Apologies the summaries of the issues have copy/paste issues but the links to the GitHub issues and PR should work.
On 2026/09/30 19:04:29 PJ Fanning wrote: > -1 binding. > Still a lot of licensing problems. Issues that I raised before was not > handled for RC7. > > Issues and pull requests raised in apache/openserverless while reviewing > 0.9.0-incubating-RC7 > > Issues > > #259 - Unzip.scala contains Stack Overflow code, not allowed by ASF licensing > policy > https://github.com/apache/openserverless/issues/259 > build/openwhisk/.../standalone/Unzip.scala (vendored from OpenWhisk) is based > on a Stack Overflow answer. Stack Overflow content is CC BY-SA, and ASF > policy does not allow it without the author's permission. Suggests a > clean-room rewrite (and guarding against zip-slip paths while doing so). > > #260 - Third-party files missing from LICENSE and carrying ASF heade > https://github.com/apache/openserverless/issues/260 > Lists vendored third-party content not in the top-level LICENSE: mvdd into > cli/tools/sh.go, and the Milvus, milvus-operator and Locustmanifests. Also > reports that vendored third-party files carry the ASF header instead of their > upstream notices, which ASF policy does not allow. A follow-up > comment cross-references the more specific issues below and notes thsince > been removed. > > #262 - Apache Kvrocks kvrocks.conf is bundled but not attributed in > https://github.com/apache/openserverless/issues/262 > oplugins-op/openserverless/templates/kvrocks-cm.yaml embeds the Apaconf, with > 8 settings changed. Suggests a LICENSE entry and theKvrocks attribution in > NOTICE. > > #263 - cert-manager.yaml: upstream copyright header replaced with ASF header, > and not in LICENSE > https://github.com/apache/openserverless/issues/263 > oplugins-op/deploy/cert-manager/cert-manager.yaml is the cert-manager v1.10.1 > manifest with its "Copyright 2022 The cert-manager Authors" header replaced > by the > ASF header. Suggests downloading it at install time, as oplugins alre header > and adding a LICENSE entry. > > #264 - Main.scala (OpenWhisk admin tool) contains MIT-licensed code bution > https://github.com/apache/openserverless/issues/264 > printErr() is Scallop 3.3.2's default error handler (MIT). Suggests ry. > > #265 - DockerToActivationFileLogStore.scala contains code derived frut > attribution > https://github.com/apache/openserverless/issues/265 > OwSink.combine is adapted from Akka 2.6.12 (Apache-2.0, Lightbend). r a > rewrite, possibly based on Apache Pekko instead. > > #266 - ExecManifest.scala copies the docker/distribution image-referbution > https://github.com/apache/openserverless/issues/266 > An 18-line grammar comment is copied verbatim from docker/distributiource > link is broken. Suggests a LICENSE entry and a pinned link, orrewording. > > #267 - Top-level LICENSE/NOTICE: bundled JavaScript copyright notices belong > in LICENSE, and several are inaccurate > https://github.com/apache/openserverless/issues/267 > The copyright lines for the npm packages bundled in upload.js and usage.js > are in the top-level NOTICE (lines 69-162), where ASF guidance says they do > not belong. > Eight of them do not match the upstream packages. Suggests moving thE. > > #268 - Source release: ship only the top-level LICENSE and NOTICE, n > https://github.com/apache/openserverless/issues/268 > The source release contains 85 LICENSE/NOTICE/DISCLAIMER files in suy > contradict each other and the top-level files. Asks for them to beleft out of > the source release. Notes that 26 Dockerfiles copy them into container > images, so the images need another source for them. > > #269 - Top-level LICENSE says Gradle wrapper v5.5, but the gradlew scripts > are from Gradle 6.9.1 > https://github.com/apache/openserverless/issues/269 > The vendored gradlew and gradlew.bat match OpenWhisk's Gradle 6.9.1 scripts, > not Gradle 5.5. Suggests correcting the version in LICENSE. > > Pull requests > > #261 - LICENSE/NOTICE: list every vendored copy of the bundled Kubernetes > components > https://github.com/apache/openserverless/pull/261 > Targets the 0.9.0 branch. Extends the existing LICENSE entries for > ingress-nginx, Kubegres, openshift-acme, Prometheus / kube-state-metrics and > the OpenWhisk Helm chart to also list the copies under oplugins-op/ and > testing/. Updatf #260. > > > On 2026-09-29 08:03 UTC Michele Sciabarra wrote: > > Hi all, > > > > RC6 included a javascript that while being apparently a source, should > > be considered a binary. > > I omitted the source for that, which was a mistake. I corrected this > > error by moving it to a separate repository and excluding it from the > > distribution as it is not currenly used. I also updated the licenses > > and distribution files and the location of the KEYS file. > > > > There are no code changes aside from that but we need to revote the > > distribution for submission to the IPMC. > > > > I propose the following RC to be released as the official > > Apache OpenServerless 0.9.0-incubating release. > > > > The artifacts for this release candidate can be found at: > > > > https://dist.apache.org/repos/dist/dev/incubator/openserverless/0.9.0-incubating-RC7 > > > > The Git tag to be voted upon is: > > > > v0.9.0-incubating-RC7 > > > > https://github.com/apache/openserverless/releases/tag/v0.9.0-incubating-RC7 > > > > Release artifacts are signed with the GPG key of the release manager. > > > > The KEYS file is available at: > > > > https://downloads.apache.org/incubator/openserverless/KEYS > > > > Please download, verify, and test the release candidate. > > > > For detailed step-by-step instructions on how to verify this > > release, please see the file VERIFY.md within the source > > archive, or check: > > > > https://github.com/apache/openserverless/blob/0.9.0/VERIFY.md > > > > The vote will run for a minimum of 72 hours and close no earlier > > than: > > > > 2026-10-02 07:55 UTC > > > > Please vote: > > > > [ ] +1 Release this package as Apache OpenServerless 0.9.0-incubating > > [ ] +0 > > [ ] -1 Do not release this package because... (reason required) > > > > Only PPMC members have binding votes, but community votes are > > encouraged. > > > > Checklist for reference: > > [ ] Download links are valid > > [ ] Checksums and signatures are valid > > [ ] LICENSE/NOTICE files exist > > [ ] No unexpected binary files in source > > [ ] All source files have ASF headers > > [ ] Can compile from source > > > > On behalf of the Apache OpenServerless Podling PMC (PPMC), > > > > Michele Sciabarra | CTO > > m: +44 747 984 8388 > > e: [email protected] > > l: https://linkedin.com/in/msciab > > Nuvolaris Inc | 1209 Orange Street, 19801Wilmington DE - US > > >
