> > I couldn't download the binary archives from ATR (the connection drops > after > 60-70 MB), so I used final-package-3.2.0.tar.gz from Nexus. It is signed > by Rui, > but its size differs from the ATR file (322,839,359 vs 322,839,846 bytes). > Are these different builds?
Hi Richard, thanks for catching that. They are built at different times during the release process. I've asked AI to dig through it and it's a bit of a Maven dependency hell. Here's what it has found: Comparing apache-storm-3.2.0.tar.gz from both, member by member, the only differences are: 1. Build timestamps. The UI pages (and their copies in storm-webapp-3.2.0.jar) link their assets with a build time (18:32:34Z vs 20:05:17Z). The version-info files in storm-client and storm-core differ only in the branch= line (the commit hash vs "v3.2.0"). Nothing else in those files differs. 2. jspecify-1.0.1.jar, a library of four nullness annotations, is in lib/ in the Nexus tarball and in lib-common/ in the ATR tarball. Why jspecify moved: dedup-libs.py puts a jar in lib-common when it is on the worker classpath, and leaves it in lib when only the daemons need it. The worker classpath comes from storm-shaded-deps, whose shade plugin publishes a dependency-reduced pom. In that pom jspecify lost its optional flag (it is also reachable through JUnit, and Maven keeps a dependency optional only if every path to it is optional). A build that takes storm-shaded-deps from the local repository reads that pom and puts jspecify on the worker classpath. release:perform builds all modules in one run, where Maven uses the in-memory model from the source pom, so the reduced pom is never read and jspecify stays daemon-only. I confirmed this in Maven 3.9.16's code and reproduced both outcomes from the tag. Effect: none at runtime. Annotations are not enforced by the JVM, and nothing in Storm's worker code uses jspecify. I ran the ATR files (full and lite) through a smoke test with 5 supervisors (WordCount, Lambda, MultiThreadWordCount, the Kafka example) and all passed with 0 failed tuples. I ran the same test again with jspecify moved off the worker classpath (the Nexus layout), with the same result and no class-loading errors. A fix for future releases, so both kinds of build give the same layout, is in https://github.com/apache/storm/pull/9267. It does not affect this vote. On Sun, 8 Nov 2026 at 19:25, Richard Zowalla <[email protected]> wrote: > +1 > > - Verified signatures and SHA-512 of the source tar.gz and zip, both match > KEYS > - Source matches tag v3.2.0 (98ce7060); zip and tar.gz have identical > contents > - Built from source (mvn clean package -DskipTests) on Java 25 > - Built and ran the Apache StormCrawler test suite (main, 4.0.0-SNAPSHOT) > against > 3.2.0 from the staging repo > - Ran a 10 min StormCrawler WARC crawl (1000 seed hosts) on a small Docker > cluster > (nimbus, supervisor, UI) with the binary from the staging repo: no > errors in > nimbus, supervisor or worker logs, WARC files valid; storm list, > deactivate, > activate, rebalance and kill work > > I couldn't download the binary archives from ATR (the connection drops > after > 60-70 MB), so I used final-package-3.2.0.tar.gz from Nexus. It is signed > by Rui, > but its size differs from the ATR file (322,839,359 vs 322,839,846 bytes). > Are these different builds? > > Minor, not blocking: > - Every storm jar now logs about 10 "pacemaker.* is a deprecated config" > warnings, > because conf/defaults.yaml still sets the keys deprecated in this > release. > - The source release contains dependency-reduced-pom.xml files and an empty > storm-server/csvmetrics/ directory (also in 3.1.0). > > > Am 08.11.2026 um 00:33 schrieb rabreu.apache.org via dev < > [email protected]>: > > > > Hello Storm, > > > > I'd like to call a vote on releasing the following artifacts as > > Apache Storm 3.2.0. This vote is being conducted using a > > Beta version of the Apache Trusted Releases (ATR) platform. > > Please report any bugs or issues to the ASF Tooling team. > > > > The page of the release candidate from ATR revision 00002, > > which includes downloads and the release notes, can be found at: > > > > https://releases.apache.org/vote/storm/3.2.0 > > > > The file manifest for ATR revision 00002, including file digests, > > can be found at: > > > > https://releases.apache.org/manifest/storm/3.2.0/00002 > > > > The release artifacts are signed with one or more OpenPGP keys from: > > > > https://downloads.apache.org/storm/KEYS > > > > The release was made from the Apache Storm 3.2.0 tag, commit > > 98ce70603d9f7fa28725c5cf41af92ebea9a38b1: > > > > https://github.com/apache/storm/tree/v3.2.0 > > > > The Nexus staging repository is here: > > > > https://repository.apache.org/content/repositories/orgapachestorm-1131 > > > > To use it in a maven build, set the version for Storm to 3.2.0 and add > > that URL to your settings.xml file. > > > > The binary release comes in two flavours: the full distribution and the > lite > > distribution (apache-storm-3.2.0-lite.*), which omits the storm-autocreds > > and storm-kafka-monitor jars. Please verify both, and the source release. > > > > "How to vote" is described here: > > > https://github.com/apache/storm/blob/master/RELEASING.md#how-to-vote-on-a-release-candidate > > When voting, please list the actions taken to verify the release. > > > > Please review the release candidate and vote accordingly. > > > > [ ] +1 Release this package > > [ ] +0 Abstain > > [ ] -1 Do not release this package (please provide specific comments) > > > > You can vote on ATR at the URL above, or manually by replying to this > email. > > > > The vote is open for 72 hours. Only votes from the Storm PMC are > > binding, but everyone is welcome to vote. The vote passes with at least > three > > binding +1 votes. > > > > Thanks, > > Rui Abreu (rabreu) > > > > This email was sent by [email protected] on the Apache Trusted Releases > platform > >
