Hi Ian, Thanks for addressing the reported issues. I re-verified the updated artifacts, and the original technical problems appear to be fixed:
- The source signature and SHA-512 checksum are valid. - The checksum file no longer contains a UTF-8 BOM. - The Unix mvnw uses LF and is executable. - The source builds successfully with JDK 8. - The Apache RAT check passes. - The Maven staging artifacts have valid signatures. - The JAR NOTICE files now contain Copyright 2025-2026 The Apache Software Foundation. However, I cannot approve the current RC1 because the artifacts and tag were modified after the vote started: The files under the same RC1 dist directory were replaced in revisions r87024 and r87026. The latest reply states that the release tag hash is 10d254d6c83a628d2a5af9b6d7e482c1cf208587. At the time of verification, the RC1 tag actually pointed to 80cafb7ebf8f82e2999632cc1be1f6f84e99157c. The current source archive matches 80cafb7..., not the hash stated in the reply. The Apache Incubator Release Votes guide states that a release vote applies to a single, immutable artifact, and that when an issue is found, the correct response is to prepare a new release candidate and vote again: https://cwiki.apache.org/confluence/display/INCUBATOR/Release+Votes Consequently, votes cast before these changes cannot be considered reviews of the current artifacts. My vote for RC1 is: [ ] +1 approve [ ] +0 no opinion [x] -1 disapprove I recommend cancelling this vote, creating an immutable RC2 with a new tag, dist directory, and Maven staging repository, and then starting a new vote for at least 72 hours. This does not indicate a remaining problem with the corrected contents; it is necessary to ensure that all voters review exactly the same candidate. Best regards, Shuxin Pan On Thu, Aug 27, 2026 at 6:31 PM ian <[email protected]> wrote: > > Hi Community, > > This is a call for vote to release Apache Fesod(incubating) > 2.1.0-incubating. > > The release candidate: > https://dist.apache.org/repos/dist/dev/incubator/fesod/2.1.0-incubating-rc1 > > The staging repo: > https://repository.apache.org/content/repositories/orgapachefesod-1034 > > Git tag for the release: > https://github.com/apache/fesod/releases/tag/2.1.0-incubating-rc1 > > Hash for the release tag: 10d254d6c83a628d2a5af9b6d7e482c1cf208587 > > Note on this release candidate (updated artifacts): Compared with the > initially announced RC1, this candidate has been re-signed and repackaged > to fix the following issues found during verification: > > - > > Maven staging artifacts are now PGP-signed and the staging repository > has passed the Close/signature validation (the previous candidate could not > be closed because of missing .asc files). > - > > The source tarball checksum file no longer carries a UTF-8 BOM, so > sha512sum > -c / shasum -a 512 -c work as-is. > - > > Line endings in the source tarball were normalized to LF; the Unix mvnw > wrapper is executable again. > - > > The NOTICE in fesod-common and fesod-sheet JARs was corrected to Copyright > 2025-2026 The Apache Software Foundation. As a result, the release tag > and the source package hash point to the fixed commit. > > Release Notes / Highlights (since 2.0.2-incubating): > > - > > Security: remote URL image fetching policy with allowlist and security > hardening (#1035) > - > > Fix: proper decoding of _xHHHH_ escapes when reading inline string cells > (#991) > - > > Fix: registered EscapeHexCellWriteHandler in DefaultWriteHandlerLoader > for XLSX (#1044) > - > > Feature: java.time.LocalTime converters (#1032) > - > > Refactor: cleaned up fesod-sheet usage examples and related tests (#1028) > > The artifacts have been signed with Key [ FDD68C1D3497B880 ], corresponding > to [ [email protected] ] which can be found in the keys file: > https://downloads.apache.org/incubator/fesod/KEYS > > Build Environment: JDK 8+, Apache Maven 3.6.0+. ./mvnw clean package > -DskipTests > > The vote will be open for at least 72 hours. > > Please vote accordingly: > > [ ] +1 approve > > [ ] +0 no opinion > > [ ] -1 disapprove with the reason > > Checklist for reference: > > [ ] Download links are valid. > > [ ] Checksums and signatures. > > [ ] LICENSE/NOTICE files exist > > [ ] No unexpected binary files > > [ ] All source files have ASF headers > > [ ] Can compile from source > > To learn more about Apache Fesod , please see https://fesod.apache.org/ > > Best Regards, Zhe Zhang [email protected] > > ian <[email protected]> 于2026年8月27日周四 16:28写道： > > > Hi Community, > > > > This is a call for vote to release Apache Fesod(incubating) > > 2.1.0-incubating. > > > > The release candidate: > > https://dist.apache.org/repos/dist/dev/incubator/fesod/2.1.0-incubating-rc1 > > > > The staging repo: > > https://repository.apache.org/content/repositories/orgapachefesod-1034 > > > > Git tag for the release: > > https://github.com/apache/fesod/releases/tag/2.1.0-incubating-rc1 > > > > Hash for the release tag: 28919a0ba39bea8afb5b27b850d2781e6927251d > > > > Release Notes / Highlights (since 2.0.2-incubating): > > > > - > > > > Security: remote URL image fetching policy with allowlist and security > > hardening (#1035) > > - > > > > Fix: proper decoding of _xHHHH_ escapes when reading inline string > > cells (#991) > > - > > > > Fix: registered EscapeHexCellWriteHandler in DefaultWriteHandlerLoader > > for XLSX (#1044) > > - > > > > Feature: java.time.LocalTime converters (#1032) > > - > > > > Refactor: cleaned up fesod-sheet usage examples and related tests > > (#1028) > > > > The artifacts have been signed with Key [ FDD68C1D3497B880 ], > > corresponding to [ [email protected] ] which can be found in the keys > > file: https://downloads.apache.org/incubator/fesod/KEYS > > > > Build Environment: JDK 8+, Apache Maven 3.6.0+. ./mvnw clean package > > -DskipTests > > > > The vote will be open for at least 72 hours. > > > > Please vote accordingly: > > > > [ ] +1 approve > > > > [ ] +0 no opinion > > > > [ ] -1 disapprove with the reason > > > > Checklist for reference: > > > > [ ] Download links are valid. > > > > [ ] Checksums and signatures. > > > > [ ] LICENSE/NOTICE files exist > > > > [ ] No unexpected binary files > > > > [ ] All source files have ASF headers > > > > [ ] Can compile from source > > > > To learn more about Apache Fesod , please see https://fesod.apache.org/ > > > > Best Regards, Zhe Zhang [email protected] > > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
