Ran through this with the help of Cursor, I found a few licensing issues which we should probably fix
+0 for fixing the issues even if they are minor Issues ------ 1. A few bundled dependencies lack explicit BUNDLE-LICENSE entries: com.google.code.findbugs:jsr305 (Apache 2.0) and Mortbay Jetty 6.1.26 (Apache 2.0). Both are ASF-compatible but should be listed for completeness. *// Russ Annotation ^^ These are both pulled in through Hive and contained in the runtime jar, see javax/annotation/Nonnull.class and org/mortbay/jetty/Server* 2. Typos in BUNDLE-LICENSE: "artfiact" (line 475, Commons Codec), "artfifact" (line 972, Curator), "artiifact" (line 1007, Iceberg), "httsp://" (line 988, Hadoop URL). *// These are just typos ^^* ---- Apache Polaris Iceberg Catalog Migrator 1.0.0 RC2 — Validation Report Tag: apache-polaris-iceberg-catalog-migrator-1.0.0-rc2 (289ca6d3294b97d46f5f3faa62df6a8dfc32c430) Signed by: Ajantha Bhat ([email protected]) Passed ------ SHA-512 checksum matches $ shasum -a 512 apache-polaris-iceberg-catalog-migrator-1.0.0.tar.gz 8cfce06da67209f57671d5dcd6f6ccb64795791dd5c01c7037845296b53329fc... apache-polaris-iceberg-catalog-migrator-1.0.0.tar.gz $ cat apache-polaris-iceberg-catalog-migrator-1.0.0.tar.gz.sha512 8cfce06da67209f57671d5dcd6f6ccb64795791dd5c01c7037845296b53329fc... apache-polaris-iceberg-catalog-migrator-1.0.0.tar.gz (hashes match) GPG signature valid, key in KEYS file $ gpg --import KEYS gpg: key 72E803684280EDCC: public key "Ajantha Bhat (code signing key) < [email protected]>" imported $ gpg --verify apache-polaris-iceberg-catalog-migrator-1.0.0.tar.gz.asc apache-polaris-iceberg-catalog-migrator-1.0.0.tar.gz gpg: Signature made Mon Mar 2 23:11:13 2026 CST gpg: using RSA key C9F50E96A9CBF484BED046B972E803684280EDCC gpg: Good signature from "Ajantha Bhat (code signing key) < [email protected]>" Source tarball matches git tag exactly (diffed all 82 files) $ git rev-parse apache-polaris-iceberg-catalog-migrator-1.0.0-rc2 289ca6d3294b97d46f5f3faa62df6a8dfc32c430 (matches commit hash in vote email) $ diff -r <extracted-tarball>/iceberg-catalog-migrator <git-checkout>/iceberg-catalog-migrator Only in <git-checkout>: .gradle Only in <git-checkout>: build (only local build artifacts differ; source files identical) No binaries in source tarball $ find . -name "*.jar" -o -name "*.class" -o -name "*.war" -o -name "*.so" -o -name "*.dll" (no output — clean) $ file gradle/wrapper/* gradle/wrapper/gradle-wrapper.properties: ASCII text (no gradle-wrapper.jar present) LICENSE file present and correct $ cat LICENSE Apache License Version 2.0, January 2004 ... This product includes a gradle wrapper. Copyright: 2010-2019 Gradle Authors. License: https://www.apache.org/licenses/LICENSE-2.0 NOTICE file present and correct $ cat NOTICE Apache Polaris Copyright 2026 The Apache Software Foundation ... The initial code for the iceberg catalog migrator project was donated to the ASF by Dremio Corporation. (https://www.dremio.com/) copyright 2022. version.txt is 1.0.0 $ cat version.txt 1.0.0 All 48 Java/Kotlin/Gradle source files have ASF license headers $ for f in $(find . -name "*.java" -o -name "*.kt" -o -name "*.kts"); do head -2 "$f"; done /* * Licensed to the Apache Software Foundation (ASF) under one (same output for all 48 files, no exceptions) RAT report: 73 files, 0 unknown licenses $ cat build/reports/rat/rat-report.txt Standards: 73 Apache Licensed: 73 0 Unknown Licenses Build from source succeeds, all unit tests pass $ ./gradlew build -x intTest > Task :iceberg-catalog-migrator-api:test > Task :iceberg-catalog-migrator-cli:test > Task :iceberg-catalog-migrator-cli:check BUILD SUCCESSFUL in 1m 27s 72 actionable tasks: 66 executed, 6 from cache Maven staging artifacts present with signatures and checksums Browsed https://repository.apache.org/content/repositories/orgapachepolaris-1057/ 3 modules: iceberg-catalog-migrator-api, iceberg-catalog-migrator-api-test, iceberg-catalog-migrator-cli Each has .jar, .pom, .asc, .sha512, -sources.jar, -javadoc.jar $ curl ... iceberg-catalog-migrator-api-1.0.0.pom <groupId>org.apache.polaris.tools.iceberg-catalog-migrator</groupId> <version>1.0.0</version> <license><name>Apache-2.0</name></license> No GPL-only dependencies $ rg -i "GPL" cli/BUNDLE-LICENSE | rg -v "CDDL\+GPL|glassfish|LGPL" (no output — no GPL-only deps) Dependency cross-reference (uber-jar contents vs BUNDLE-LICENSE) $ jar tf cli/build/libs/iceberg-catalog-migrator-cli-1.0.0.jar | grep "pom.properties$" | wc -l 175 $ rg "^This" cli/BUNDLE-LICENSE | wc -l 101 (extracted groupId/artifactId/version from each of 175 pom.properties, mapped to the 101 BUNDLE-LICENSE entries; ) *// I took the issues and manually went through them and added the real ones to the top of this email* On Fri, Mar 6, 2026 at 7:57 PM Ajantha Bhat <[email protected]> wrote: > Gentle reminder to verify the release and cast your votes. > > Thanks > > On Tue, Mar 3, 2026 at 12:24 PM Ajantha Bhat <[email protected]> > wrote: > > > Hi everyone, > > > > I propose that we release the following RC as the official > > Apache Polaris Iceberg catalog migrator 1.0.0 release. > > > > * This corresponds to the tag: > > apache-polaris-iceberg-catalog-migrator-1.0.0-rc2 > > * > > > https://github.com/apache/polaris-tools/commits/apache-polaris-iceberg-catalog-migrator-1.0.0-rc2/ > > * > > > https://github.com/apache/polaris-tools/tree/289ca6d3294b97d46f5f3faa62df6a8dfc32c430 > > > > The release tarball, signature, and checksums are here: > > * > > > https://dist.apache.org/repos/dist/dev/polaris/apache-polaris-iceberg-catalog-migrator/1.0.0/ > > > > You can find the KEYS file here: > > * https://downloads.apache.org/polaris/KEYS > > > > Convenience binary artifacts are staged on Nexus. The Maven repositories > > URLs are: > > * > > > https://repository.apache.org/content/repositories/orgapachepolaris-1057/ > > > > Please download, verify, and test. > > > > Please vote in the next 72 hours. > > > > [ ] +1 Release this as Apache Polaris Iceberg catalog migrator 1.0.0 > > [ ] +0 > > [ ] -1 Do not release this because... > > > > Only PMC members have binding votes, but other community > > members are encouraged to cast non-binding votes. This vote will pass if > > there are > > 3 binding +1 votes and more binding +1 votes than -1 votes. > > > > - Ajantha > > >
