I found a potential issue with the license and notice files that might be a release blocker.
Many of the jars lack license files, notice files, or both. Out of 59 staged JARs: - 40 lack both files - 2 lack LICENSE - 10 lack NOTICE The remaining 7 contain both, but their contents might be incomplete or outdated. Here's the script I used to verify and the result from the audit: https://gist.github.com/kevinjqliu/2f899c085abb2716b13c220d4f52a677?permalink_comment_id=6271325#gistcomment-6271325 I also found that the NOTICE file's copyright year is out of date ( https://github.com/apache/parquet-java/blob/83c2c80d49c57b1ae180df45229ee01dbceddc1e/NOTICE#L3 ) This is my first time verifying a parquet-java release, so please let me know if there's anything I'm missing. Best, Kevin Liu On Wed, Jul 22, 2026 at 1:30 PM Steve Loughran <[email protected]> wrote: > +1 non-binding. > > I only audited the tarball and the maven artifacts, not the code; leaving > that to others. I was answering the question "did the release-manager place > anything malicious in the nexus artifacts", which is something you should > be doing for all releases these days. > > Verified the RC1 source tarball and staged Maven artifacts: > * Source tarball SHA-512 OK; GPG signature good (Fokko Driesprong, key 2F37 > FE05 5E54 7EDD ACD9 A633 B13C 6981 6C5E 13EF). Signed Fokko's key BTW, as > nobody else has. > * Extracted source matches tag apache-parquet-1.18.0-rc1 exactly > * All 15 staged modules (104 artifacts): SHA-1/MD5 checksums match and > every GPG signature is good > * Rebuilt from the tag with JDK 11 (mvn clean package): parquet-encoding > and parquet-jackson jars are byte-identical to the release; the rest differ > only in bytecode traceable to a javac string-concat idiom (String.valueOf + > makeConcatWithConstants). > * No structural differences (no added/removed classes, methods, or fields) > and no new suspicious API calls in any jar. > > For anyone who wants to do that jar comparison, Auditor: > https://github.com/steveloughran/auditor > This disassembles the binary and looks at the bytecodes, so doesn't require > a byte for byte match. Give it to claude to validate (as done here) and > it'll analyse why there there's a mismatch. > > steve > > > On Mon, 20 Jul 2026 at 15:30, Fokko Driesprong <[email protected]> > wrote: > > > Hi everyone, > > > > I propose the following RC to be released as official Apache Parquet > > 1.18.0 release. > > > > - The commit id is [5e2ad0969c7f411613671c5ef054d399995de5f9]( > > > https://github.com/apache/parquet-java/tree/5e2ad0969c7f411613671c5ef054d399995de5f9 > > ) > > - This corresponds to the tag: [apache-parquet-1.18.0-rc1]( > > > https://github.com/apache/parquet-java/releases/tag/apache-parquet-1.18.0-rc1 > > ) > > > > The release tarball, signature, and checksums are here: > > > > - > > > https://dist.apache.org/repos/dist/dev/parquet/apache-parquet-1.18.0-rc1/ > > > > You can find the KEYS file here: > > > > - https://downloads.apache.org/parquet/KEYS > > > > You can find the changelog here: > > > > - > > > https://github.com/apache/parquet-java/releases/tag/apache-parquet-1.18.0-rc1 > > > > Binary artifacts are staged in Nexus here: > > > > - > https://repository.apache.org/content/groups/staging/org/apache/parquet/ > > > > Please download, verify, and test. > > > > Please vote in the next 72 hours. > > > > [ ] +1 Release this as Apache Parquet 1.18.0 > > [ ] +0 > > [ ] -1 Do not release this because... > > > > Kind regards, > > Fokko Driesprong >
