+1 My checks so far for Apache OpenServerless 0.9.0-incubating-RC4:
[X] Download links are valid $ wget -nv \ https://dist.apache.org/repos/dist/dev/incubator/openserverless/KEYS \ https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/openserverless-0.9.0-incubating-RC4-src.tar.gz \ https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/openserverless-0.9.0-incubating-RC4-src.tar.gz.asc \ https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/openserverless-0.9.0-incubating-RC4-src.tar.gz.sha512 All four files were downloaded successfully from the official Apache HTTPS URLs. [X] Checksums and signatures are valid $ sha512sum -c openserverless-0.9.0-incubating-RC4-src.tar.gz.sha512 openserverless-0.9.0-incubating-RC4-src.tar.gz: OK A dedicated GPG keyring was used for verification: $ mkdir -p gnupg $ chmod 700 gnupg $ gpg --batch --homedir "$PWD/gnupg" --import KEYS gpg: Total number processed: 3 gpg: imported: 3 $gpg --import KEYS gpg: /home/ubuntu/.gnupg/trustdb.gpg: trustdb created gpg: key CEBE1A0116BE6665: public key "Michele Sciabarra (Apache OpenServerless Release Key) <[email protected] <mailto:[email protected]>>" imported gpg: key BD49E720DDA765FF: public key "Francesco Timperi Tiberi <[email protected] <mailto:[email protected]>>" imported gpg: key CC940C9E19629781: public key "Michele Manzani <[email protected] <mailto:[email protected]>>" imported gpg: Total number processed: 3 gpg: imported: 3 $ gpg --verify openserverless-0.9.0-incubating-RC4-src.tar.gz.asc gpg: assuming signed data in 'openserverless-0.9.0-incubating-RC4-src.tar.gz' gpg: Signature made Fri Sep 11 07:12:20 2026 UTC gpg: using RSA key E64863824BDA2495CBAA57FDCEBE1A0116BE6665 gpg: Good signature from "Michele Sciabarra (Apache OpenServerless Release Key) <[email protected] <mailto:[email protected]>>" [unknown] gpg: Signature notation: manu=2,2.5+1.12,0,3 gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: E648 6382 4BDA 2495 CBAA 57FD CEBE 1A01 16BE 6665 The signature was verified successfully against the key imported from the official KEYS file. The trust warning is expected with this fresh keyring; no owner trust was assigned. [X] LICENSE/NOTICE files exist $ cd openserverless-0.9.0-incubating-RC4 $ grep -E 'Apache' LICENSE NOTICE LICENSE: Apache License LICENSE: APPENDIX: How to apply the Apache License to your work. LICENSE: To apply the Apache License to your work, attach the following LICENSE: Licensed under the Apache License, Version 2.0 (the "License"); NOTICE:Apache OpenServerless (Incubating) NOTICE:Copyright 2024 The Apache Software Foundation NOTICE:The Apache Software Foundation (http://www.apache.org/). [X] No unexpected binary files in source $ task find-binaries # No output: no unexpected binary files reported. [X] ASF license header checks pass $ task license CMD=check INFO Totally checked 3394 files, valid: 15, invalid: 0, ignored: 3379, fixed: 0 *** Checking license headers in admin-api INFO Totally checked 59 files, valid: 48, invalid: 0, ignored: 11, fixed: 0 *** Checking license headers in build INFO Totally checked 1130 files, valid: 16, invalid: 0, ignored: 1114, fixed: 0 *** Checking license headers in cli INFO Totally checked 930 files, valid: 132, invalid: 0, ignored: 798, fixed: 0 *** Checking license headers in devcontainer INFO Totally checked 14 files, valid: 8, invalid: 0, ignored: 6, fixed: 0 *** Checking license headers in oplugins-op INFO Totally checked 590 files, valid: 510, invalid: 0, ignored: 80, fixed: 0 *** Checking license headers in oplugins INFO Totally checked 216 files, valid: 148, invalid: 0, ignored: 68, fixed: 0 *** Checking license headers in runtimes INFO Totally checked 300 files, valid: 