Hi I want to cut a new hadoop-thirdparty release as a precursor to a new hadoop 3.5.1 release.
Proposed changes for a hadoop thirdparty release - close the 1.6.0 release JIRA HADOOP-19840 as WONTFIX. There's already a branch there &c and with the other changes planned, it's easiest to stop work on 1.6 and fork branch-1.7 off trunk later. - cut the avro artifact. Unused. Out of date. Not worth maintaining if it's not going to be wired up. - build process to be repeatable for asf trusted releases -see https://releases.apache.org/ . This will include maven and github workflow changes. - update protobuf and guava to latest versions - build and publish the SBOM for hadoop to pick up. (keep on java 8 BTW) I will get claude to do the work for this, so add claude.md &c as needed. The repeatable builds work is something I'm trying with cloudstore first; Aaron and I are involved with the asf tooling team. The tooling is designed such that github actions do all the building and sign with a special signing key, but release still follows the ASF vote process. There is still a human in the loop and hence resilience to NPM-style package manager worms. The ultimate goal is for hadoop itself to use ASF trusted releases for a fast release cycle, which would permit a monthly release cadence just to deal with the wave of security reports coming in from everything used. What I need from others 1. timely reviews 2. any other help needed for this 3. updating and testing any hadoop dependencies. someone doing a new aws sdk update would be a big one. 4. testing when the RC vote is in, for people who aren't aware, I am not working @ cloudera and anything I do in OSS dev is very much spare time right now. It'll drop to approximately nothing in two weeks time. I'm not reviewing anything not security related (sorry), and am doing this work just so we can get a 3.5.1 release out the door with all those transient cve fixes in. Steve
