On Wed, Mar 25, 2026, 05:50 Piotr P. Karwasz <[email protected]> wrote:
> Hi all, > > On 25.03.2026 10:32, [email protected] wrote: > > The ATR release candidate page, including downloads, can be found at: > > > > https://release-test.apache.org/vote/logging-log4j/2.25.4 > > > You'll find a lot of failed checks on this page. The main reason for > that, is that the content of our source and binary archive is not > wrapped in a directory. > Hi Piotr, Thank you for preparing the RC. Does that mean all the RAT check failures about missing license headers are incorrect? Gary > We'll fix that in future releases, since I plan to: > > - Use `git archive` to generate the source archive. > - Drop the binary archive completely: less than 1 user in 10,000 > downloads JARs from our website. > - We'll consider a SLSA Provenance attestation to prove the authenticity > of the artifacts in Central instead. > > Piotr >
