+1 (non-binding)
The following checks passed: - Verified the SHA-512 checksum of the staged source archive. - Verified its GPG signature using the published Paimon KEYS file. - Confirmed that the top-level LICENSE and NOTICE files are present and that the workspace version is 0.5.0. - Confirmed that the CI run and the Release Rust validation job succeeded for the candidate commit. Best, Jacky Jingsong Li <[email protected]> 于2026年10月26日周一 19:42写道： > Hi everyone, > > Please review and vote on release candidate #1 for Apache Paimon Rust > 0.5.0. > > [ ] +1 Approve the release > [ ] +0 No opinion > [ ] -1 Do not approve (please provide specific comments) > > Source candidate, signature, and SHA-512 checksum: > https://dist.apache.org/repos/dist/dev/paimon/paimon-rust-0.5.0-rc1/ > > Git tag: > https://github.com/apache/paimon-rust/tree/v0.5.0-rc1 > > Git commit: > 370428b053da5692fad3cf9db32f95e62d72ab98 > > KEYS for signature verification: > https://downloads.apache.org/paimon/KEYS > > Verification instructions: > > https://github.com/apache/paimon-rust/blob/v0.5.0-rc1/docs/src/release/verifying-a-release-candidate.md > > Changes since 0.4.0: > https://github.com/apache/paimon-rust/compare/v0.4.0...v0.5.0-rc1 > > Release validation workflow: > https://github.com/apache/paimon-rust/actions/runs/40314807343 > > The automated release workflows are currently waiting for > GitHub-hosted Linux runners. The source commit passed all 16 project > CI checks before the candidate was tagged: > https://github.com/apache/paimon-rust/actions/runs/40205637621 > > The vote is on the signed source artifacts linked above. The release > workflow results and language-specific candidate artifacts will be > available as the queued builds complete. > > Local validation completed: dependency report verification, dependency > license checks, all-feature packaging and compilation of both Rust > crates, paimon publication dry run, signed tag and source signature > verification, and SHA-512 verification. The staged source artifacts > were downloaded and compared byte for byte with the local originals. > > The following pre-existing dependency advisory alerts remain open for > review in this candidate: > - thrift 0.17.0 via parquet 58.4.0: > https://github.com/advisories/GHSA-2f9f-gq7v-9h6m > - Python binding pyo3 0.28.3: > https://github.com/advisories/GHSA-36hh-v3qg-5jq4 and > https://github.com/advisories/GHSA-chgr-c6px-7xpp > - Go binding klauspost/compress 1.17.11: > https://github.com/advisories/GHSA-259r-337f-4rfw > > These dependency alerts have not been fixed or dismissed in this > candidate. Initial source inspection found that the Go binding imports > zstd rather than the affected s2 API, and found no direct use of the > affected PyO3 APIs in the Python binding. This is not a complete > transitive reachability audit. > > The vote will be open for at least 72 hours. > > Thanks, > Jingsong Lee >
