Hi Justin, > • No KEYS link pointing to https://downloads.apache.org/ was found. > • No visible download verification instructions on the page.
We added a section with the required information to the downloads page; see https://fluss.apache.org/downloads/#verifying-downloads -- Best, MKO On 2026/05/25 08:27:16 Justin Mclean wrote: > Hi, > > The project looks in good shape as a graduation candidate, but I think we > have some issues here. Fuss was recently mentioned in [1], and it appears the > mentors/PPMC took no action, which is itself a concern. > > So your download page: > • No closer.lua / [preferred] links for release artifacts. The page is > serving downloads but not routing through the ASF mirror network - this MUST > be done. Is there a reason the project is not following policy here? > • Some checksum and signature links do not use > https://downloads.apache.org/. > • No KEYS link pointing to https://downloads.apache.org/ was found. > • No visible download verification instructions on the page. > > Docker Hub - The Docker Hub description does not include a visible incubation > disclaimer text. > > Docker Hub: fluss/fluss -- needs attention - misuse of ASF trademarks. > > Maven Central - The POM descriptions don't include incubation disclaimer text. > > There are also some serious 3rd party branding concerns: > > Ververica (the commercial company behind Apache Flink, part of Alibaba) is > the biggest source of potential branding issues. The blog posts and > announcements generally use "Apache Fluss™ (incubating)" correctly, with a TM > symbol, which is good. > > The Ververica documentation page [1] is titled simply "Fluss" with no > "Apache" prefix throughout, which doesn't meet the ASF requirement to use > "Apache Fluss" on first and prominent references. It also misses a trademark > statement. The blog tag page uses "Fluss" as a category tag alongside "Apache > Flink”, so it's inconsistently treated: Flink gets the "Apache” prefix, but > "Fluss" doesn't. > > The Alibaba Cloud community blog has posts mixing pre-donation "Fluss" > references with post-donation "Apache Fluss (Incubating)” references. This > could create confusion about the brand's ownership. Some post-incubator > articles are also incorrect, e.g. https://www.alibabacloud.com/blog/602412 > > Alibaba Cloud has just released a managed service for Apache Fluss. I am > curious to know whether that follows the ASF's trademark and branding > policies. > > I also have a concern about vendor neutrality. The project originated > entirely within Alibaba Cloud, and Ververica is an Alibaba subsidiary, so > they're one corporate family. Of the 14 proposed PMC members, I can see that > several are Alibaba Cloud or Ververica employees. Can you provide an explicit > company breakdown of all 14 PMC members, excluding mentors, counting Alibaba > and Ververica as a single entity? While the figures of 8+ companies and 44 > unique committers are encouraging, I think it would be helpful to have a bit > more detail here. > > Kind Regards, > Justin > > 1. https://lists.apache.org/thread/xnb4lhjk82y3c0zd0f622ljgjrpdlydf > 2. https://docs.ververica.com/introduction/about-ecosystem/fluss/ > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