140, invalid: 0, ignored: 160, fixed: 0 *** Checking license headers in streamer INFO Totally checked 26 files, valid: 17, invalid: 0, ignored: 9, fixed: 0 The checks passed using the exclusions configured in the release's .licenserc.yaml files. No automatic fixes were applied. [X] Can compile from source $ ./build-and-test-ubuntu.sh Exit status: 0 ============================================ SUCCESS ./1-deploy.sh SUCCESS ./2-ssl.sh SUCCESS ./3-sys-redis.sh SUCCESS ./4a-sys-ferretdb.sh SUCCESS ./4b-sys-postgres.sh SUCCESS ./5-sys-seaweedfs.sh SUCCESS ./6-login.sh SUCCESS ./7-static.sh SUCCESS ./8-user-redis.sh SUCCESS ./9a-user-ferretdb.sh SUCCESS ./9b-user-postgres.sh SUCCESS ./10-user-seaweedfs.sh SUCCESS ./14-runtime-testing.sh SUCCESS ./11-sso-mock.sh Observations: - On Kind, the suite skips SSL verification and the static HTTP access check, although both scripts appear as SUCCESS above. - All ten JavaScript/Python runtime checks passed. - SSO password login and hello action execution passed using the bundled mock OIDC provider over HTTP. An initial HTTP 503 was handled successfully by the test's retry logic. > On 11 Sep 2026, at 13:21, Alessio Marinelli via dev > <[email protected]> wrote: > > +1 (non-binding) > I verified the release candidate as follows: > - Downloaded openserverless-0.9.0-incubating-RC4-src.tar.gz from > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/- > Imported KEYS, verified the GPG signature: "Good signature from Michele > Sciabarra (Apache OpenServerless Release Key)"- Verified the SHA512 checksum: > OK- Confirmed LICENSE, NOTICE, DISCLAIMER, README.md, CHANGES present at the > root- Checked for unexpected binary files: ran "task find-binaries" (no > output, clean) and manually confirmed no .jar/.psd/.odg files are present in > the archive. The jmx_prometheus_javaagent-0.18.0.jar I flagged in RC3 (and > the other binaries reported by other reviewers) are now correctly excluded > via the new no-release.txt file - thanks for the quick fix.- Ran > build-and-test-ubuntu.sh on a clean environment: build completed, and all 14 > applicable test scripts (deploy, ssl, sys-redis, sys-ferretdb, sys-postgres, > sys-seaweedfs, login, static, user-redis, user-ferretdb, user-postgres, > user-seaweedfs, runtime-testing, sso-mock) reported SUCCESS. > Note: on the first run, 11-sso-mock.sh initially failed because the > system-api pod couldn't reach the internet to install Python dependencies at > boot - this turned out to be a local networking issue on my test machine (a > ufw firewall rule blocking forwarding for the kind cluster's docker subnet), > not a release defect. After fixing that locally and re-running the test in > isolation with "task test-one TEST=11-sso-mock.sh", it passed cleanly (SSO > password login via OIDC, hello action setup and execution all successful). > - The previously reported docker.io/docker.io/ duplicated prefix issue > (#239) is still present but remains non-blocking, as before (pull falls back > to the locally-built image automatically). > Thanks for the fast turnaround on RC4, Alessio > > > Il giorno venerdì 11 settembre 2026 alle ore 10:17:41 CEST, Michele > Sciabarra <[email protected]> ha scritto: > > +1 my checks as follows: > > Checklist for reference: > > [X] Download links are valid > > $ wget -q https://dist.apache.org/repos/dist/dev/incubator/openserverless/KEYS > $ wget -q > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/openserverless-0.9.0-incubating-RC4-src.tar.gz > $ wget -q > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/openserverless-0.9.0-incubating-RC4-src.tar.gz.asc > $ wget -q > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/openserverless-0.9.0-incubating-RC4-src.tar.gz.sha512 > $ ls -l > -rw-r--r--@ 1 msciab staff 6620 10 Sep 13:01 KEYS > -rw-r--r--@ 1 msciab staff 8610475 11 Sep 09:58 > openserverless-0.9.0-incubating-RC4-src.tar.gz > -rw-r--r--@ 1 msciab staff 870 11 Sep 09:58 > openserverless-0.9.0-incubating-RC4-src.tar.gz.asc > -rw-r--r--@ 1 msciab staff 177 11 Sep 09:58 > openserverless-0.9.0-incubating-RC4-src.tar.gz.sha512 > > [X] Checksums and signatures are valid > $ sha512 -c openserverless-0.9.0-incubating-RC4-src.tar.gz.sha512 > # no news is a good news > > $ gpg --import KEYS > gpg: key CEBE1A0116BE6665: "Michele Sciabarra (Apache OpenServerless > Release Key) <[email protected]>" not changed > gpg: key BD49E720DDA765FF: "Francesco Timperi Tiberi > <[email protected]>" not changed > gpg: key CC940C9E19629781: "Michele Manzani > <[email protected]>" not changed > gpg: Total number processed: 3 > gpg: unchanged: 3 > > $ gpg --verify openserverless-0.9.0-incubating-RC4-src.tar.gz.asc > openserverless-0.9.0-incubating-RC4-src.tar.gz > gpg: Signature made Fri 11 Sep 09:12:20 2026 CEST > gpg: using RSA key E64863824BDA2495CBAA57FDCEBE1A0116BE6665 > gpg: Good signature from "Michele Sciabarra (Apache OpenServerless > Release Key) <[email protected]>" [ultimate] > > > [X] LICENSE/NOTICE files exist > $ tar xzf openserverless-0.9.0-incubating-RC4-src.tar.gz > $ grep -E 'Apache' openserverless-0.9.0-incubating-RC4/{LICENSE,NOTICE} > > openserverless-0.9.0-incubating-RC4/LICENSE: > Apache License > openserverless-0.9.0-incubating-RC4/LICENSE: APPENDIX: How to apply > the Apache License to your work. > openserverless-0.9.0-incubating-RC4/LICENSE: To apply the Apache > License to your work, attach the following > openserverless-0.9.0-incubating-RC4/LICENSE: Licensed under the > Apache License, Version 2.0 (the "License"); > openserverless-0.9.0-incubating-RC4/NOTICE:Apache OpenServerless (Incubating) > openserverless-0.9.0-incubating-RC4/NOTICE:Copyright 2024 The Apache > Software Foundation > openserverless-0.9.0-incubating-RC4/NOTICE:The Apache Software > Foundation (http://www.apache.org/). > > > [X] No unexpected binary files in source > # you need here task and file - > $ cd openserverless-0.9.0-incubating-RC4 > $ task find-binaries > # no news is a good news > > [X] All source files have ASF headers > $ task license > INFO Loading configuration from file: .licenserc.yaml > INFO Totally checked 3394 files, valid: 15, invalid: 0, ignored: 3379, fixed: > 0 > *** Checking license headers in admin-api > INFO Loading configuration from file: .licenserc.yaml > INFO Totally checked 59 files, valid: 48, invalid: 0, ignored: 11, fixed: 0 > *** Checking license headers in build > INFO Loading configuration from file: .licenserc.yaml > INFO Totally checked 1130 files, valid: 16, invalid: 0, ignored: 1114, fixed: > 0 > *** Checking license headers in cli > INFO Loading configuration from file: .licenserc.yaml > INFO Totally checked 930 files, valid: 132, invalid: 0, ignored: 798, fixed: 0 > *** Checking license headers in devcontainer > INFO Loading configuration from file: .licenserc.yaml > INFO Totally checked 14 files, valid: 8, invalid: 0, ignored: 6, fixed: 0 > *** Checking license headers in oplugins-op > INFO Loading configuration from file: .licenserc.yaml > INFO Totally checked 590 files, valid: 510, invalid: 0, ignored: 80, fixed: 0 > *** Checking license headers in oplugins > INFO Loading configuration from file: .licenserc.yaml > INFO Totally checked 216 files, valid: 148, invalid: 0, ignored: 68, fixed: 0 > *** Checking license headers in runtimes > INFO Loading configuration from file: .licenserc.yaml > INFO Totally checked 300 files, valid: 140, invalid: 0, ignored: 160, fixed: 0 > *** Checking license headers in streamer > INFO Loading configuration from file: .licenserc.yaml > INFO Totally checked 26 files, valid: 17, invalid: 0, ignored: 9, fixed: 0 > > [X] Can compile from source > $ ./build-and-test-ubuntu.sh > # or ./build-and-test-mac.sh > # or .