > wrote: > >>> > >>> Hi all, > >>> > >>> adding my +1 as well. > >>> > >>> The vote to release Apache Burr (Incubating) 0.43.0 RC1 has passed. > >>> > >>> The vote result is: > >>> +1: 3 binding > >>> - Stefan Krawczyk > >>> - Jarek Potiuk > >>> - Elijah ben Izzy > >>> - Jernej Frank > >>> > >>> +1: 1 non-binding > >>> - Viquar Khan > >>> > >>> +0: 0 > >>> -1: 0 > >>> > >>> Vote thread: > >>> https://lists.apache.org/thread/okv20r6v8f31qobgqvpqvqvgn1h5kj5c > >>> > >>> Thank you to everyone who reviewed and voted. I will now request > approval > >>> from the Incubator PMC. > >>> > >>> On behalf of the Apache Burr PPMC, > >>> Jernej Frank > >>> > >>> On Sat, Aug 15, 2026 at 5:42â¯PM vaquar khan <[email protected]> > >>> wrote: > >>> > >>>> +1 (non-binding) > >>>> > >>>> *Validated from source:* > >>>> > >>>> - Release branch and RC tag point at the same clean commit, no drift > >>>> past what was put up for vote. > >>>> - Source tree is clean: no node_modules, no built UI assets, no > stray > >>>> binaries or archives. The single burr/example symlink is tracked in > >>> git > >>>> and > >>>> legitimate. > >>>> - LICENSE, NOTICE, and DISCLAIMER are present. LICENSE-wheel carries > >>> the > >>>> generated third-party section covering the bundled npm packages, and > >>> the > >>>> license-generation check runs in CI, so the list won't drift > silently > >>> on > >>>> the next dependency bump. This addresses the RC0 blocker. > >>>> > >>>> I did not re-verify the artifact checksums or GPG signatures; the > binding > >>>> voters have already covered that. > >>>> > >>>> Regards, > >>>> Viquar Khan > >>>> > >>>> On Fri, Aug 14, 2026 at 11:38â¯PM Elijah ben Izzy < > >>>> [email protected]> wrote: > >>>> > >>>>> +1 (binding) > >>>>> > >>>>> Checked: > >>>>> - 9 artifacts, SHA512 + GPG all verify (Jernej's key, in KEYS) > >>>>> - Source matches tag v0.43.0-incubating-RC1 (971a3530); RAT 0 > >>> unapproved > >>>> on > >>>>> src > >>>>> - LICENSE / NOTICE / DISCLAIMER present in src, sdist, wheel > >>>>> - Re-checked the RC0 blocker: LICENSE-wheel covers all 130 npm > packages > >>>> in > >>>>> the Vite bundle, all Cat-A (MIT/BSD-3/ISC/Apache-2.0/PSF), no Cat-X. > >>>>> Independently spot-verified Jarek's 4 "legit absence" claims > >>>>> (micromark-util-symbol, highlight.js, prismjs, reactflow > sub-packages) > >>>> plus > >>>>> the top-20 by prominence -- all accounted for. MPL/CC-BY hits in > >>>>> LICENSE-wheel are attribution text inside react-icons' own MIT > license; > >>>> no > >>>>> react-icons subpackage is imported in the UI src and zero Ci*/Fa* > hits > >>> in > >>>>> the shipped bundle. Not distributed. > >>>>> - generate_wheel_license.py --check runs in release-validation.yml -- > >>>> won't > >>>>> drift silently on next dep bump. > >>>>> - Fresh venv install of the wheel works: import burr, burr --help, > >>>> tracking > >>>>> server serves the Vite bundle (index-D7mZX6DE.js + > index-CCnzmWxs.css) > >>> at > >>>>> HTTP 200. > >>>>> > >>>>> Non-blocking follow-ups for a later release (nothing here needs a new > >>>> RC): > >>>>> - Sdist filename apache-burr-0.43.0-incubating-sdist.tar.gz breaks > the > >>>>> PEP-517 <name>-<version>.tar.gz convention -- pip install <url> won't > >>>> infer > >>>>> the version. Worth reverting or calling out in the announce. > >>>>> - Sdist ships without .rat-excludes -- RAT on sdist flags 21 demo > >>>> log.jsonl > >>>>> + 2 already-MIT-attributed deep-researcher .py. Ship .rat-excludes in > >>>> sdist > >>>>> next time, or add headers. > >>>>> - burr.__version__ attribute missing; only > >>>>> importlib.metadata.version("apache-burr") works. Minor DX. > >>>>> - 3 duplicate "opentelemetry ... already instrumented" warnings on > >>> server > >>>>> start. Cosmetic. > >>>>> > >>>>> Stefan's #882 covers the earlier non-blockers. > >>>>> > >>>>> Thanks Jernej -- good turnaround on RC0. > >>>>> > >>>>> Elijah > >>>>> > >>>>> On Thu, Aug 13, 2026 at 4:03â¯AM Jarek Potiuk <[email protected]> > wrote: > >>>>> > >>>>>> Hello Jernej, > >>>>>> > >>>>>> [X] +1 Release this as Apache Burr 0.43.0 (binding) > >>>>>> [ ] +0 > >>>>>> [ ] -1 Do not release this package because... (reason required) > >>>>>> > >>>>>> Checklist: > >>>>>> [X] Download links are valid > >>>>>> [X] Checksums and signatures are valid > >>>>>> [X] LICENSE/NOTICE/DISCLAIMER files exist and are correct > >>>>>> [X] No unexpected binary files in source > >>>>>> [X] All