Remove the dev KEYS file: https://dist.apache.org/repos/dist/dev/incubator/openserverless/KEYS
I don't why podling after podling keeps breaking this rule. The KEYS file must be in https://downloads.apache.org/incubator/openserverless/KEYS This file is synched from https://dist.apache.org/repos/dist/release/incubator/openserverless/KEYS The RC does go in https://dist.apache.org/repos/dist/dev/incubator/openserverless It is the KEYS file that must be in https://dist.apache.org/repos/dist/release/incubator/openserverless On 2026/09/11 20:20:56 Bruno wrote: > +1 > > I verified the release candidate as follows on Ubuntu 24.04 LTS. > > [X] Download links are valid > > $ wget -nv \ > https://dist.apache.org/repos/dist/dev/incubator/openserverless/KEYS \ > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/openserverless-0.9.0-incubating-RC4-src.tar.gz > \ > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/openserverless-0.9.0-incubating-RC4-src.tar.gz.asc > \ > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/openserverless-0.9.0-incubating-RC4-src.tar.gz.sha512 > > All four files were downloaded successfully from the official Apache HTTPS > URLs. > > [X] Checksums and signatures are valid > - SHA512 checksum verified: OK > > $ sha512sum -c openserverless-0.9.0-incubating-RC4-src.tar.gz.sha512 > openserverless-0.9.0-incubating-RC4-src.tar.gz: OK > > $ gpg --import KEYS > gpg: key CEBE1A0116BE6665: public key "Michele Sciabarra (Apache > OpenServerless Release Key) <[email protected]>" imported > gpg: key BD49E720DDA765FF: public key "Francesco Timperi Tiberi < > [email protected]>" imported > gpg: key CC940C9E19629781: public key "Michele Manzani < > [email protected]>" imported > gpg: Total number processed: 3 > gpg: imported: 3 > > $ gpg --verify openserverless-0.9.0-incubating-RC4-src.tar.gz.asc > gpg: assuming signed data in > 'openserverless-0.9.0-incubating-RC4-src.tar.gz' > gpg: Signature made Fri Sep 11 07:12:20 2026 UTC > gpg: using RSA key E64863824BDA2495CBAA57FDCEBE1A0116BE6665 > gpg: Good signature from "Michele Sciabarra (Apache OpenServerless Release > Key) <[email protected]>" [unknown] > gpg: Signature notation: manu=2,2.5+1.12,0,3 > gpg: WARNING: This key is not certified with a trusted signature! > gpg: There is no indication that the signature belongs to the > owner. > Primary key fingerprint: E648 6382 4BDA 2495 CBAA 57FD CEBE 1A01 16BE 6665 > > The signature was verified successfully against the key imported from the > official KEYS file. The trust warning is expected with this fresh keyring; > no owner trust was assigned. > > [X] LICENSE/NOTICE files exist > $ grep -E 'Apache' LICENSE NOTICE > > LICENSE: Apache License > LICENSE: APPENDIX: How to apply the Apache License to your work. > LICENSE: To apply the Apache License to your work, attach the following > LICENSE: Licensed under the Apache License, Version 2.0 (the "License"); > NOTICE:Apache OpenServerless (Incubating) > NOTICE:Copyright 2024 The Apache Software Foundation > NOTICE:The Apache Software Foundation (http://www.apache.org/). > > $ task find-binaries > # No output: no unexpected binary files reported. > > [X] ASF license header checks pass > > $ task license > > INFO Totally checked 3394 files, valid: 15, invalid: 0, ignored: 3379, > fixed: 0 > *** Checking license headers in admin-api > INFO Totally checked 59 files, valid: 48, invalid: 0, ignored: 11, fixed: 0 > *** Checking license headers in build > INFO Totally checked 1130 files, valid: 16, invalid: 0, ignored: 1114, > fixed: 0 > *** Checking license headers in cli > INFO Totally checked 930 files, valid: 132, invalid: 0, ignored: 798, > fixed: 0 > *** Checking license headers in devcontainer > INFO Totally checked 14 files, valid: 8, invalid: 0, ignored: 6, fixed: 0 > *** Checking license headers in oplugins-op > INFO Totally checked 590 files, valid: 510, invalid: 0, ignored: 80, fixed: > 0 > *** Checking license headers in oplugins > INFO Totally checked 216 files, valid: 148, invalid: 0, ignored: 68, fixed: > 0 > *** Checking license headers in runtimes > INFO Totally checked 300 files, valid: 140, invalid: 0, ignored: 160, > fixed: 0 > *** Checking license headers in streamer > INFO Totally checked 26 files, valid: 17, invalid: 0, ignored: 9, fixed: 0 > > The checks passed using the exclusions configured in the > release's .licenserc.yaml files. No automatic fixes were applied. > > [X] Can compile from source > > $ ./build-and-test-ubuntu.sh > > Exit status: 0 > > - All 14 test scripts passed: > ============================================ > SUCCESS ./1-deploy.sh > SUCCESS ./2-ssl.sh > SUCCESS ./3-sys-redis.sh > SUCCESS ./4a-sys-ferretdb.sh > SUCCESS ./4b-sys-postgres.sh > SUCCESS ./5-sys-seaweedfs.sh > SUCCESS ./6-login.sh > SUCCESS ./7-static.sh > SUCCESS ./8-user-redis.sh > SUCCESS ./9a-user-ferretdb.sh > SUCCESS ./9b-user-postgres.sh > SUCCESS ./10-user-seaweedfs.sh > SUCCESS ./14-runtime-testing.sh > SUCCESS ./11-sso-mock.sh > > Regards, > Bruno > > Il giorno ven 11 set 2026 alle ore 21:19 Lorenzo Sarna < > [email protected]> ha scritto: > > > +1 (non-binding) > > > > I verified the release candidate as follows: > > > > [X] Download links are valid > > - Downloaded openserverless-0.9.0-incubating-RC4-src.tar.gz from > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/ > > > > [X] Checksums and signatures are valid > > - Imported KEYS (3 keys imported), verified GPG signature: > > "Good signature from Michele Sciabarra (Apache OpenServerless Release > > Key)" > > - SHA512 checksum verified: OK > > > > [X] LICENSE/NOTICE files exist > > - LICENSE, NOTICE, README.md, CHANGES present at root > > > > [X] No unexpected binary files in source > > - Checked for .lockb and .jar files: none found > > > > [X] Can compile from source > > - Ran .\build-and-test-windows.ps1 on Windows 10 Home + WSL2 > > - All 14 test scripts passed: > > SUCCESS ./1-deploy.sh > > SUCCESS ./2-ssl.sh > > SUCCESS ./3-sys-redis.sh > > SUCCESS ./4a-sys-ferretdb.sh > > SUCCESS ./4b-sys-postgres.sh > > SUCCESS ./5-sys-seaweedfs.sh > > SUCCESS ./6-login.sh > > SUCCESS ./7-static.sh > > SUCCESS ./8-user-redis.sh > > SUCCESS ./9a-user-ferretdb.sh > > SUCCESS ./9b-user-postgres.sh > > SUCCESS ./10-user-seaweedfs.sh > > SUCCESS ./14-runtime-testing.sh > > SUCCESS ./11-sso-mock.sh > > > > Il giorno ven 11 set 2026 alle ore 10:14 Michele Sciabarra < > > [email protected]> ha scritto: > > > > > Hi all, > > > > > > I propose the following RC to be released as the official > > > Apache OpenServerless 0.9.0-incubating release. > > > > > > Apache OpenServerless is an effort undergoing incubation at The Apache > > > Software > > > Foundation (ASF), sponsored by the Apache Incubator. Incubation is > > required > > > of all newly accepted projects until a further review indicates that the > > > infrastructure, communications, and decision making process have > > stabilized > > > in a manner consistent with other successful ASF projects. While > > incubation > > > status is not necessarily a reflection of the completeness or stability > > of > > > the code, it does indicate that the project has yet to be fully endorsed > > by > > > the ASF. > > > > > > The artifacts for this release candidate can be found at: > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4 > > > > > > The Git tag to be voted upon is: > > > > > > v0.9.0-incubating-RC4 > > > > > > > > https://github.com/apache/openserverless/releases/tag/v0.9.0-incubating-RC4 > > > > > > Release artifacts are signed with the GPG key of the release manager. > > > > > > The KEYS file is available at: > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/KEYS > > > > > > Please download, verify, and test the release candidate. > > > > > > For detailed step-by-step instructions on how to verify this > > > release, please see the file VERIFY.md within the source > > > archive, or check: > > > > > > https://github.com/apache/openserverless/blob/0.9.0/VERIFY.md > > > > > > The vote will run for a minimum of 72 hours and close no earlier > > > than: > > > > > > 2026-09-14 07:12 UTC > > > > > > Please vote: > > > > > > [ ] +1 Release this package as Apache OpenServerless 0.9.0-incubating > > > [ ] +0 > > > [ ] -1 Do not release this package because... (reason required) > > > > > > Only PPMC members have binding votes, but community votes are > > > encouraged. > > > > > > Checklist for reference: > > > [ ] Download links are valid > > > [ ] Checksums and signatures are valid > > > [ ] LICENSE/NOTICE files exist > > > [ ] No unexpected binary files in source > > > [ ] All source files have ASF headers > > > [ ] Can compile from source > > > > > > On behalf of the Apache OpenServerless Podling PMC (PPMC), > > > > > > -- > > > Michele Sciabarrà - [email protected] - linkedin.com/in/msciab > > > Apache OpenServerless committer - reddit.com/r/openserverless > > > Apache OpenWhisk PMC member - Author Learning Apache OpenWhisk > > > < > > > > > https://www.oreilly.com/library/view/learning-apache-openwhisk/9781492046158/ > > > > > > > > > > > > -- > The life is short.. live at your best! >
