The source release should be reproducible. Can you write a document in English that describes the release process? Not a link to a shell script.
This is in your vote email. [ ] All source files have ASF headers This means all files. Test files are not excluded from this rule. Markdown files are not excluded from this rule. These are source files. Apache RAT is located at https://creadur.apache.org/rat/ Any file that is in the tar.gz needs a source header. On 2026/09/11 22:00:10 Michele Sciabarra wrote: > >Your tar.gz has 100s of files that don't have Apache licenses. > > used Apache Rat to check. > We use license-eye the files without a license are usually test files > data file and config files that does not need a license. > Please provide a list of the files that you think actually needs a license. > > > >You have dozens of OpenWhisk source files in the tar.gz - why is this? > It is a vendored specific version with patches. > > But I already mentioned the mistake I did not include the full notice > > In the updated version there is the full mention of all the openwhisk > components > > https://github.com/apache/openserverless/blob/8b8c3f134daedf0b272294b77da703b730e02018/NOTICE#L249 > > >Why are they not mentioned in your license and notice if you need them? > Because last minute I did not merge the LICENSE from my fork. My mistake. > THis is why I am going to cancel the vote and re-issue the version > with the proper LICENSE and NOTICE. > > > -- > Michele Sciabarrà - [email protected] - linkedin.com/in/msciab > Apache OpenServerless committer - reddit.com/r/openserverless > Apache OpenWhisk PMC member - Author Learning Apache OpenWhisk > > > > Michele Sciabarra | CTO > m: +44 747 984 8388 > e: [email protected] > l: https://linkedin.com/in/msciab > Nuvolaris Inc | 1209 Orange Street, 19801Wilmington DE - US > > > > > On Fri, 11 Sept 2026 at 23:51, PJ Fanning <[email protected]> wrote: > > > > Your tar.gz has 100s of files that don't have Apache licenses. > > I used Apache Rat to check. > > > > You have dozens of OpenWhisk source files in the tar.gz - why is this? > > > > Why are they not mentioned in your license and notice if you need them? > > > > On 2026/09/11 21:47:28 PJ Fanning wrote: > > > Also the directory name is good > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/ > > > but file name should omit the RC4 > > > apache-openserverless-0.9.0-incubating-RC4-src.tar.gz > > > should be > > > apache-openserverless-0.9.0-incubating-src.tar.gz > > > > > > The RC4 is in the directory name. > > > The file will hopefully be released and you shouldn't rename the file > > > when releasing. > > > > > > Most teams use something like this to release > > > svn mv dev/incubator/openserverless/0.9.0-incubating-RC4 > > > release/incubator/openserverless/0.9.0-incubating > > > svn commit . -m "Release OpenServerless 0.9.0" > > > > > > Likewise, the directory inside the tar.gz should omit the RC4. Your > > > tar.gz has the RC4 in the filenames. For example, > > > openserverless-0.9.0-incubating-RC4/admin-api/README.md > > > should be > > > openserverless-0.9.0-incubating/admin-api/README.md > > > > > > > > > > > > > > > > > > On 2026/09/11 21:33:52 PJ Fanning wrote: > > > > I didn't ask for the files in the RC to be renamed. I said to fix it in > > > > the next RC. > > > > You have now invalidated everyone's vote by modifying the artifacts. > > > > > > > > -1 binding due to the interference in the RC files after the vote > > > > started. > > > > > > > > On 2026/09/11 21:22:09 Michele Sciabarra wrote: > > > > > Files renamed. I have