The release process is fully automated here: https://github.com/apache/openserverless/blob/85b0dca145bc8984354a740939bf8ae484a9edb3/Taskfile.yml#L299
Michele Sciabarra | CTO m: +44 747 984 8388 e: [email protected] l: https://linkedin.com/in/msciab Nuvolaris Inc | 1209 Orange Street, 19801Wilmington DE - US On Fri, 11 Sept 2026 at 22:57, PJ Fanning <[email protected]> wrote: > Also not commit Ids have been provided to verify that the source code > matches what is in git. > The only git tag that I found did not match the name of this RC - the git > tag is for RC3 while this vote is for RC4. > > https://github.com/apache/openserverless/tags > > Is there a document describing the release process? So that someone could > verify that the process has been followed. > > On 2026/09/11 20:45:21 PJ Fanning wrote: > > Not a blocker for this release but you should prefix the tar.gz file > name and other file names with 'apache'. > > > > openserverless-0.9.0-incubating-RC4-src.tar.gz > > should be > > apache-openserverless-0.9.0-incubating-RC4-src.tar.gz > > > > On 2026/09/11 20:42:52 PJ Fanning wrote: > > > Remove the dev KEYS file: > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/KEYS > > > > > > I don't why podling after podling keeps breaking this rule. > > > The KEYS file must be in > > > https://downloads.apache.org/incubator/openserverless/KEYS > > > > > > This file is synched from > > > > https://dist.apache.org/repos/dist/release/incubator/openserverless/KEYS > > > > > > The RC does go in > https://dist.apache.org/repos/dist/dev/incubator/openserverless > > > > > > It is the KEYS file that must be in > https://dist.apache.org/repos/dist/release/incubator/openserverless > > > > > > > > > On 2026/09/11 20:20:56 Bruno wrote: > > > > +1 > > > > > > > > I verified the release candidate as follows on Ubuntu 24.04 LTS. > > > > > > > > [X] Download links are valid > > > > > > > > $ wget -nv \ > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/KEYS \ > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/openserverless-0.9.0-incubating-RC4-src.tar.gz > > > > \ > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/openserverless-0.9.0-incubating-RC4-src.tar.gz.asc > > > > \ > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/openserverless-0.9.0-incubating-RC4-src.tar.gz.sha512 > > > > > > > > All four files were downloaded successfully from the official Apache > HTTPS > > > > URLs. > > > > > > > > [X] Checksums and signatures are valid > > > > - SHA512 checksum verified: OK > > > > > > > > $ sha512sum -c openserverless-0.9.0-incubating-RC4-src.tar.gz.sha512 > > > > openserverless-0.9.0-incubating-RC4-src.tar.gz: OK > > > > > > > > $ gpg --import KEYS > > > > gpg: key CEBE1A0116BE6665: public key "Michele Sciabarra (Apache > > > > OpenServerless Release Key) <[email protected]>" imported > > > > gpg: key BD49E720DDA765FF: public key "Francesco Timperi Tiberi < > > > > [email protected]>" imported > > > > gpg: key CC940C9E19629781: public key "Michele Manzani < > > > > [email protected]>" imported > > > > gpg: Total number processed: 3 > > > > gpg: imported: 3 > > > > > > > > $ gpg --verify openserverless-0.9.0-incubating-RC4-src.tar.gz.asc > > > > gpg: assuming signed data in > > > > 'openserverless-0.9.0-incubating-RC4-src.tar.gz' > > > > gpg: Signature made Fri Sep 11 07:12:20 2026 UTC > > > > gpg: using RSA key > E64863824BDA2495CBAA57FDCEBE1A0116BE6665 > > > > gpg: Good signature from "Michele Sciabarra (Apache OpenServerless > Release > > > > Key) <[email protected]>" [unknown] > > > > gpg: Signature notation: manu=2,2.5+1.12,0,3 > > > > gpg: WARNING: This key is not certified with a trusted signature! > > > > gpg: There is no indication that the signature belongs to > the > > > > owner. > > > > Primary key fingerprint: E648 6382 4BDA 2495 CBAA 57FD CEBE 1A01 > 16BE 6665 > > > > > > > > The signature was verified successfully against the key imported > from