XiaoHongbo-Hope opened a new pull request, #554: URL: https://github.com/apache/paimon-rust/pull/554
## Summary - Commit `Cargo.lock`, use locked builds, and pin release tooling. - Generate reproducible dependency inventories and target-specific third-party license reports. - Package and byte-verify LICENSE, NOTICE, and third-party reports in Rust crates, Python archives, and Go release assets. - Verify Linux wheel OpenSSL libraries, native formats, architectures, versions, and legal metadata. - Harden Rust publishing with MSRV checks, package-content checks, tag/version validation, ordered publishing, and safe reruns. ## Background This applies the release-vote fixes from apache/paimon-full-text#17 and apache/paimon-full-text#22. Paimon Rust had the same artifact-exact legal metadata and Windows line-ending risks, plus several repository-specific gaps: - `Cargo.lock` was ignored. - Published Rust crates omitted test helpers and fixtures needed by packaged tests. - Go native assets had no matching legal sidecars. - Linux wheels bundled OpenSSL 1.1 shared libraries without explicit license coverage. ## Verification - `cargo deny --locked --all-features check licenses` - `python3.11 scripts/dependencies.py verify` - `python3.11 scripts/release_licenses.py --check` - `rustup run 1.91.0 cargo check --locked --workspace --all-targets --all-features` - `cargo publish --locked -p paimon -p paimon-datafusion --all-features --dry-run` - Rust crate package inventory checks - Python five-wheel and sdist verifier tests, including OpenSSL negative cases - Go native artifact positive and negative verifier tests - `cargo fmt`, Ruff, Python byte compilation, YAML parsing, and actionlint -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