checked the signatures, they are still valid. > > > > > > > > > > > > > > > Michele Sciabarra | CTO > > > > > m: +44 747 984 8388 > > > > > e: [email protected] > > > > > l: https://linkedin.com/in/msciab > > > > > Nuvolaris Inc | 1209 Orange Street, 19801Wilmington DE - US > > > > > > > > > > > > > > > > > > > > On Fri, 11 Sept 2026 at 22:45, PJ Fanning <[email protected]> > > > > > wrote: > > > > > > > > > > > Not a blocker for this release but you should prefix the tar.gz > > > > > > file name > > > > > > and other file names with 'apache'. > > > > > > > > > > > > openserverless-0.9.0-incubating-RC4-src.tar.gz > > > > > > should be > > > > > > apache-openserverless-0.9.0-incubating-RC4-src.tar.gz > > > > > > > > > > > > On 2026/09/11 20:42:52 PJ Fanning wrote: > > > > > > > Remove the dev KEYS file: > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/KEYS > > > > > > > > > > > > > > I don't why podling after podling keeps breaking this rule. > > > > > > > The KEYS file must be in > > > > > > > https://downloads.apache.org/incubator/openserverless/KEYS > > > > > > > > > > > > > > This file is synched from > > > > > > > https://dist.apache.org/repos/dist/release/incubator/openserverless/KEYS > > > > > > > > > > > > > > The RC does go in > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless > > > > > > > > > > > > > > It is the KEYS file that must be in > > > > > > https://dist.apache.org/repos/dist/release/incubator/openserverless > > > > > > > > > > > > > > > > > > > > > On 2026/09/11 20:20:56 Bruno wrote: > > > > > > > > +1 > > > > > > > > > > > > > > > > I verified the release candidate as follows on Ubuntu 24.04 LTS. > > > > > > > > > > > > > > > > [X] Download links are valid > > > > > > > > > > > > > > > > $ wget -nv \ > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/KEYS > > > > > > \ > > > > > > > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/openserverless-0.9.0-incubating-RC4-src.tar.gz > > > > > > > > \ > > > > > > > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/openserverless-0.9.0-incubating-RC4-src.tar.gz.asc > > > > > > > > \ > > > > > > > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/openserverless-0.9.0-incubating-RC4-src.tar.gz.sha512 > > > > > > > > > > > > > > > > All four files were downloaded successfully from the official > > > > > > > > Apache > > > > > > HTTPS > > > > > > > > URLs. > > > > > > > > > > > > > > > > [X] Checksums and signatures are valid > > > > > > > > - SHA512 checksum verified: OK > > > > > > > > > > > > > > > > $ sha512sum -c > > > > > > > > openserverless-0.9.0-incubating-RC4-src.tar.gz.sha512 > > > > > > > > openserverless-0.9.0-incubating-RC4-src.tar.gz: OK > > > > > > > > > > > > > > > > $ gpg --import KEYS > > > > > > > > gpg: key CEBE1A0116BE6665: public key "Michele Sciabarra (Apache > > > > > > > > OpenServerless Release Key) <[email protected]>" imported > > > > > > > > gpg: key BD49E720DDA765FF: public key "Francesco Timperi Tiberi > > > > > > > > < > > > > > > > > [email protected]>" imported > > > > > > > > gpg: key CC940C9E19629781: public key "Michele Manzani < > > > > > > > > [email protected]>" imported > > > > > > > > gpg: Total number processed: 3 > > > > > > > > gpg: imported: 3 > > > > > > > > > > > > > > > > $ gpg --verify > > > > > > > > openserverless-0.9.0-incubating-RC4-src.tar.gz.asc > > > > > > > > gpg: assuming signed data in > > > > > > > > 'openserverless-0.9.0-incubating-RC4-src.tar.gz' > > > > > > > > gpg: Signature made Fri Sep 11 07:12:20 2026 UTC > > > > > > > > gpg: using RSA key > > > > > > E64863824BDA2495CBAA57FDCEBE1A0116BE6665 > > > > > > > > gpg: Good signature from "Michele Sciabarra (Apache > > > > > > > > OpenServerless > > > > > > Release > > > > > > > > Key) <[email protected]>" [unknown] > > > > > > > > gpg: Signature notation: manu=2,2.5+1.12,0,3 > > > > > > > > gpg: WARNING: This key is not certified with a trusted > > > > > > > > signature! > > > > > > > > gpg: There is no indication that the signature belongs > > > > > > > > to the > > > > > > > > owner. > > > > > > > > Primary key fingerprint: E648 6382 4BDA 2495 CBAA 57FD CEBE > > > > > > > > 1A01 16BE > > > > > > 6665 > > > > > > > > > > > > > > > > The signature was verified successfully against the key > > > > > > > > imported from > > > > > > the > > > > > > > > official KEYS file. The trust warning is expected with this > > > > > > > > fresh > > > > > > keyring; > > > > > > > > no owner trust was assigned. > > > > > > > > > > > > > > > > [X] LICENSE/NOTICE files exist > > > > > > > > $ grep -E 'Apache' LICENSE NOTICE > > > > > > > > > > > > > > > > LICENSE: Apache License > > > > > > > > LICENSE: APPENDIX: How to apply the Apache License to your > > > > > > > > work. > > > > > > > > LICENSE: To apply the Apache License to your work, attach > > > > > > > > the > > > > > > following > > > > > > > > LICENSE: Licensed under the Apache License, Version 2.0 (the > > > > > > "License"); > > > > > > > > NOTICE:Apache OpenServerless (Incubating) > > > > > > > > NOTICE:Copyright 2024 The Apache Software Foundation > > > > > > > > NOTICE:The Apache Software Foundation (http://www.apache.org/). > > > > > > > > > > > > > > > > $ task find-binaries > > > > > > > > # No output: no unexpected binary files reported. > > > > > > > > > > > > > > > > [X] ASF license header checks pass > > > > > > > > > > > > > > > > $ task license > > > > > > > > > > > > > > > > INFO Totally checked 3394 files, valid: 15, invalid: 0, > > > > > > > > ignored: 3379, > > > > > > > > fixed: 0 > > > > > > > > *** Checking license headers in admin-api > > > > > > > > INFO Totally checked 59 files, valid: 48, invalid: 0, ignored: > > > > > > > > 11, > > > > > > fixed: 0 > > > > > > > > *** Checking license headers in build > > > > > > > > INFO Totally checked 1130 files, valid: 16, invalid: 0, > > > > > > > > ignored: 1114, > > > > > > > > fixed: 0 > > > > > > > > *** Checking license headers in cli > > > > > > > > INFO Totally checked 930 files, valid: 132, invalid: 0, > > > > > > > > ignored: 798, > > > > > > > > fixed: 0 > > > > > > > > *** Checking license headers in devcontainer > > > > > > > > INFO Totally checked 14 files, valid: 8, invalid: 0, ignored: 6, > > > > > > fixed: 0 > > > > > > > > *** Checking license headers in oplugins-op > > > > > > > > INFO Totally checked 590 files, valid: 510, invalid: 0, > > > > > > > > ignored: 80, > > > > > > fixed: > > > > > > > > 0 > > > > > > > > *** Checking license headers in oplugins > > > > > > > > INFO Totally checked 216 files, valid: 148, invalid: 0, > > > > > > > > ignored: 68, > > > > > > fixed: > > > > > > > > 0 > > > > > > > > *** Checking license headers in runtimes > > > > > > > > INFO Totally checked 300 files, valid: 140, invalid: 0, > > > > > > > > ignored: 160, > > > > > > > > fixed: 0 > > > > > > > > *** Checking license headers in streamer > > > > > > > > INFO Totally checked 26 files, valid: 17, invalid: 0, ignored: > > > > > > > > 9, > > > > > > fixed: 0 > > > > > > > > > > > > > > > > The checks passed using the exclusions configured in the > > > > > > > > release's .licenserc.yaml files. No automatic fixes were > > > > > > > > applied. > > > > > > > > > > > > > > > > [X] Can compile from source > > > > > > > > > > > > > > > > $ ./build-and-test-ubuntu.sh > > > > > > > > > > > > > > > > Exit status: 0 > > > > > > > > > > > > > > > > - All 14 test scripts passed: > > > > > > > > ============================================ > > > > > > > > SUCCESS ./1-deploy.sh > > > > > > > > SUCCESS ./2-ssl.sh > > > > > > > > SUCCESS ./3-sys-redis.sh > > > > > > > > SUCCESS ./4a-sys-ferretdb.sh > > > > > > > > SUCCESS ./4b-sys-postgres.sh > > > > > > > > SUCCESS ./5-sys-seaweedfs.sh > > > > > > > > SUCCESS ./6-login.sh > > > > > > > > SUCCESS ./7-static.sh > > > > > > > > SUCCESS ./8-user-redis.sh > > > > > > > > SUCCESS ./9a-user-ferretdb.sh > > > > > > > > SUCCESS ./9b-user-postgres.sh > > > > > > > > SUCCESS ./10-user-seaweedfs.sh > > > > > > > > SUCCESS ./14-runtime-testing.sh > > > > > > > > SUCCESS ./11-sso-mock.sh > > > > > > > > > > > > > > > > Regards, > > > > > > > > Bruno > > > > > > > > > > > > > > > > Il giorno ven 11 set 2026 alle ore 21:19 Lorenzo Sarna < > > > > > > > > [email protected]> ha scritto: > > > > > > > > > > > > > > > > > +1 (non-binding) > > > > > > > > > > > > > > > > > > I verified the release candidate as follows: > > > > > > > > > > > > > > > > > > [X] Download links are valid > > > > > > > > > - Downloaded openserverless-0.9.0-incubating-RC4-src.tar.gz > > > > > > > > > from > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4/ > > > > > > > > > > > > > > > > > > [X] Checksums and signatures are valid > > > > > > > > > - Imported KEYS (3 keys imported), verified GPG signature: > > > > > > > > > "Good signature from Michele Sciabarra (Apache > > > > > > > > > OpenServerless > > > > > > Release > > > > > > > > > Key)" > > > > > > > > > - SHA512 checksum verified: OK > > > > > > > > > > > > > > > > > > [X] LICENSE/NOTICE files exist > > > > > > > > > - LICENSE, NOTICE, README.md, CHANGES present at root > > > > > > > > > > > > > > > > > > [X] No unexpected binary files in source > > > > > > > > > - Checked for .lockb and .jar files: none found > > > > > > > > > > > > > > > > > > [X] Can compile from source > > > > > > > > > - Ran .\build-and-test-windows.ps1 on Windows 10 Home + WSL2 > > > > > > > > > - All 14 test scripts passed: > > > > > > > > > SUCCESS ./1-deploy.sh > > > > > > > > > SUCCESS ./2-ssl.sh > > > > > > > > > SUCCESS ./3-sys-redis.sh > > > > > > > > > SUCCESS ./4a-sys-ferretdb.sh > > > > > > > > > SUCCESS ./4b-sys-postgres.sh > > > > > > > > > SUCCESS ./5-sys-seaweedfs.sh > > > > > > > > > SUCCESS ./6-login.sh > > > > > > > > > SUCCESS ./7-static.sh > > > > > > > > > SUCCESS ./8-user-redis.sh > > > > > > > > > SUCCESS ./9a-user-ferretdb.sh > > > > > > > > > SUCCESS ./9b-user-postgres.sh > > > > > > > > > SUCCESS ./10-user-seaweedfs.sh > > > > > > > > > SUCCESS ./14-runtime-testing.sh > > > > > > > > > SUCCESS ./11-sso-mock.sh > > > > > > > > > > > > > > > > > > Il giorno ven 11 set 2026 alle ore 10:14 Michele Sciabarra < > > > > > > > > > [email protected]> ha scritto: > > > > > > > > > > > > > > > > > > > Hi all, > > > > > > > > > > > > > > > > > > > > I propose the following RC to be released as the official > > > > > > > > > > Apache OpenServerless 0.9.0-incubating release. > > > > > > > > > > > > > > > > > > > > Apache OpenServerless is an effort undergoing incubation at > > > > > > > > > > The > > > > > > Apache > > > > > > > > > > Software > > > > > > > > > > Foundation (ASF), sponsored by the Apache Incubator. > > > > > > > > > > Incubation is > > > > > > > > > required > > > > > > > > > > of all newly accepted projects until