Hi PJ, Thank you for the careful review — all three findings are confirmed, and we will address each of them in RC4.
1. maven-wrapper.jar in the source release Confirmed: .mvn/wrapper/maven-wrapper.jar is committed in the Git repository, and the RC3 source-release.zip was rebuilt from a clean git archive of the tag, so the jar was carried in. For RC4 we will add an export-ignore rule for .mvn/wrapper/maven-wrapper.jar in .gitattributes so the source archives exclude it, while the jar stays in the repository for people building with mvnw. 2. Why two source releases? The tar.gz is the direct git archive of the tag; the zip is produced by the Maven source-release assembly inherited from the Apache parent POM (that is the artifact its release profile builds and deploys). Both were verified file-by-file against the tag. We agree the duplication is confusing, and we will evaluate publishing a single source archive for RC4 and say so explicitly in the vote email. 3. KEYS link in the vote email Confirmed — the RC3 email linked the dev dist directory. RC4 vote emails will use https://downloads.apache.org/incubator/fesod/KEYS and we will remove the KEYS file from the dev dist directory, keeping signer KEYS only in the release directory. 4. NOTICE in fesod-sheet jar (also filed as https://github.com/apache/fesod/issues/1064) Confirmed and root-caused: the NOTICE inside our jars is generated by the apache-jar-resource-bundle (inherited from org.apache:apache:31), whose template renders ${project.name} — hence "Fesod Spreadsheet" — and has no slot for third-party attribution, so the root NOTICE's Alibaba attribution never made it into the jars. fesod-common has the same problem; fesod-shaded is correct because it carries its own META-INF/NOTICE. For RC4, fesod-sheet and fesod-common will ship an authored META-INF/NOTICE reading "Apache Fesod (Incubating) Spreadsheet" / "Apache Fesod (Incubating) Common" including the Alibaba EasyExcel attribution paragraph, and we will verify every jar's NOTICE as part of the release checklist. Thanks again — these are exactly the checks that keep the release honest. Best regards, Zhe Zhang PJ Fanning <[email protected]> 于2026年9月5日周六 05:02写道： > The link in the vote email (repeated twice) for the KEYS file is wrong. > It should be > https://downloads.apache.org/incubator/fesod/KEYS > > You shouldn't have a dev KEYS file anyway. > > On 2026/09/04 20:50:19 PJ Fanning wrote: > > fesod-parent-2.1.0-incubating/.mvn/wrapper/maven-wrapper.jar > > > > It is not permitted to have jars in source releases. This appears in > fesod-parent-2.1.0-incubating-source-release.zip > > > > What is the reason for 2 source releases anyway? > > > > > > On 2026/09/04 15:08:19 Minseok Song wrote: > > > 0 (non-binding), pending clarification. > > > The artifact checks passed for me: > > > > > > * > > > The download links are valid. > > > * > > > The SHA-512 checksums match. > > > * > > > The signatures are valid. > > > * > > > Both source archives match Git tag 2.1.0-incubating-rc3 (commit > 1cd6e891316cfea2c49028091be9d6ee0409cd1e) file-for-file. > > > * > > > LICENSE, NOTICE, and DISCLAIMER are present. > > > * > > > No unexpected binary files are included. > > > * > > > Apache RAT passes with no unapproved licenses. > > > * > > > The source package builds successfully with tests skipped. > > > > > > However, the full test suite failed at the same test in two clean runs: > > > > > > fesod-sheet: Tests run: 894, Failures: 1, Errors: 0, Skipped: 0 > > > DateFormatTest.readCn(ExcelFormat)[1] > > > DateFormatTest passes when run independently, but I can consistently > reproduce the failure with the following test order: > > > CsvRowTest#csvWrite_withSqlDateAndTime_producesCorrectFile > > > DateFormatTest > > > > > > The actual formatted value contains the Korean AM marker ("오전") > instead of the expected Chinese marker ("上午"), even though Locale.CHINA is > explicitly configured. > > > > > > I traced this behavior to NumberDataFormatterUtils, which retains one > DataFormatter per thread without accounting for changes to the requested > locale. A formatter initialized with the JVM's default Korean locale is > therefore reused when Locale.CHINA is requested later on the same thread. > The direct CsvWorkbook/CsvSheet path appears to leave that formatter cached. > > > > > > To verify this, I temporarily added a call to > NumberDataFormatterUtils.removeThreadLocalCache() immediately after the CSV > operation. The same ordered test run then passed with 6 tests and 0 > failures. I reverted the diagnostic change after confirming the result. > > > > > > This indicates a reproducible, order-dependent locale cache issue > rather than a random or flaky test failure. However, I have not yet > confirmed whether this sequence can occur during normal application usage > or is limited to the direct low-level CSV API