Xuanwo, thank you for the detailed review and for the binding -1 vote. You
are exactly right, and the problem is confirmed.
Root cause
----------
The `fesod-parent-2.1.0-incubating-source-release.zip` in the Maven staging
repository `orgapachefesod-1037` was assembled from the release manager's
working directory rather than from a clean checkout of the Git tag. Because
of this it accidentally bundled several artifacts that only exist under that
working tree and are not part of the source:
- release-manager / RC working directories
(`dist/dist-rc2/`, `dist/remote-check/`, `dist/rc2-eval/`,
`svn-rc2-wc/`);
- staging deployment logs;
- an embedded copy of the voted source tarball together with its `.asc`
and `.sha512` and a KEYS file (repeated three times).
At the same time, the source-release assembly descriptor excluded some files
that are part of the tag (e.g. `.github/*`, `.asf.yaml`, `.idea/*`, ...).
Combined, this produced exactly the "864 extra files / 22 missing files"
mismatch against tag `2.1.0-incubating-rc2` that you observed.
For completeness, the primary source artifact itself
(`apache-fesod-2.1.0-incubating-src.tar.gz`) does match tag
`2.1.0-incubating-rc2` at `1cd6e891316cfea2c49028091be9d6ee0409cd1e` exactly
and passes signature, checksum, LICENSE/NOTICE/DISCLAIMER, RAT and build
checks, consistent with what you verified.
Withdrawal and fix
------------------
We agree this is release-blocking, so we withdraw the RC2 vote.
Thanks for your detail reviewed again.
Best regards,
Zhe Zhang
Xuanwo <[email protected]> 于2026年9月3日周四 14:23写道：
> -1 (binding)
>
> I found a release-blocking issue in the Maven staging repository
> `orgapachefesod-1037`.
>
> The staged `fesod-parent-2.1.0-incubating-source-release.zip` contains
> release-manager working directories and generated release artifacts that
> are not part of the source tree, including `dist/dist-rc2/`,
> `dist/remote-check/`, `dist/rc2-eval/`, staging deployment logs, and
> `svn-rc2-wc/`. It embeds the voted source tarball three times, together
> with its signature, checksum, and a KEYS file. Compared with tag
> `2.1.0-incubating-rc2`, the ZIP has 864 extra files and omits 22 tagged
> files.
>
> Please clean the source-release assembly, recreate the Maven staging
> repository, and start a new RC vote.
>
> For completeness, the primary source artifact itself passed the checks I
> ran: SHA-512 and signature verification (signing fingerprint
> `CCCFA0EAA4BFB4A441D4D770FDD68C1D3497B880`), exact match to tag
> `2.1.0-incubating-rc2` at `1cd6e891316cfea2c49028091be9d6ee0409cd1e`,
> archive safety, LICENSE/NOTICE/DISCLAIMER, RAT and Hawkeye license-header
> checks, and `./mvnw clean install -DskipTests`.
>