a further review > > > > > > > > > > indicates > > > > > > that the > > > > > > > > > > infrastructure, communications, and decision making process > > > > > > > > > > have > > > > > > > > > stabilized > > > > > > > > > > in a manner consistent with other successful ASF projects. > > > > > > > > > > While > > > > > > > > > incubation > > > > > > > > > > status is not necessarily a reflection of the completeness > > > > > > > > > > or > > > > > > stability > > > > > > > > > of > > > > > > > > > > the code, it does indicate that the project has yet to be > > > > > > > > > > fully > > > > > > endorsed > > > > > > > > > by > > > > > > > > > > the ASF. > > > > > > > > > > > > > > > > > > > > The artifacts for this release candidate can be found at: > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC4 > > > > > > > > > > > > > > > > > > > > The Git tag to be voted upon is: > > > > > > > > > > > > > > > > > > > > v0.9.0-incubating-RC4 > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > https://github.com/apache/openserverless/releases/tag/v0.9.0-incubating-RC4 > > > > > > > > > > > > > > > > > > > > Release artifacts are signed with the GPG key of the release > > > > > > manager. > > > > > > > > > > > > > > > > > > > > The KEYS file is available at: > > > > > > > > > > > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/KEYS > > > > > > > > > > > > > > > > > > > > Please download, verify, and test the release candidate. > > > > > > > > > > > > > > > > > > > > For detailed step-by-step instructions on how to verify this > > > > > > > > > > release, please see the file VERIFY.md within the source > > > > > > > > > > archive, or check: > > > > > > > > > > > > > > > > > > > > https://github.com/apache/openserverless/blob/0.9.0/VERIFY.md > > > > > > > > > > > > > > > > > > > > The vote will run for a minimum of 72 hours and close no > > > > > > > > > > earlier > > > > > > > > > > than: > > > > > > > > > > > > > > > > > > > > 2026-09-14 07:12 UTC > > > > > > > > > > > > > > > > > > > > Please vote: > > > > > > > > > > > > > > > > > > > > [ ] +1 Release this package as Apache OpenServerless > > > > > > 0.9.0-incubating > > > > > > > > > > [ ] +0 > > > > > > > > > > [ ] -1 Do not release this package because... (reason > > > > > > > > > > required) > > > > > > > > > > > > > > > > > > > > Only PPMC members have binding votes, but community votes > > > > > > > > > > are > > > > > > > > > > encouraged. > > > > > > > > > > > > > > > > > > > > Checklist for reference: > > > > > > > > > > [ ] Download links are valid > > > > > > > > > > [ ] Checksums and signatures are valid > > > > > > > > > > [ ] LICENSE/NOTICE files exist > > > > > > > > > > [ ] No unexpected binary files in source > > > > > > > > > > [ ] All source files have ASF headers > > > > > > > > > > [ ] Can compile from source > > > > > > > > > > > > > > > > > > > > On behalf of the Apache OpenServerless Podling PMC (PPMC), > > > > > > > > > > > > > > > > > > > > -- > > > > > > > > > > Michele Sciabarrà - [email protected] - > > > > > > > > > > linkedin.com/in/msciab > > > > > > > > > > Apache OpenServerless committer - > > > > > > > > > > reddit.com/r/openserverless > > > > > > > > > > Apache OpenWhisk PMC member - Author Learning Apache > > > > > > > > > > OpenWhisk > > > > > > > > > > < > > > > > > > > > > > > > > > > > > > > > > > > > https://www.oreilly.com/library/view/learning-apache-openwhisk/9781492046158/ > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > > > > > > > The life is short.. live at your best! > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >
