I would like to release Apache Commons Secure XML 1.0.0. This is the
first release, second release candidate.
Apache Commons Secure XML 1.0.0 RC2 is available for review here:
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC2
(svn revision 87149)
The Git tag commons-secure-xml-1.0.0-RC2 commit for this RC is
f240d75a9e69b9e89a7791ab6f226cf4a85161e4, which you can browse here:
https://gitbox.apache.org/repos/asf?p=commons-secure-xml.git;a=commit;h=f240d75a9e69b9e89a7791ab6f226cf4a85161e4
You may checkout this tag using:
git clone https://gitbox.apache.org/repos/asf/commons-secure-xml.git
--branch commons-secure-xml-1.0.0-RC2 commons-secure-xml-1.0.0-RC2
Maven artifacts are here:
https://repository.apache.org/content/repositories/orgapachecommons-1962/org/apache/commons/commons-secure-xml/1.0.0/
These are the artifacts and their hashes:
#Release SHA-512s
#Wed Sep 02 22:13:01 UTC 2026
commons-secure-xml-1.0.0-bin.tar.gz=aceca3c825554fb396f254684080f01c772fd22f4b014fcbedb89cdc4b85bd53bfdd3c7f889170ea8c93e9ddb7d291b70abbe780aca0284f86e292761fe24031
commons-secure-xml-1.0.0-bin.zip=3a84df97a21f610ef485cc393fed601ceff709f1f315ef68ebcf3ae822c20f70e186c5c9f900f9d9fc7e228718a1b3dca0164dd8365178f506f17ea653ed5e18
commons-secure-xml-1.0.0-bom.json=8d847f4dc0a2875dac35513f5b4636bd5dafa6038d1acd8fcaaa6d9e15ef6ee2f2756b90377e0acf4129ffd18e6898d9d3a95ce932137815f0d3606648a9506c
commons-secure-xml-1.0.0-bom.xml=a1ac8cd4bfd88a103acc2218cf49350aa7aebf1ec95e9366792e784b6f7c771e501bfefe5672eee25ebf18fdc1ea5b10fce695d5988295bc589b50ff5cf0a69b
commons-secure-xml-1.0.0-javadoc.jar=781277f0a173e4533a5db0de3798b5c4284d809c1ec3629ca8dba62f9ef5c2ee13c1f986093b4cd6c4e8293352bc5b376d45b14ea384a43fde07b808e5da0fa7
commons-secure-xml-1.0.0-sources.jar=9d74f98fd8032203956eb2c9e7b737f2d6184e2697761642066f4e1243c7dc12136d6abee5d857752e6bbd17e68712126de53bb3eb193485ace9a93b19442c7e
commons-secure-xml-1.0.0-src.tar.gz=544c31c4c276287fd312eef07829ed7cf0ce88c7e296e4ee2a1b3b2ee185a711ee8be7479bd060b095c8cab9b4a23a7a2bbca0a040e30715154dc2788eb958e2
commons-secure-xml-1.0.0-src.zip=c41883f7cbb76983726f8d1e86aa00365a3e8151ed7bd20e9d6e7dae3af2f483118fd58ae2363939225f2d47ebe53c02e90f20dbda6b266c67632d110cb03afc
commons-secure-xml-1.0.0-test-sources.jar=0f6c95a8e764cecf064bf9613405036d6dd1dc3ef6ef478167b74a52c723d622c5eae5e742f65fefe53bf58c1a7679dd6b1b59ed1a002929bc8820d6c5c19528
org.apache.commons_commons-secure-xml-1.0.0.spdx.json=ab49a0c8b3dc5ed2481ea85ea02cd2f387774bab8036b370113791726bdf4cd20b7c71c9b1e6379cadb8cdddf4e7766980e5befdd777e7333a947da08f99f3a6
I have tested this with 'mvn' and 'mvn clean install site' using:
openjdk version "21.0.12.1" 2026-08-18
OpenJDK Runtime Environment Homebrew (build 21.0.12.1)
OpenJDK 64-Bit Server VM Homebrew (build 21.0.12.1, mixed mode, sharing)
Apache Maven 3.9.16 (2bdd9fddda4b155ebf8000e807eb73fd829a51d5)
Maven home: /opt/homebrew/Cellar/maven/3.9.16/libexec
Java version: 21.0.12.1, vendor: Homebrew, runtime:
/opt/homebrew/Cellar/openjdk@21/21.0.12.1/libexec/openjdk.jdk/Contents/Home
Default locale: en_US, platform encoding: UTF-8
OS name: "mac os x", version: "26.6.2", arch: "aarch64", family: "mac"
Darwin ****.local 25.6.0 Darwin Kernel Version 25.6.0: Fri Jul 31
19:17:26 PDT 2026; root:xnu-12377.161.14~5/RELEASE_ARM64_T6041 arm64
Docker version 29.7.2, build a7dcaa6
Details of changes since 103 are in the release notes:
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC2/RELEASE-NOTES.txt
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC2/site/changes.html
Site:
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC2/site/index.html
(Note some *relative* links are broken and the 1.0.0 directories
are not yet created - these will be OK once the site is deployed.)
JApiCmp Report: None, this is the first release.
RAT Report:
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC2/site/rat-report.html
KEYS:
https://downloads.apache.org/commons/KEYS
Please review the release candidate and vote.
This vote will close no sooner than 72 hours from now.
[ ] +1 Release these artifacts
[ ] +0 OK, but...
[ ] -0 OK, but really should fix...
[ ] -1 I oppose this release because...
Thank you,
Gary Gregory,
Release Manager (using key 530AA5F25C25011F)
The following is intended as a helper and refresher for reviewers.
Validating a release candidate
==============================
These guidelines are NOT complete.
Requirements: Git, Java, and Maven.
You can validate a release from a release candidate (RC) tag as follows.
1a) Download and decompress the source archive from:
https://dist.apache.org/repos/dist/dev/commons/secure-xml/1.0.0-RC2/source
1b) Check out the RC tag from git (optional)
This is optional, as a reviewer must at least check source distributions.
git clone https://gitbox.apache.org/repos/asf/commons-secure-xml.git
--branch commons-secure-xml-1.0.0-RC2 commons-secure-xml-1.0.0-RC2
cd commons-secure-xml-1.0.0-RC2
2) Checking the build
All components should include a default Maven goal, such that you can
run 'mvn' from the command line by itself.
2) Check Apache licenses
This step is not required if the site includes a RAT report page,
which you then must check.
This check should be included in the default Maven build, but you can
check it with:
mvn apache-rat:check
3) Check binary compatibility
This step is not required if the site includes a JApiCmp report page,
which you then must check.
This check should be included in the default Maven build, but you can
check it with:
mvn verify -DskipTests -P japicmp japicmp:cmp
4) Build the package
This check should be included in the default Maven build, but you can
check it with:
mvn -V clean package
You can record the Maven and Java version produced by -V in your VOTE reply.
To gather OS information from a command line:
Windows: ver
Linux: uname -a
4b) Check reproducibility
To check that a build is reproducible, run:
mvn clean verify artifact:compare -DskipTests
-Dreference.repo=https://repository.apache.org/content/repositories/staging/
'-Dbuildinfo.ignore=*/*.spdx.json'
Note that this excludes SPDX files from the check.
5) Build the site for a single module project
Note: Some plugins require the components to be installed instead of packaged.
mvn site
Check the site reports in:
- Windows: target\site\index.html
- Linux: target/site/index.html
-the end-
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
