+1 non-binding. I only audited the tarball and the maven artifacts, not the code; leaving that to others. I was answering the question "did the release-manager place anything malicious in the nexus artifacts", which is something you should be doing for all releases these days.
Verified the RC1 source tarball and staged Maven artifacts: * Source tarball SHA-512 OK; GPG signature good (Fokko Driesprong, key 2F37 FE05 5E54 7EDD ACD9 A633 B13C 6981 6C5E 13EF). Signed Fokko's key BTW, as nobody else has. * Extracted source matches tag apache-parquet-1.18.0-rc1 exactly * All 15 staged modules (104 artifacts): SHA-1/MD5 checksums match and every GPG signature is good * Rebuilt from the tag with JDK 11 (mvn clean package): parquet-encoding and parquet-jackson jars are byte-identical to the release; the rest differ only in bytecode traceable to a javac string-concat idiom (String.valueOf + makeConcatWithConstants). * No structural differences (no added/removed classes, methods, or fields) and no new suspicious API calls in any jar. For anyone who wants to do that jar comparison, Auditor: https://github.com/steveloughran/auditor This disassembles the binary and looks at the bytecodes, so doesn't require a byte for byte match. Give it to claude to validate (as done here) and it'll analyse why there there's a mismatch. steve On Mon, 20 Jul 2026 at 15:30, Fokko Driesprong <[email protected]> wrote: > Hi everyone, > > I propose the following RC to be released as official Apache Parquet > 1.18.0 release. > > - The commit id is [5e2ad0969c7f411613671c5ef054d399995de5f9]( > https://github.com/apache/parquet-java/tree/5e2ad0969c7f411613671c5ef054d399995de5f9 > ) > - This corresponds to the tag: [apache-parquet-1.18.0-rc1]( > https://github.com/apache/parquet-java/releases/tag/apache-parquet-1.18.0-rc1 > ) > > The release tarball, signature, and checksums are here: > > - > https://dist.apache.org/repos/dist/dev/parquet/apache-parquet-1.18.0-rc1/ > > You can find the KEYS file here: > > - https://downloads.apache.org/parquet/KEYS > > You can find the changelog here: > > - > https://github.com/apache/parquet-java/releases/tag/apache-parquet-1.18.0-rc1 > > Binary artifacts are staged in Nexus here: > > - https://repository.apache.org/content/groups/staging/org/apache/parquet/ > > Please download, verify, and test. > > Please vote in the next 72 hours. > > [ ] +1 Release this as Apache Parquet 1.18.0 > [ ] +0 > [ ] -1 Do not release this because... > > Kind regards, > Fokko Driesprong
