+1 here is my check list not relying on provided script that may lead to false positive - just use standard tools
[X] Download links are valid $ wget -nv https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC5/apache-openserverless-0.9.0-incubating-src.tar.gz https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC5/apache-openserverless-0.9.0-incubating-src.tar.gz.asc https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC5/apache-openserverless-0.9.0-incubating-src.tar.gz.sha512 $ ls -l -rw-r--r--@ 1 msciab staff 6392970 14 Sep 02:04 apache-openserverless-0.9.0-incubating-src.tar.gz -rw-r--r--@ 1 msciab staff 870 14 Sep 02:04 apache-openserverless-0.9.0-incubating-src.tar.gz.asc -rw-r--r--@ 1 msciab staff 180 14 Sep 02:04 apache-openserverless-0.9.0-incubating-src.tar.gz.s [X] Checksums and signatures are valid $ sha512sum -c apache-openserverless-0.9.0-incubating-src.tar.gz.sha512 apache-openserverless-0.9.0-incubating-src.tar.gz: OK $ gpg --verify apache-openserverless-0.9.0-incubating-src.tar.gz.asc apache-openserverless-0.9.0-incubating-src.tar.gz gpg: Signature made Mon 14 Sep 02:02:49 2026 CEST gpg: using RSA key E64863824BDA2495CBAA57FDCEBE1A0116BE6665 gpg: Good signature from "Michele Sciabarra (Apache OpenServerless Release Key) <[email protected]>" [ultimate] [X] LICENSE/NOTICE files exist $ tar xzf apache-openserverless-0.9.0-incubating-src.tar.gz $ cat apache-openserverless-0.9.0-incubating/LICENSE (ok) $ cat apache-openserverless-0.9.0-incubating/NOTICE (ok) Text confirmed ok by Jean-Baptiste Onofré [X] No unexpected binary files in source Searching for binary files we find $ find . -type f -size +0 -print | xargs -L1 file --mime | grep -v 'text/' | wc -l 105 Excluding json and images we get: $ find . -type f -size +0 -print | xargs -L1 file --mime | grep -v 'text/' | grep -v -E '.json|.ico|.png|.jpg' ./oplugins/util/config/configurator.js: application/octet-stream; charset=binary This is actually one false positive as it is considered binary for an embedded character but is a bun generated javascript [X] All source files have ASF headers Using apache rat: $ java -jar ../apache-rat-0.18.jar --input-exclude-file .rat-excludes -- . the exclusion excludes the the bun.lock (json files) and go.sum (dependency files) which are allowed INFO: RAT summary: INFO: Approved: 1638 INFO: Archives: 0 INFO: Binaries: 268 INFO: Document types: 4 INFO: Ignored: 14 INFO: License categories: 2 INFO: License names: 2 INFO: Notices: 89 INFO: Standards: 1637 INFO: Unapproved: 0 INFO: Unknown: 0 [X] Can compile from source $ ./build-and-test-ubuntu.sh (long build and test) ============================================ SUCCESS ./1-deploy.sh SUCCESS ./2-ssl.sh SUCCESS ./3-sys-redis.sh SUCCESS ./4a-sys-ferretdb.sh SUCCESS ./4b-sys-postgres.sh SUCCESS ./5-sys-seaweedfs.sh SUCCESS ./6-login.sh SUCCESS ./7-static.sh SUCCESS ./8-user-redis.sh SUCCESS ./9a-user-ferretdb.sh SUCCESS ./9b-user-postgres.sh SUCCESS ./10-user-seaweedfs.sh SUCCESS ./14-runtime-testing.sh SUCCESS ./11-sso-mock.sh -- Michele Sciabarrà - [email protected] - linkedin.com/in/msciab Apache OpenServerless committer - reddit.com/r/openserverless Apache OpenWhisk PMC member - Author Learning Apache OpenWhisk Michele Sciabarra | CTO m: +44 747 984 8388 e: [email protected] l: https://linkedin.com/in/msciab Nuvolaris Inc | 1209 Orange Street, 19801Wilmington DE - US On Mon, 14 Sept 2026 at 09:44, Michele Sciabarra <[email protected]> wrote: > > Hi all, > > I propose the following RC to be released as the official > Apache OpenServerless 0.9.0-incubating release. > > Apache OpenServerless is an effort undergoing incubation at The Apache > Software > Foundation (ASF), sponsored by the Apache Incubator. Incubation is required > of all newly accepted projects until a further review indicates that the > infrastructure, communications, and decision making process have stabilized > in a manner consistent with other successful ASF projects. While incubation > status is not necessarily a reflection of the completeness or stability of > the code, it does indicate that the project has yet to be fully endorsed by > the ASF. > > The artifacts for this release candidate can be found at: > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC5 > > The Git tag to be voted upon is: > > v0.9.0-incubating-RC5 > > The release can be browser on version control here: > > https://github.com/apache/openserverless/tree/v0.9.0-incubating-RC5 > > Release artifacts are signed with the GPG key of the release manager. > > The KEYS file is available at: > > https://dist.apache.org/repos/dist/release/incubator/openserverless/KEYS > > Please download, verify, and test the release candidate. > > For detailed step-by-step instructions on how to verify this > release, please see the file VERIFY.md within the source > archive. > > The vote will run for a minimum of 72 hours and close no earlier > than: > > 2026-09-17 10:00 UTC > > Please vote: > > [ ] +1 Release this package as Apache OpenServerless 0.9.0-incubating > [ ] +0 > [ ] -1 Do not release this package because... (reason required) > > Only PPMC members have binding votes, but community votes are > encouraged. > > Checklist for reference: > [ ] Download links are valid > [ ] Checksums and signatures are valid > [ ] LICENSE/NOTICE files exist > [ ] No unexpected binary files in source > [ ] All source files have ASF headers > [ ] Can compile from source > > On behalf of the Apache OpenServerless Podling PMC (PPMC), > -- > Michele Sciabarrà - [email protected] - linkedin.com/in/msciab > Apache OpenServerless committer - reddit.com/r/openserverless > Apache OpenWhisk PMC member - Author Learning Apache OpenWhisk
