And by the way there’s reason why projects use the root folder: when you shade you can keep the the original license/notice.
So I don’t understand why you are worried about that now (maybe AI helped to verify the artifacts but AI tools are not always right ;)): 1. I did this since 1.0.0 and it has been validated during incubation period. 2. This is correct and valid (used in several projects). Regards JB Le jeu. 30 juil. 2026 à 19:48, Yufei Gu <[email protected]> a écrit : > I validated Apache Polaris 1.7.0 rc1 on Darwin arm64 with Java 21.0.9. > > All provenance, cryptographic, build, test, and runtime checks passed: > > - Tag apache-polaris-1.7.0-rc1 resolves > to: 4ac2f059d1cce149453d0a5f1ff1dff980ec97cc > - The signed source matches that commit across 2,466 files, eight symlinks, > and 54 executable modes. > - All distribution, Helm, Python, and 429 primary Maven JAR/POM/module > signatures and SHA-512 checksums are valid. > - Signing fingerprint: F2EEEB06110BEE1397EC74CBB8960FF52D9B1312 > - The repository release verifier passed. > - ./gradlew check -PnoIntegrationTests passed with 25,548 tests, 70 > skipped, and zero failures or errors. > - All 164 Python client tests passed. > - The ASF-dist and TestPyPI wheels rebuilt byte-for-byte from the signed > source. > - The binary server started as Polaris 1.7.0, reported health UP, and > returned HTTP 401 for an unauthenticated catalog request. > > Inspection of all 269 staged Maven JARs, Rc1 fixes all 32 test-fixture > classifier omissions and all nine non-bundle Spark omissions from rc0. > However, three still lack META-INF/LICENSE and META-INF/NOTICE: > > - polaris-spark-3.5_2.12-1.7.0-bundle.jar > - polaris-spark-3.5_2.13-1.7.0-bundle.jar > - polaris-spark-4.0_2.13-1.7.0-bundle.jar > > Each contains LICENSE and NOTICE only at the archive root. Their contents > exactly match the corresponding BUNDLE-LICENSE and BUNDLE-NOTICE files in > the signed source, so the remaining problem is their location. > > ASF release policy requires licensing materials in the distribution > format’s customary location, and its release FAQ specifically states that > distributed JARs must place LICENSE and NOTICE under META-INF: > > https://www.apache.org/legal/release-policy.html#licensing-documentation > > The way we place LICENSE and NOTICE has been like that since the very > beginning (release 1.0.0). Maybe we should fix them per ASF policy. WDYT? > > Thanks, > Yufei > > > On Thu, Jul 30, 2026 at 8:10 AM Alexandre Dutra <[email protected]> wrote: > > > +1 > > > > - Automated checks (verify-release.sh) OK > > - Git tag, checksums and GPG signatures OK > > - NOTICE and LICENSE files OK > > - Smoke test binary distribution OK > > - Smoke test source distribution OK > > - Smoke test Helm chart OK > > > > Thanks, > > Alex > > > > On Thu, Jul 30, 2026 at 7:12 AM Jean-Baptiste Onofré <[email protected]> > > wrote: > > > > > > Hi everyone, > > > > > > I propose that we release the following RC as the official Apache > > > Polaris 1.7.0 release. > > > > > > This corresponds to the tag: apache-polaris-1.7.0-rc1 > > > > > > * > https://github.com/apache/polaris/commits/apache-polaris-1.7.0-rc1 > > > * > > > https://github.com/apache/polaris/tree/4ac2f059d1cce149453d0a5f1ff1dff980ec97cc > > > > > > The release tarball, signature, and checksums are here: > > > > > > * https://dist.apache.org/repos/dist/dev/polaris/1.7.0 > > > > > > Helm charts are available on: > > > > > > * https://dist.apache.org/repos/dist/dev/polaris/helm-chart/1.7.0 > > > > > > NB: you have to build the Docker images locally in order to test Helm > > charts. > > > > > > The Python CLI wheel is available on: > > > > > > * > https://dist.apache.org/repos/dist/dev/polaris/python-client/1.7.0 > > > > > > The Python CLI is also available on Test PyPI: > > > > > > * https://test.pypi.org/project/apache-polaris/1.7.0rc1/ > > > > > > You can find the KEYS file here: > > > > > > * https://downloads.apache.org/polaris/KEYS > > > > > > Convenience binary artifacts are staged on Nexus. The Maven repository > > URL is: > > > > > > * > > > https://repository.apache.org/content/repositories/orgapachepolaris-1071/ > > > > > > Please download, verify, and test according to the release > > > verification guide, which can be found at: > > > > > > * > > > https://polaris.apache.org/community/release-guides/release-verification-guide/ > > > > > > Please vote in the next 72 hours. > > > > > > [ ] +1 Release this as Apache Polaris 1.7.0 > > > [ ] +0 > > > [ ] -1 Do not release this because... > > > > > > Only PMC members have binding votes, but other community members are > > > encouraged to cast non-binding votes. > > > This vote will pass if there are 3 binding +1 votes and more binding > > > +1 votes than -1 votes. > > > > > > Regards > > > JB > > >