the > > > > official KEYS file. The trust warning is expected with this fresh > keyring; > > > > no owner trust was assigned. > > > > > > > > [X] LICENSE/NOTICE files exist > > > > $ grep -E 'Apache' LICENSE NOTICE > > > > > > > > LICENSE: Apache License > > > > LICENSE: APPENDIX: How to apply the Apache License to your work. > > > > LICENSE: To apply the Apache License to your work, attach the > following > > > > LICENSE: Licensed under the Apache License, Version 2.0 (the > "License"); > > > > NOTICE:Apache OpenServerless (Incubating) > > > > NOTICE:Copyright 2024 The Apache Software Foundation > > > > NOTICE:The Apache Software Foundation (http://www.apache.org/). > > > > > > > > $ task find-binaries > > > > # No output: no unexpected binary files reported. > > > > > > > > [X] ASF license header checks pass > > > > > > > > $ task license > > > > > > > > INFO Totally checked 3394 files, valid: 15, invalid: 0, ignored: > 3379, > > > > fixed: 0 > > > > *** Checking license headers in admin-api > > > > INFO Totally checked 59 files, valid: 48, invalid: 0, ignored: 11, > fixed: 0 > > > > *** Checking license headers in build > > > > INFO Totally checked 1130 files, valid: 16, invalid: 0, ignored: > 1114, > > > > fixed: 0 > > > > *** Checking license headers in cli > > > > INFO Totally checked 930 files, valid: 132, invalid: 0, ignored: 798, > > > > fixed: 0 > > > > *** Checking license headers in devcontainer > > > > INFO Totally checked 14 files, valid: 8, invalid: 0, ignored: 6, > fixed: 0 > > > > *** Checking license headers in oplugins-op > > > > INFO Totally checked 590 files, valid: 510, invalid: 0, ignored: 80, > fixed: > > > > 0 > > > > *** Checking license headers in oplugins > > > > INFO Totally checked 216 files, valid: 148, invalid: 0, ignored: 68, > fixed: > > > > 0 > > > > *** Checking license headers in runtimes > > > > INFO Totally checked 300 files, valid: 140, invalid: 0, ignored: 160, > > > > fixed: 0 > > > > *** Checking license headers in streamer > > > > INFO Totally checked 26 files, valid: 17, invalid: 0, ignored: 9, > fixed: 0 > > > > > > > > The checks passed using the exclusions configured in the > > > > release's .licenserc.yaml files. No automatic fixes were applied. > > > > > > > > [X] Can compile from source > > > > > > > > $ ./build-and-test-ubuntu.sh > > > > > > > > Exit status: 0 > > > > > > > > - All 14 test scripts passed: > > > > ============================================ > > > > SUCCESS ./1-deploy.sh > > > > SUCCESS ./2-ssl.sh > > > > SUCCESS ./3-sys-redis.sh > > > > SUCCESS ./4a-sys-ferretdb.sh > > > > SUCCESS ./4b-sys-postgres.sh > > > > SUCCESS ./5-sys-seaweedfs.sh > > > > SUCCESS ./6-login.sh > > > > SUCCESS ./7-static.sh > > > > SUCCESS ./8-user-redis.sh > > > > SUCCESS ./9a-user-ferretdb.sh > > > > SUCCESS ./9b-user-postgres.sh > > > > SUCCESS ./10-user-seaweedfs.sh > > > > SUCCESS ./14-runtime-testing.sh > > > > SUCCESS ./11-sso-mock.sh > > > > > > > > Regards, > > > > Bruno > > > > > > > > Il giorno ven 11 set 2026 alle ore 21:19 Lorenzo Sarna < > > > > [email protected]> ha scritto: > > > > > > > > > +1 (non-binding) > > > > > > > > > > I verified the release candidate as follows: > > > > > > > > > > [X] Download links are valid > > > > > - Downloaded openserverless-0.9.0-incubating-RC4-src.tar.gz from > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/ > > > > > > > > > > [X] Checksums and signatures are valid > > > > > - Imported KEYS (3 keys imported), verified GPG signature: > > > > > "Good signature from Michele Sciabarra (Apache OpenServerless > Release > > > > > Key)" > > > > > - SHA512 checksum verified: OK > > > > > > > > > > [X] LICENSE/NOTICE files exist > > > > > - LICENSE, NOTICE, README.md, CHANGES present at root > > > > > > > > > > [X] No unexpected binary files in source > > > > > - Checked for .lockb and .jar files: none found > > > > > > > > > > [X] Can compile from source > > > > > - Ran .