+1 (binding) — late, but the vote thread was still open and the
verification adds coverage in the area earlier voters explicitly
flagged ("did no compile from source").
Source distribution:
- "incubating" present in artifact filenames and DISCLAIMER text
- DISCLAIMER, LICENSE (Apache 2.0), NOTICE all present and correct
("Apache Burr (Incubating)", copyright 2025-2026)
- ASF header on 100% of Python source files (68/68 in burr/, 36/36
in tests/)
- No unexpected binaries (no shared libs, no JVM artifacts, no
compiled Python); only documentation and example image assets
- KEYS imports cleanly; signing fingerprint
BB8B72B34AB9A664A109AA17A76CF4C80E4E5355 matches the VOTE message
- GPG signatures verify on all three artifacts (src tarball, sdist,
wheel) — Good signature from the announced key
- SHA-512 digests match for all three artifacts
Build from source (the part nobody else exercised):
- Building a wheel from the extracted sdist with the standard
python-build frontend succeeds
- The released wheel installs into a fresh venv with the [learn] extra
- The burr CLI launches; running it with --no-open --dev-mode starts
the uvicorn server cleanly to "Application startup complete"
- A tiny synthetic ApplicationBuilder pipeline (increment to report,
conditional transitions, asserted final state) runs end-to-end
Two non-blocker observations for the next RC, not -1 material:
1. The .sha512 files contain only the bare hex digest, not the
digest-then-two-spaces-then-filename layout that the standard
sha512sum tool expects. Voters following the recipe in the
verification README hit a "no properly formatted checksum lines
found" error and have to compare manually. PR with the one-line
fix and a matching README simplification:
https://github.com/apache/burr/pull/769
2. The released wheel and a wheel built from the sdist diverge: the
released wheel bundles the pre-built React UI under
burr/tracking/server/build/static/ (about 1.7 MB of JS plus a
16.5 MB source map) and the burr/examples/ directory, neither of
which is in the sdist. The UI sources ARE shipped in the src
tarball (telemetry/ui/), and the README does document the
`python scripts/apache_release.py wheel` recipe (which builds the
UI internally) plus a "from scratch" path with explicit npm steps
— so the wheel is reproducible-with-extra-steps, but a voter who
skips the README and runs `pip wheel` directly will produce a
different wheel. Worth a louder up-front note in the verification
workflow. (Related to the existing follow-up at apache/burr#756.)
Thanks for driving this, Elijah — and for the clean PPMC review
notes on the vote message.
Jarek
---
Verification performed with the assistance of Claude Code (Opus 4.7);
text reviewed before posting.
On Tue, May 05, 2026 05:01 AM, [email protected] wrote:
> Hi all,
>
> This is a call for a vote on releasing Apache Burr 0.42.0-incubating
> release candidate 3.
>
> The Apache Burr (incubating) PPMC voted to release this RC.
>
> PPMC vote thread:
> https://lists.apache.org/thread/t1ktvfyzq885qsylr9w97nwpttlf2w4v
>
> PPMC result: passed with 4 binding +1 (Stefan Krawczyk, Jarek Potiuk,
> Jernej Frank, Elijah ben Izzy) and 1 non-binding +1 (André Ahlert).
> No -1s. Jarek Potiuk cast a binding +1 on the PPMC thread as an IPMC
> member.
>
> Notable changes since 0.41.0:
> - Bedrock integration: BedrockAction and BedrockStreamingAction (#677)
> - Remove phone-home telemetry per ASF policy
> - Add override_state_values support to initialize_from
> - Add comparison and identity operators to when() conditions
> - Add AST-based linter for undeclared state reads in function actions
> (#656)
> - Add flexible_api decorator to fix mypy override errors (#683)
> - Support async with on async persister factory methods (#681)
> - Graceful stream shutdown on exceptions in streaming actions (#680)
> - Enable Burr UI to be added to existing FastAPI app (#671)
> - Add toggle to show/hide input nodes in graph view
> - Implement counter app demo in Burr UI (#675)
> - Add Next.js landing page for burr.apache.org (#679)
> - Add ecosystem page (#661)
> - Cloud native AWS deployment support (#666)
> - Fix pydantic warnings and minimum pins to pydantic >=2.0 (#668)
> - Release-validation CI: builds artifacts, runs Apache RAT, and
> end-to-end smoke tests the wheel from a fresh venv on every PR
> - Licensing cleanup: correct MIT attribution for third-party files,
> proper basename-based RAT excludes
>
> The artifacts for this release candidate can be found at:
> https://dist.apache.org/repos/dist/dev/incubator/burr/0.42.0-incubating-RC3
>
> The Git tag to be voted upon is: v0.42.0-incubating-RC3
> RC tag commit (version bump): 7c64f50619a47332badbe152d2ca1992fd422026
> Functional release commit (parent of the version bump):
> b707b1d8 -- this is what voters can diff against main to see the
> release contents.
>
> Signing key fingerprint:
> BB8B72B34AB9A664A109AA17A76CF4C80E4E5355
>
> KEYS file:
> https://downloads.apache.org/incubator/burr/KEYS
>
> The artifacts include:
> - Full source archive (git archive)
> - Wheel (binary distribution with UI and bundled examples)
> - Sdist (source for building wheel)
>
> Verification instructions:
> https://github.com/apache/burr/blob/main/scripts/README.md
>
> Quick test:
> svn export
> https://dist.apache.org/repos/dist/dev/incubator/burr/0.42.0-incubating-RC3/
> burr-rc3
> <https://dist.apache.org/repos/dist/dev/incubator/burr/0.42.0-incubating-RC3/burr-rc3>
> cd burr-rc3
> pip install "apache_burr-0.42.0-py3-none-any.whl[learn]"
> burr
>
> Non-blocking observations from PPMC review (filed as follow-ups,
> not blockers for this release):
> - sdist PKG-INFO License-File metadata doesn't enumerate the bundled
> Magic UI / shadcn MIT components (they ARE present in LICENSE-wheel).
> Tracked: https://github.com/apache/burr/issues/755
> - The bundled UI build (~1.7 MB) inside the wheel includes third-party
> JS deps; per-dep enumeration is in the webpack-generated
> main.<hash>.js.LICENSE.txt rather than the wheel's LICENSE.
> Tracked: https://github.com/apache/burr/issues/756
> - (Resolved during PPMC review) A stray v0.42.0 git tag from February
> pointed at a long-dead release-prep commit. Already deleted from
> the repo so the final release tag can be cleanly cut.
>
> The vote will run for a minimum of 72 hours.
>
> [ ] +1 Release this package as Apache Burr 0.42.0-incubating
> [ ] +0 No opinion
> [ ] -1 Do not release this package because...
>
> Thanks,
> Elijah
> on behalf of the Apache Burr (incubating) PPMC
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>
>