\build-and-test-windows.ps1 from PowerShell > > ============================================ > <omissis long output> > ============================================ > SUCCESS ./1-deploy.sh > SUCCESS ./2-ssl.sh > SUCCESS ./3-sys-redis.sh > SUCCESS ./4a-sys-ferretdb.sh > SUCCESS ./4b-sys-postgres.sh > SUCCESS ./5-sys-seaweedfs.sh > SUCCESS ./6-login.sh > SUCCESS ./7-static.sh > SUCCESS ./8-user-redis.sh > SUCCESS ./9a-user-ferretdb.sh > SUCCESS ./9b-user-postgres.sh > SUCCESS ./10-user-seaweedfs.sh > SUCCESS ./14-runtime-testing.sh > SUCCESS ./11-sso-mock.sh > > -- > Michele Sciabarrà - [email protected] - linkedin.com/in/msciab > Apache OpenServerless committer - reddit.com/r/openserverless > Apache OpenWhisk PMC member - Author Learning Apache OpenWhisk > > > Michele Sciabarra | CTO > m: +44 747 984 8388 > e: [email protected] > l: https://linkedin.com/in/msciab > Nuvolaris Inc | 1209 Orange Street, 19801Wilmington DE - US > > > > > On Fri, 11 Sept 2026 at 10:13, Michele Sciabarra <[email protected]> wrote: >> >> Hi all, >> >> I propose the following RC to be released as the official >> Apache OpenServerless 0.9.0-incubating release. >> >> Apache OpenServerless is an effort undergoing incubation at The Apache >> Software >> Foundation (ASF), sponsored by the Apache Incubator. Incubation is required >> of all newly accepted projects until a further review indicates that the >> infrastructure, communications, and decision making process have stabilized >> in a manner consistent with other successful ASF projects. While incubation >> status is not necessarily a reflection of the completeness or stability of >> the code, it does indicate that the project has yet to be fully endorsed by >> the ASF. >> >> The artifacts for this release candidate can be found at: >> >> https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4 >> >> The Git tag to be voted upon is: >> >> v0.9.0-incubating-RC4 >> >> https://github.com/apache/openserverless/releases/tag/v0.9.0-incubating-RC4 >> >> Release artifacts are signed with the GPG key of the release manager. >> >> The KEYS file is available at: >> >> https://dist.apache.org/repos/dist/dev/incubator/openserverless/KEYS >> >> Please download, verify, and test the release candidate. >> >> For detailed step-by-step instructions on how to verify this >> release, please see the file VERIFY.md within the source >> archive, or check: >> >> https://github.com/apache/openserverless/blob/0.9.0/VERIFY.md >> >> The vote will run for a minimum of 72 hours and close no earlier >> than: >> >> 2026-09-14 07:12 UTC >> >> Please vote: >> >> [ ] +1 Release this package as Apache OpenServerless 0.9.0-incubating >> [ ] +0 >> [ ] -1 Do not release this package because... (reason required) >> >> Only PPMC members have binding votes, but community votes are >> encouraged. >> >> Checklist for reference: >> [ ] Download links are valid >> [ ] Checksums and signatures are valid >> [ ] LICENSE/NOTICE files exist >> [ ] No unexpected binary files in source >> [ ] All source files have ASF headers >> [ ] Can compile from source >> >> On behalf of the Apache OpenServerless Podling PMC (PPMC), >> >> -- >> Michele Sciabarrà - [email protected] - linkedin.com/in/msciab >> Apache OpenServerless committer - reddit.com/r/openserverless >> Apache OpenWhisk PMC member - Author Learning Apache OpenWhisk >> >> >> >>
smime.p7s
Description: S/MIME cryptographic signature