path. > > > > > > For that reason, I am voting 0 rather than -1. Could you confirm > whether the direct CSV path is expected to clear this cache and whether > this issue should block this release candidate? > > > > > > Environment: > > > > > > * > > > Windows 11 (amd64) > > > * > > > Oracle JDK 11.0.17 > > > * > > > Apache Maven 3.6.3 > > > > > > Best regards, > > > Minseok Song > > > GitHub: https://github.com/skytin1004 > > > > > > ________________________________ > > > From: Bengbengbalabalabeng <[email protected]> > > > Sent: Friday, September 4, 2026 8:36 PM > > > To: [email protected] <[email protected]> > > > Subject: Re: [VOTE] Release Apache Fesod (Incubating) 2.1.0-incubating > RC3 > > > > > > +1 (non-binding) > > > > > > I have checked: > > > [X] Download links are valid. > > > [X] Checksums and signatures. > > > [X] LICENSE/NOTICE/DISCLAIMER files exist. > > > [X] No unexpected binary files. > > > [X] All source files have ASF headers. > > > [X] Can compile from source. (macOS, Corretto-11.0.31 LTS, Maven 3.9.6) > > > > > > Best, > > > Bengbengbalabalabeng > > > > > > ian <[email protected]> 于2026年9月3日周四 21:01写道： > > > > > > > > Hi all, > > > > > > > > Please review and vote on the release candidate #3 of Apache Fesod > > > > (Incubating) version 2.1.0-incubating. > > > > > > > > This is an incubating podling. This vote is for the release > candidate only; > > > > a separate IPMC vote will follow once this vote passes. > > > > > > > > RC3 fixes the source-release.zip content so that it matches the Git > tag > > > > file-by-file (addressing the RC2 note that the staging zip did not > match > > > > the tag). > > > > > > > > The source release archive was rebuilt from a clean git archive of > the > > > > tagged commit and verified to match 1cd6e891 file-by-file. > > > > > > > > The release candidate to be voted on: > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/fesod/2.1.0-incubating-rc3/ > > > > > > > > Git tag to be voted on: 2.1.0-incubating-rc3 > > > > https://github.com/apache/fesod/tree/2.1.0-incubating-rc3 commit > > > > 1cd6e891316cfea2c49028091be9d6ee0409cd1e > > > > > > > > The Maven staging repository (closed): > > > > > > > > > https://repository.apache.org/content/repositories/orgapachefesod-1045/ > > > > > > > > Source package (with .asc signature and .sha512 checksum): > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/fesod/2.1.0-incubating-rc3/apache-fesod-2.1.0-incubating-src.tar.gz > > > > SHA512: > > > > > 4db8b55f2f0617aa0ff88b645ccfd4faaa55b8c71b06be0c07c3dcdd03932221a79bbcb5958ea525eefdabce9319346d0ed5684fc980adab7830e0adf92d0546 > > > > > > > > Source release archive (with .asc signature and .sha512 checksum): > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/fesod/2.1.0-incubating-rc3/fesod-parent-2.1.0-incubating-source-release.zip > > > > SHA512: > > > > > 3656a01cfa9c60d3b48537eaf07190f11cc34a8c0f4c56908a366c4612c45db2bc125d62e417d0c9a59ca8cb2c48578bda4e66afe4434b8117d2db7e3191908d > > > > > > > > The KEYS file (used to verify the artifacts, PGP public keys): > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/fesod/KEYS > > > > > > > > To verify this release candidate: > > > > > > > > 1. > > > > > > > > Import the KEYS file and check the release signatures: > > > > > > > > $ curl -O > https://dist.apache.org/repos/dist/dev/incubator/fesod/KEYS $ > > > > gpg --import KEYS $ gpg --verify > > > > apache-fesod-2.1.0-incubating-src.tar.gz.asc > > > > apache-fesod-2.1.0-incubating-src.tar.gz $ gpg --verify > > > > fesod-parent-2.1.0-incubating-source-release.zip.asc > > > > fesod-parent-2.1.0-incubating-source-release.zip > > > > 2. > > > > > > > > Verify the SHA-512 checksums (values are listed above): > > > > > > > > $ sha512sum apache-fesod-2.1.0-incubating-src.tar.gz $ sha512sum > > > > fesod-parent-2.1.0-incubating-source-release.zip > > > > 3. > > > > > > > > Verify the source-release.zip matches the Git tag 1cd6e891 > exactly. > > > > 4. > > > > > > > > Verify the source package builds (JDK 8) and RAT passes, and > confirm > > > > LICENSE/NOTICE/DISCLAIMER content and NOTICE copyright years. > > > > 5. > > > > > > > > Verify the artifacts in the Maven staging repository. > > > > > > > > This vote will be open for 72 hours (or until the necessary number > of votes > > > > is reached). Please cast your vote: > > > > > > > > [ ] +1 approve > > > > > > > > [ ] +0 no opinion > > > > > > > > [ ] -1 disapprove (and please state the reason) > > > > > > > > Best regards, Zhe Zhang > > > > > > --------------------------------------------------------------------- > > > To unsubscribe, e-mail: [email protected] > > > For additional commands, e-mail: [email protected] > > > > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: [email protected] > > For additional commands, e-mail: [email protected] > > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