\build-and-test-windows.ps1 on Windows 10 Home + WSL2 > > > > > - All 14 test scripts passed: > > > > > SUCCESS ./1-deploy.sh > > > > > SUCCESS ./2-ssl.sh > > > > > SUCCESS ./3-sys-redis.sh > > > > > SUCCESS ./4a-sys-ferretdb.sh > > > > > SUCCESS ./4b-sys-postgres.sh > > > > > SUCCESS ./5-sys-seaweedfs.sh > > > > > SUCCESS ./6-login.sh > > > > > SUCCESS ./7-static.sh > > > > > SUCCESS ./8-user-redis.sh > > > > > SUCCESS ./9a-user-ferretdb.sh > > > > > SUCCESS ./9b-user-postgres.sh > > > > > SUCCESS ./10-user-seaweedfs.sh > > > > > SUCCESS ./14-runtime-testing.sh > > > > > SUCCESS ./11-sso-mock.sh > > > > > > > > > > Il giorno ven 11 set 2026 alle ore 10:14 Michele Sciabarra < > > > > > [email protected]> ha scritto: > > > > > > > > > > > Hi all, > > > > > > > > > > > > I propose the following RC to be released as the official > > > > > > Apache OpenServerless 0.9.0-incubating release. > > > > > > > > > > > > Apache OpenServerless is an effort undergoing incubation at The > Apache > > > > > > Software > > > > > > Foundation (ASF), sponsored by the Apache Incubator. Incubation > is > > > > > required > > > > > > of all newly accepted projects until a further review indicates > that the > > > > > > infrastructure, communications, and decision making process have > > > > > stabilized > > > > > > in a manner consistent with other successful ASF projects. While > > > > > incubation > > > > > > status is not necessarily a reflection of the completeness or > stability > > > > > of > > > > > > the code, it does indicate that the project has yet to be fully > endorsed > > > > > by > > > > > > the ASF. > > > > > > > > > > > > The artifacts for this release candidate can be found at: > > > > > > > > > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4 > > > > > > > > > > > > The Git tag to be voted upon is: > > > > > > > > > > > > v0.9.0-incubating-RC4 > > > > > > > > > > > > > > > > > > https://github.com/apache/openserverless/releases/tag/v0.9.0-incubating-RC4 > > > > > > > > > > > > Release artifacts are signed with the GPG key of the release > manager. > > > > > > > > > > > > The KEYS file is available at: > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/KEYS > > > > > > > > > > > > Please download, verify, and test the release candidate. > > > > > > > > > > > > For detailed step-by-step instructions on how to verify this > > > > > > release, please see the file VERIFY.md within the source > > > > > > archive, or check: > > > > > > > > > > > > https://github.com/apache/openserverless/blob/0.9.0/VERIFY.md > > > > > > > > > > > > The vote will run for a minimum of 72 hours and close no earlier > > > > > > than: > > > > > > > > > > > > 2026-09-14 07:12 UTC > > > > > > > > > > > > Please vote: > > > > > > > > > > > > [ ] +1 Release this package as Apache OpenServerless > 0.9.0-incubating > > > > > > [ ] +0 > > > > > > [ ] -1 Do not release this package because... (reason required) > > > > > > > > > > > > Only PPMC members have binding votes, but community votes are > > > > > > encouraged. > > > > > > > > > > > > Checklist for reference: > > > > > > [ ] Download links are valid > > > > > > [ ] Checksums and signatures are valid > > > > > > [ ] LICENSE/NOTICE files exist > > > > > > [ ] No unexpected binary files in source > > > > > > [ ] All source files have ASF headers > > > > > > [ ] Can compile from source > > > > > > > > > > > > On behalf of the Apache OpenServerless Podling PMC (PPMC), > > > > > > > > > > > > -- > > > > > > Michele Sciabarrà - [email protected] - > linkedin.com/in/msciab > > > > > > Apache OpenServerless committer - reddit.com/r/openserverless > > > > > > Apache OpenWhisk PMC member - Author Learning Apache OpenWhisk > > > > > > < > > > > > > > > > > > > https://www.oreilly.com/library/view/learning-apache-openwhisk/9781492046158/ > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > The life is short.. live at your best! > > > > > > > > > >
