-1 (binding) I verified the advertised SHA-512 checksums and detached signatures against the Apache Seata KEYS file. The source ZIP is byte-for-byte reproducible from tag v2.7.0 at 54b1b017cd4fff55ebbbdb49020d2ae58f9ca706, and both the advertised build and a relevant local test path pass.
I cannot approve this candidate because its release LICENSE changes the Apache License 2.0 definition of "control" from "(i)" to "(properties)". In addition, the bundled Bootstrap v3.0.3 derivative removes the upstream Copyright 2013 Twitter, Inc. and Apache-2.0 header and replaces it with an ASF header, and the binary tar package root has no LICENSE or NOTICE. Maven staging also publishes a BOM that refers to the absent seata-threadpool-loom:2.7.0 coordinate and omits the JDK-gated json-common-jackson3 module. Please correct the legal files and their placement, restore the third-party attribution, fix the Maven publication matrix, rebuild and re-sign the artifacts, and restart the vote. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
