+1 (binding) Verification followed the canonical checklist from RELEASING.md, then focused on the *authentication/authorization* hardening that makes up most of this release (#8973–#9005, #9069, STORM-3871), exercised on a secured multi-container cluster (dev-tools/cluster). ------------------------------ Canonical checklist1. Verify *.asc / *.sha512 files
- Downloaded all 7 artifacts from dist.apache.org/repos/dist/dev/storm/apache-storm-3.1.0-rc1/ (src, binary and lite, tar.gz and zip each, plus RELEASE_NOTES.html). - Imported the official KEYS file; all 7 GPG signatures verify as *Good signature from "Rui Abreu (Code Signing Key) [email protected] <[email protected]>"*, fingerprint 72B4 3655 8AA9 CDCA 2C4C BAC3 40D4 B35E 2C14 52E5, listed in KEYS. - All 7 SHA512 checksums verified OK with sha512sum -c. 2. Build source, run unit tests, create a distribution *PASSED*3. Set up a standalone cluster Distributed dev cluster (Docker Compose, dev-tools/cluster + a new docker-compose.secure.yml overlay): dev ZooKeeper + Nimbus + *two* supervisors + UI + logviewer + Prometheus/Grafana, image built from the RC binary tarball *PASSED* 4. Launch WordCountTopology, check logs / metrics *PASSED*5. Basic UI functionality UI REST API exercised for cluster summary, cluster configuration, supervisor summary, topology summary, topology page, worker placement, visualization, log config, history, activate/deactivate/kill actions (see the authorization matrix below). Static pages served. 6. Basic CLI storm jar (with and without --artifacts), storm list, storm kill, storm activate / deactivate, storm rebalance (-e, -t overrides), storm upload-credentials, storm blobstore list, storm version — all working on the secured cluster. ------------------------------ Ad-hoc: authentication / authorization on the secured clusterUI ( AuthorizedUserFilter + SimpleACLAuthorizer) HTTP status per principal Request Anonymous Eve (unknown) Bob (nimbus.users) Dave (readonly) Carol (topology.users) Alice (owner) Admin *GET* /cluster/summary, /topology/summary, /supervisor/summary 403 403 200 200 200 200 200 *GET* /cluster/configuration 403 403 200 200 200 200 200 *GET* /topology/{id}, /topology-workers/{id}, /visualization 403 403 *403* 200 200 200 200 *GET* /topology/{id}/logconfig – – – 200 – – – *POST* /topology/{id}/deactivate / activate – – 403 *403* 200 – – *POST* /topology/{id}/kill/0 – – 403 – – – – *GET* /history/summary [] – [] – – Own topology only – - *#9005* unauthenticated requests are evaluated (and denied), not passed through. - *#9004* every StormApiResource endpoint carries @AuthNimbusOp or @UnauthenticatedNimbusOp (only /history/summary, which Nimbus filters itself). - *#9003* history is filtered by the caller (alice sees her topology, bob sees []). - *#8977* ui.enable.jsonp: false (default): ?callback=cb is ignored, plain JSON returned. - *#9069* drpc.https.keystore.password is ***** both in /cluster/configuration and in the "Starting Nimbus with conf" log line. - Impersonation: doAsUser=admin from anonymous and from alice is *denied* Nimbus Thrift (storm CLI with per-user principals) Action Result storm jar / storm list as eve (not present in nimbus.users) Denied with AuthorizationException: getLeader is not authorized. storm jar as alice Submission succeeds. Nimbus adds the submitter to topology.users, resulting in [carol, alice]. storm kill / rebalance / deactivate as bob or dave Denied with AuthorizationException on killTopology, rebalance, and deactivate. storm upload-credentials as bob (*#9001*) Denied with getTopologyConf ... is not authorized. The same operation as alice succeeds and credentials are pushed. storm rebalance -t '{"topology.blobstore.map": {"some-other-users-blob": ...}}' as carol (*#8999*) Rejected with InvalidTopologyException(Key not found: some-other-users-blob). storm rebalance -t referencing a blob the caller can read, with -e splitter=3, as carol Accepted successfully. storm blobstore list as bob with ACL validation enabled (*#9000*) Shows only the world-readable dependency blob [o::r--, u:alice:rwa]; none of alice's topology blobs are visible. alice and admin can see all four blobs. storm blobstore list as supervisor Denied with getLeader is not authorized, confirming that the supervisor principal is restricted to supervisor commands. --artifacts submission (*#8982*) The dependency blob receives a unique key, dep-org.apache.commons-commons-text-jar-1.10.0-<uuid>.jar, and is localized by the supervisors with ACL validation enabled. Topology killed (*STORM-3871, #9011 / #9082*) Dependency blobs are removed (Removing dependency blobs of ... [dep-...]), and the blob store is empty afterwards. See F5 for a spurious warning observed during cleanup. Overall, the authorization checks and blob ACL behavior are working as expected across the tested scenarios. Logviewer (#8973, #8974) — logs.users: [admin] Request Anonymous bob dave (readonly) carol alice (owner) admin /daemonlog, /daemondownload?file=supervisor.log 403 – – 403 403 200 /log, /download?file=<topo>/6700/worker.log 403 403 403 200 200 – /search?file=<topo>/6700/worker.log – 403 – – 200 – /listLogs?topoId=<topo> and /listLogs [] [] – – Full list Full list /deepSearch/<topo> – [] – – Matches – Cheers, Gianluca Il giorno sab 12 set 2026 alle ore 18:55 Rui Abreu <[email protected]> ha scritto: > +1 (binding) > > I verified the release candidate on a local Docker-based cluster > (ZooKeeper, > Kafka, Nimbus, Supervisor(s) and UI) running the RC distributions unpacked > from > the staged tarballs. Actions taken: > > # Signatures and checksums > - Verified GPG signatures and SHA-512 checksums for all artifacts in the RC > directory: -src, lite and full, both .tar.gz and .zip, plus > RELEASE_NOTES.html. > All showed a good signature from my code-signing key and matching > checksums. > > # Distributions > - Built and started a cluster from both the lite > (apache-storm-3.1.0-lite.tar.gz) > and full (apache-storm-3.1.0.tar.gz) binary distributions. The UI > reported > version 3.1.0, with a revision matching the v3.1.0 tag. > > # Topologies from storm-examples > - Ran example topologies built from storm-examples (storm-starter and > storm-kafka-client-examples): WordCountTopology, > MultiThreadWordCountTopology, > LambdaTopology, and KafkaSpoutTopologyMainNamedTopics (Kafka producers > plus a > Kafka spout consumer). > - All reached ACTIVE and processed data, emitting and acking with no > failed tuples. > > # Multi-node and inter-worker communication > - Ran with multiple single-slot supervisors so multi-worker topologies were > forced onto separate containers. > - Confirmed workers spread across distinct hosts (for example, WordCount > across > three nodes) and that changing the worker count at runtime with "storm > rebalance" works. > > # Lite optional jars > - On the lite distribution, used bin/storm-kafka-monitor-fetch to fetch > storm-kafka-monitor from the staging repository, restarted the UI, and > confirmed Kafka spout lag is reported. > > # Not tested > - Secure/Kerberos features (storm-autocreds). >
