-1 (binding) I verified the canonical RC5 source tarball successfully:
- SHA-512 checksum and PGP signature are valid. - The release tag and commit match the vote email. - The archive contains a single versioned root directory and matches the tag manifest with the expected export exclusions. - LICENSE, NOTICE, DISCLAIMER, and Apache RAT checks pass. - The full reactor passes with JDK 8: 976 tests, with no failures, errors, or skipped tests. - The staged JAR signatures and legal metadata are valid. However, the Nexus staging repository still contains: fesod-parent-2.1.0-incubating-source-release.zip This archive is not equivalent to the canonical source tarball. It contains 1039 files versus 849 in the canonical source archive, with 190 additional ignored/generated files, including flattened POMs, fuzz corpora, workspace files, and the compiled Maven Wrapper JAR. These files are absent from the release tag archive and many are explicitly ignored or export-ignored. RAT also excludes these ignored files, so the successful RAT result does not cover the additional content. Please drop and rebuild the staging repository. I recommend disabling the inherited source-release-assembly execution, or otherwise producing the archive from a clean tag checkout and making it equivalent to the canonical source release. Best, SHuxin Pan On Wed, Sep 9, 2026 at 12:10 AM ian <[email protected]> wrote: > > Hi Fesod Community, > > This is a call for vote to release Apache Fesod(incubating) > 2.1.0-incubating. > > The release candidates: > https://dist.apache.org/repos/dist/dev/incubator/fesod/2.1.0-incubating-rc5 > > The staging repo: > https://repository.apache.org/content/repositories/orgapachefesod-1053 > > Git tag for the release: > https://github.com/apache/fesod/tree/2.1.0-incubating-rc5 > > Hash for the release tag: acd4045e0811799445c3602b6f625edc8800b9ff > > Release Notes: > https://github.com/apache/fesod/releases/tag/2.1.0-incubating-rc5 > > The artifacts have been signed with Key [ 3497B880 ], corresponding to [ > [email protected] ] which can be found in the keys file: > https://downloads.apache.org/incubator/fesod/KEYS > > Build Environment: JDK 8+, Apache Maven 3.6.0+. ./mvnw clean package > -DskipTests > > The vote will be open for at least 72 hours. > > Please vote accordingly: > [ ] +1 approve > [ ] +0 no opinion > [ ] -1 disapprove with the reason > > Checklist for reference: > [ ] Download links are valid. > [ ] Checksums and signatures. > [ ] LICENSE/NOTICE files exist > [ ] No unexpected binary files > [ ] All source files have ASF headers > [ ] Can compile from source --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
