uranusjr commented on code in PR #69582: URL: https://github.com/apache/airflow/pull/69582#discussion_r3541232159
########## java-sdk/README.md: ########## @@ -291,7 +316,144 @@ is the source-package URL you link in the vote. Send a `[VOTE]` email to `[email protected]` linking the git tag and commit, the source package in `dist/dev`, the closed Nexus staging repository, -and the `KEYS` file. +and the `KEYS` file. See "Vote email template" below for the exact fields to +fill in, and "Verifying a release" for what to ask reviewers to check. + +### Vote email template + +Past vote emails have shipped with unfilled placeholders or an incomplete +artifact list, so treat this template as the source of truth and diff your +draft against it before sending. + +```text +Subject: [VOTE] Release Apache Airflow Java SDK 1.0.0-beta1 based on rc<N> + +Hey all, + +I have prepared the Apache Airflow Java SDK 1.0.0-beta1 rc<N>. + +Changes since rc<N-1>: +<one-line summary per fix, or "N/A — first RC" if this is rc1> + +Consider this a formal vote on whether to release these packages as +Apache Airflow Java SDK 1.0.0-beta1. + +The vote will be open for at least 72 hours (until <YYYY-MM-DD HH:MM UTC>) or +until the necessary number of votes is reached. + +https://www.apache.org/legal/release-policy.html#release-approval + +Airflow Java SDK Package: +https://dist.apache.org/repos/dist/dev/airflow/java-sdk/1.0.0-beta1-rc<N>/ + +git tag / commit: +https://github.com/apache/airflow/releases/tag/java-sdk/1.0.0-beta1-rc<N> +(commit <full-commit-sha>) + +KEYS file: +https://downloads.apache.org/airflow/KEYS + +Staging Nexus repository (convenience binaries — 8 artifacts + plugin marker): +https://repository.apache.org/content/repositories/orgapacheairflow-<NNNN>/org/apache/airflow/ + - airflow-sdk + - airflow-sdk-jul + - airflow-sdk-log4j2 + - airflow-sdk-slf4j + - airflow-sdk-jpl + - airflow-sdk-processor + - airflow-sdk-bom + - airflow-sdk-gradle-plugin + - org.apache.airflow.sdk.gradle.plugin (Gradle plugin marker artifact) + +Please vote accordingly: + +[ ] +1 approve +[ ] +0 no opinion +[ ] -1 disapprove with the reason + +Only PMC members' votes are binding, but everyone is encouraged to test the +release and vote. + +Thanks, +<your name> +``` + +Pre-send checklist: + +* Every staged artifact above resolves in the Nexus staging repository — cross + check against the *Verify the upload* step, not just this list from memory. +* `Changes since rc<N-1>` and the vote deadline are filled in (not "N/A" unless + this really is rc1, and not left blank). +* Run `grep '<' email.txt` on the rendered email and confirm **no output** — + any match means a template placeholder (`<N>`, `<NNNN>`, `<YYYY-MM-DD ...>`, + etc.) was left unfilled. + +### Verifying a release + +Anyone on `[email protected]` can (and should) independently verify a +candidate before voting. Below is the checklist a reviewer — or the release +manager, before sending the vote — should run against the source package in +`dist/dev`. + +1. **Checksum.** Confirm the published SHA-512 matches the downloaded tarball: + + ```bash + sha512sum -c apache-airflow-java-sdk-1.0.0-beta1-src.tar.gz.sha512 + ``` + +2. **Signature.** Import the `KEYS` file and verify the GPG signature: + + ```bash + curl -O https://downloads.apache.org/airflow/KEYS + gpg --import KEYS + gpg --verify apache-airflow-java-sdk-1.0.0-beta1-src.tar.gz.asc \ + apache-airflow-java-sdk-1.0.0-beta1-src.tar.gz + ``` + +3. **Diff against the git tag.** Extract the tarball and compare it with a + clean checkout of the tag it claims to be built from — they should be + identical apart from the excluded Gradle wrapper files. Note the extracted + top-level directory is named after the `--prefix` used by the `sourceRelease` + task, `apache-airflow-java-sdk-<version>` — it does **not** carry the `-src` + suffix that only appears in the tarball's own filename: + + ```bash + tar xzf apache-airflow-java-sdk-1.0.0-beta1-src.tar.gz + git clone --branch java-sdk/1.0.0-beta1-rc1 \ Review Comment: ```suggestion git clone --branch java-sdk/1.0.0-beta1-rc<N> \ ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
