Hi Yufei That's a good catch, even if it's not new, it was an issue way before version 1.5.0 release (I mentioned that a while ago, including during incubation, with "to be fixed").
Since the fix is probably pretty simple (just a Gradle configuration, I guess, I will work on it), I propose canceling rc0 to prepare rc1 with the fix. Thanks! Regards JB On Wed, Jul 29, 2026 at 12:54 AM Yufei Gu <[email protected]> wrote: > > -1 (binding) > > I found a release-blocking licensing-documentation issue in the staged > Maven repository. > > I inspected all 269 staged JARs. 44 do not contain both META-INF/LICENSE > and META-INF/NOTICE: > > * 32 test-fixtures-{sources,javadoc}.jar artifacts across 16 modules: > polaris-admin, polaris-async-api, polaris-async-vertx, polaris-core, > polaris-nodes-impl, polaris-persistence-nosql-api, > polaris-persistence-nosql-cdi-weld, > polaris-persistence-nosql-correctness, > polaris-persistence-nosql-impl, > polaris-persistence-nosql-inmemory, > polaris-persistence-nosql-maintenance-impl, > polaris-persistence-nosql-metastore, > polaris-persistence-nosql-metastore-maintenance, > polaris-persistence-nosql-mongodb, > polaris-persistence-nosql-realms-spi, and polaris-runtime-service. > > > * 12 Spark artifacts: the main, sources, Javadoc, and bundle JARs for > polaris-spark-3.5_2.12, polaris-spark-3.5_2.13, and > polaris-spark-4.0_2.13. The three bundle JARs place LICENSE and > NOTICE at the archive root; the other nine lack the ASF pair. > > This is not newly introduced in 1.7.0 rc0: the released 1.6.0 Maven > artifacts have the identical 44-artifact pattern. However, 1.5.0 and > 1.4.1 included the required META-INF files in all 32 test-fixture > source/Javadoc classifiers, showing that portion is a regression. > > ASF release policy requires each package to provide LICENSE and NOTICE > in the customary location, and specifically requires JARs to place > them in META-INF: > https://www.apache.org/legal/release-policy.html#licensing-documentation > > The project's automatic verifier succeeds, but its JAR-content check > only matches conventional main and -sources JARs and explicitly > excludes all polaris-spark artifacts, so it does not detect these > omissions. > > Other validation completed successfully: > > * apache-polaris-1.7.0-rc0 resolves to > d1c9aff170772fb60295ea362024a7e605a29fbd. > * The signed source archive exactly matches the tag's 2,474 Git > files/symlinks and contains no unexpected compiled binaries. > * All announced signatures and checksums validate against the > published KEYS. Signing fingerprint: > F2EEEB06110BEE1397EC74CBB8960FF52D9B1312. > * The standard release verifier completed successfully. > * ./gradlew check -PnoIntegrationTests passed from a fresh source > extraction after rerunning one flaky OPA test. > * 164 Python client tests passed, and the staged wheel was reproduced > byte-for-byte. > * The staged admin CLI and server started successfully; server health > was UP. > > A separate non-blocking concern is that client/python/pyproject.toml > still declares version 1.6.0 in the signed 1.7.0 source. The release > target stamps 1.7.0 and reproduced the staged wheel, but this should > also be corrected in the next RC. > > Yufei > > > On Tue, Jul 28, 2026 at 1:32 PM Jean-Baptiste Onofré <[email protected]> > wrote: > > > Hi everyone, > > > > I propose that we release the following RC as the official Apache > > Polaris 1.7.0 release. > > > > This corresponds to the tag: apache-polaris-1.7.0-rc0 > > > > * https://github.com/apache/polaris/commits/apache-polaris-1.7.0-rc0 > > * > > https://github.com/apache/polaris/tree/d1c9aff170772fb60295ea362024a7e605a29fbd > > > > The release tarball, signature, and checksums are here: > > > > * https://dist.apache.org/repos/dist/dev/polaris/1.7.0 > > > > Helm charts are available on: > > > > * https://dist.apache.org/repos/dist/dev/polaris/helm-chart/1.7.0 > > > > NB: you have to build the Docker images locally in order to test Helm > > charts. > > > > The Python CLI wheel is available on: > > > > * https://dist.apache.org/repos/dist/dev/polaris/python-client/1.7.0 > > > > The Python CLI is also available on Test PyPI: > > > > * https://test.pypi.org/project/apache-polaris/1.7.0rc0/ > > > > You can find the KEYS file here: > > > > * https://downloads.apache.org/polaris/KEYS > > > > Convenience binary artifacts are staged on Nexus. The Maven repository URL > > is: > > > > * > > https://repository.apache.org/content/repositories/orgapachepolaris-1070/ > > > > Please download, verify, and test according to the release > > verification guide, which can be found at: > > > > * > > https://polaris.apache.org/community/release-guides/release-verification-guide/ > > > > Please vote in the next 72 hours. > > > > [ ] +1 Release this as Apache Polaris 1.7.0 > > [ ] +0 > > [ ] -1 Do not release this because... > > > > Only PMC members have binding votes, but other community members are > > encouraged to cast non-binding votes. > > This vote will pass if there are 3 binding +1 votes and more binding > > +1 votes than -1 votes. > > > > Regards > > JB > >
