Hi Hervé Boutemy, Thank you very much for the thorough verification and for testing the Reproducible Builds!
I acknowledge the issues you pointed out, specifically regarding the empty directories and the node_modules included in the artifacts. You are absolutely right—this happened because I ran the release process in my local working directory without a fresh clone. Since this is our first release and we are eager to get it out to the community, if these issues are not considered blocking (given the +0 vote), I would prefer to proceed with the current RC. However, to ensure a clean and reproducible build for all future releases, I will strictly follow your advice to run the release process from a fresh Git clone (and update the mvnw version). I have submitted a PR [1] to update our release documentation. Furthermore, for the next release, we will implement a release script to programmatically enforce the "fresh clone" step, ensuring that future Release Managers cannot accidentally release from a dirty environment. Thanks again for the valuable lesson on build hygiene. [1] https://github.com/apache/fesod/pull/815 Best, Shuxin Pan On Mon, Jan 19, 2026 at 10:23 AM Hervé Boutemy <[email protected]> wrote: > > +0 > > I did a local rebuild and compared with staging binaires > = mvn clean package -Papache-release -DskipTests -Dmaven.javadoc.skip > artifact:compare -Dcompare.fail=false > -Dreference.repo=https://repository.apache.org/content/repositories/staging/ > with Maven 3.9.12 + JDK 17 on *nix, I was able to get 14 files as expected, > but I found 3 small issues: > > 1. in fesod-sheet-2.0.0-incubating-sources.jar, there are 4 empty directories > that I don't get when rebuilding > │ -drwxr-xr-x 2.0 unx 0 b- stor 23-Nov-08 22:14 > org/apache/fesod/sheet/support/asm/ > │ -drwxr-xr-x 2.0 unx 0 b- stor 23-Nov-08 22:14 > org/apache/fesod/sheet/support/cglib/ > │ -drwxr-xr-x 2.0 unx 0 b- stor 23-Nov-08 22:14 > org/apache/fesod/sheet/support/cglib/beans/ > │ -drwxr-xr-x 2.0 unx 0 b- stor 23-Nov-08 22:14 > org/apache/fesod/sheet/support/cglib/core/ > │ -drwxr-xr-x 2.0 unx 0 b- stor 23-Nov-08 22:14 > org/apache/fesod/sheet/support/cglib/proxy/ > > 2. in fesod-parent-2.0.0-incubating-source-release.zip, there is a huge > fesod-parent-2.0.0-incubating/website/node_modules/ content and few files > from release manager that I don't get in my rebuild > > 3. using ./mvnw runs Maven 3.6.3 that gets additional differences: mvnw > configuration should be updated to match reality of what is used during > release > > I think the only fix to do is the have release manager run the release from a > fresh Git clone, to avoid pollution from his usual working directory > And you'll be fine with full Reproducible Builds :) (I did not name it > before, but this is it) > > Best regards > > Hervé > > On 2026/01/18 14:26:03 Shuxin Pan wrote: > > Hello everyone, > > > > This is a call for vote to release Apache Fesod(incubating) > > 2.0.0-incubating-RC3 > > > > The Apache Fesod community has voted and approved the release of > > Apache Fesod(incubating) 2.0.0-incubating-RC3. We now kindly request > > the IPMC members review and vote for this release. > > > > Project description: Apache Fesod (Incubating) is a high-performance, > > easy-to-use Java library for processing spreadsheet files. > > > > Vote Status: > > The PPMC vote passed with 4 +1 binding votes and 2 +1 non-binding votes. > > > > The vote thread: > > https://lists.apache.org/thread/h7jm9302hwv7tg6bqhl99d1do8ftyd6h > > > > The vote Result: > > https://lists.apache.org/thread/btgoydhk98ybzr82dr383685o3wkzylm > > > > The release candidates: > > https://dist.apache.org/repos/dist/dev/incubator/fesod/2.0.0-incubating-RC3 > > > > The staging repo: > > https://repository.apache.org/content/repositories/orgapachefesod-1021/ > > > > Git tag for the release: > > https://github.com/apache/fesod/releases/tag/2.0.0-incubating-RC3 > > > > Hash for the release tag: > > 7dfdb8ed01ef9bdc7907770fe39210761bb54d55 > > > > Release Notes: > > https://github.com/apache/fesod/releases/tag/2.0.0-incubating-RC3 > > > > > > The artifacts have been signed with Key [ 72D5936C ], corresponding to > > [ [email protected] ] > > which can be found in the keys file: > > https://downloads.apache.org/incubator/fesod/KEYS > > > > Build Environment: JDK 8+, Apache Maven 3.6.0+. > > ./mvnw clean package -DskipTests > > > > > > The vote will be open for at least 72 hours. > > > > Please vote accordingly: > > > > [ ] +1 approve > > [ ] +0 no opinion > > [ ] -1 disapprove with the reason > > > > Checklist for reference: > > > > [ ] Download links are valid. > > [ ] Checksums and signatures. > > [ ] LICENSE/NOTICE files exist > > [ ] No unexpected binary files > > [ ] All source files have ASF headers > > [ ] Can compile from source > > > > To learn more about Apache Fesod(Incubating) , please see > > https://fesod.apache.org/ > > > > Best, > > Shuxin Pan > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: [email protected] > > For additional commands, e-mail: [email protected] > > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