source files have ASF headers > >>>>>> [X] Can build and test from source > >>>>>> > >>>>>> I gave a binding -1 on RC0 over the wheel's LICENSE not accounting > >>> for > >>>>> the > >>>>>> npm packages bundled into the compiled tracking UI. RC1 fixes that > >>>>>> properly, > >>>>>> so I am +1 here. > >>>>>> > >>>>>> On the LICENSE fix specifically, since it was the blocker: > >>>>>> > >>>>>> - LICENSE-wheel now carries a generated "THIRD-PARTY COMPONENTS > >>> BUNDLED > >>>>> IN > >>>>>> THIS BINARY DISTRIBUTION" section listing 130 npm packages with > >>> their > >>>>>> licenses and copyright lines. Licenses are Apache-2.0, > >>> BSD-3-Clause, > >>>>> ISC, > >>>>>> MIT and PSF -- no Category X. > >>>>>> - It is generated, not hand-maintained: > >>>> scripts/generate_wheel_license.py > >>>>>> derives the list from a `vite build --sourcemap` run, resolving > >>> each > >>>>>> node_modules source back to its owning package. That is the right > >>> way > >>>>> to > >>>>>> do this, and it is the part that makes me confident it will not > >>>>> silently > >>>>>> drift on the next dependency bump. > >>>>>> - `generate_wheel_license.py --check` runs in CI > >>>>>> (.github/workflows/release-validation.yml), so a stale list fails > >>> the > >>>>>> build rather than costing another RC. > >>>>>> - All 130 listed entries match telemetry/ui/package-lock.json > >>> versions > >>>>>> exactly, and none of them is a dev-only dependency. > >>>>>> - I spot-checked the packages that look like they *should* be in the > >>>> list > >>>>>> but are not -- micromark-util-symbol, highlight.js/lowlight, > >>> prismjs, > >>>>>> @floating-ui/core, reactflow, react-router-dom, character-entities > >>> -- > >>>>> by > >>>>>> grepping the shipped minified bundle for their distinctive string > >>>>>> literals. Each absence is legitimate: micromark ships > >>> constant-folded > >>>>>> builds so its symbol package contributes no code, the UI imports > >>>>>> { Prism as SyntaxHighlighter } so the highlight.js path is > >>>> tree-shaken > >>>>>> out, and the rest are type-only or re-export-only. The list is > >>>>> accurate, > >>>>>> not merely plausible. > >>>>>> > >>>>>> The rest of my verification: > >>>>>> > >>>>>> - All three SHA-512 checksums verify, and all three detached > >>> signatures > >>>>> are > >>>>>> good against the KEYS file at > >>>>>> https://downloads.apache.org/incubator/burr/KEYS, signed by Jernej > >>>>>> Frank, > >>>>>> 3959 450E 4AA8 9991 1547 112F 25CA 7FC3 4D7C 68C1. > >>>>>> - The signed tag v0.43.0-incubating-RC1 (object 30f4a9aa, commit > >>>>> 971a3530) > >>>>>> matches the tag on GitHub. The source tarball is byte-identical to > >>>> that > >>>>>> tag: 820 files, every SHA-256 equal. > >>>>>> - No compiled objects, archives or built UI assets in the source > >>>>> artifact. > >>>>>> The single symlink (burr/examples -> ../examples) is present in git > >>>>> too. > >>>>>> - scripts/check_asf_headers.py reports clean. > >>>>>> - `twine check` passes on the wheel and the sdist, and the project's > >>>> own > >>>>>> verify_apache_artifacts.py signatures/artifacts checks pass on all > >>>>> three > >>>>>> artifacts. > >>>>>> - Python test suite from the source tarball on 3.12: 665 passed, 5 > >>>>> skipped. > >>>>>> The two Ray tests did not run in my sandbox (Ray wants /tmp/ray and > >>>>> unix > >>>>>> sockets); that is my environment, not the release. > >>>>>> - The released wheel installs cleanly, reports 0.43.0, and the core, > >>>>>> tracking and server modules import with the relevant extras. > >>>>>> > >>>>>> Two cosmetic follow-ups for a later release, on top of the ones > >>> Stefan > >>>>>> already raised in #882: > >>>>>> > >>>>>> - scripts/README.md's policy table says tests ship in the sdist, but > >>>> the > >>>>>> sdist has no tests/ directory. They are in the voting src.tar.gz, > >>> so > >>>>> the > >>>>>> artifacts are fine -- it is the doc that is out of step. > >>>>>> - verify_apache_artifacts.py's `signatures` command reports FAIL for > >>>>> every > >>>>>> non-artifact file that happens to sit in the directory it scans (it > >>>>>> flagged the KEYS file I had downloaded alongside the artifacts as > >>>>>> "missing .asc"). Worth filtering to the expected artifact names so > >>>>> voters > >>>>>> do not see spurious failures. > >>>>>> > >>>>>> Thanks for turning RC0 around quickly. > >>>>>> > >>>>>> Jarek > >>>>>> > >>>>> > >>>> > >>> >
