+1 paulk (binding) Carrying forward my vote from the grails dev list:
I checked: * "incubating" in distribution file names * NOTICE, LICENSE and DISCLAIMER files exist * No unexpected binary files in src zip * Verified signatures and checksums for all zips * Gradle bootstrap for src zip using: "gradle -p gradle-bootstrap" (I used gradle 8.11) * Build from source: "./gradlew build -PskipTests" * Build from source for grails-forge: as above (used MacOS this time and didn't get spotless complaints) * I note the xsd/dtd CDDL licenses which normally wouldn't be in a source distribution but are allowed "by virtue of being specified by a standard" for a small number of files as per tomcat src release * For next release, please give more attention to NOTICE/LICENSE files in jar artifacts * Just the known "grails-forge/.gitattributes" error from the RAT report * I tried: ./grails-forge-cli-help ./grails-forge-cli create-app hello ./grails-forge-cli --version ./grails-shell-cli --version * I think additional guidance in the vote email on what to read to build from src would be useful for newbies Cheers, Paul. On Sat, Jun 7, 2025 at 7:24 PM James Daugherty <jdaughe...@jdresources.net> wrote: > > Hi Everyone, > > > The Apache Grails podling has voted to approve the release of Apache Grails > (incubating) 7.0.0-M4. Please note that we "restaged" this release and redid > the vote after a critical issue was found. Unfortuntely, I made the mistake > of using the same subject so lists.apache.org shows one thread for both sets > of votes. > > > As the incubation host, we now kindly request the Groovy PMC to review & > approve our initial ASF release. > > > Grails vote thread: > > * https://lists.apache.org/thread/wdsyo1wzxt06bqcpnlyw6q56n2yj6xpj > > > Vote result thread: > > * https://lists.apache.org/thread/k2p46y0tx9r0brtgwtljvfno6pdndqon > > > The Grails framework consists of 2 repositories, so there are 2 tags for this > release: > > * (grails-core) https://github.com/apache/grails-core/releases/tag/v7.0.0-M4 > > * (grails-forge) https://github.com/apache/grails-forge/releases/tag/v7.0.0-M4 > > > The artifacts to be voted on are located as follows (r77366): > > Source release: > https://dist.apache.org/repos/dist/dev/grails/core/7.0.0-M4/sources > > Binary distributions: > https://dist.apache.org/repos/dist/dev/grails/core/7.0.0-M4/distribution > > > Release artifacts are signed with a key from the following file: > > https://dist.apache.org/repos/dist/release/grails/KEYS > > > Our release process, including verification steps, are documented here: > https://github.com/apache/grails-core/blob/7.0.x/RELEASE.md The last section > of this document `Appendix: Verification from a Container` is likely > relevant. The main maven staging repo id is `orgapachegrails-1053`. We know > we need to improve our build instructions in README.md, and plan do so in the > next release. Finally, there are 2 known groovy issues that prevent the > build from being fully reproducible. For the differing artifacts, we have > compared the decompiled classes to ensure they are as we expect to meet the > ASF security team's requirements. > > > The vote for this release is open for the next 72 hours. > > > [ ] +1 Release Apache Grails (incubating) 7.0.0-M4 > > [ ] 0 I don't have a strong opinion about this, but I assume it's ok > > [ ] -1 Do not release Apache Grails (incubating) 7.0.0-M4 because... > > > Regards, > > James
