Checked on Windows 11 with Azul Zulu JDK 25.0.4 and GnuPG 2.4.9:

   - Signatures on the src and bin tarballs are good (Adam Monsen's key
   A9A14F22F57DA182 from the Fineract KEYS file); the 1.16.0 tag is signed by
   the same key and points to 6da8a989b3.
   - SHA-512 checksums match, and the SHA3-256 values match the ATR
   manifest.
   - LICENSE and NOTICE are present in the source release; no unexpected
   binaries (only gradle-wrapper.jar and the dev keystore.jks, both in git and
   in 1.15.0 too).
   - Compared the source tarball against the 1.16.0 tag: all 8381 shared
   files are byte-identical.
   - ./gradlew rat passes. ./gradlew build -x test -x doc compiles every
   module and produces the WAR and boot jar; the OpenAPI client SDK generation
   ran out of heap on my laptop (I had to cap Gradle at 5 GB instead of the
   default 12 GB), so that part is my environment.

Two small non-blocking notes for the next release:

   1. The source tarball contains .claude/settings.local.json, which is not
   in git; it looks like a local file from the build machine that the
   srcDistTar task picked up because it copies everything not in its exclude
   list. Adding '.claude' to the excludes in fineract-war/build.gradle would
   keep it out.
   2. NOTICE still says "Copyright 2008-2025".

Thanks to everyone who put this release together.
Regards,
Aarti Panchal

On Wed, Oct 21, 2026 at 7:49 PM James Dailey <[email protected]> wrote:

> +1 (binding) not tested
>
>
> Sent from Gmail Mobile
>
> On Wed, Oct 21, 2026 at 5:57 AM Bhavya Sonigra <[email protected]>
> wrote:
>
>>
>>> +1 (non-binding)
>>>
>>> Verified on Windows 10, JDK 25.0.4.1 (Temurin):
>>> - GPG signatures and SHA-512 checksums OK (src + bin), also matching the
>>> ATR manifest (revision 00004)
>>> - Source tarball vs commit 6da8a98: no source files differ
>>> - LICENSE/NOTICE present in src and bin
>>> - Built src with ./gradlew clean build -x test: BUILD SUCCESSFUL
>>>
>>> Minor, non-blocking: the src tarball contains
>>> .claude/settings.local.json, which is not in the recorded commit. Also,
>>> NOTICE says "Copyright 2008-2025".
>>>
>>> Thanks to everyone involved in preparing this release.
>>>
>>> Regards,
>>> Bhavya
>>
>>

Reply via email to