In a recent thread on this list [1], Julian Hyde asked a question about ADBC release candidate provenance that I don't feel qualified to answer so I'm starting a new thread to get more eyeballs.
The question was, "How can you be sure that the SHA of the RC that four people voted on?" I'm hoping some other release managers can chime in. I wasn't aware that other ASF projects kept their RCs around and had assumed we don't keep RCs for Arrow [2] due to file size limitations. Last, the issue was pointed out for ADBC but I'm not sure it doesn't apply to other Arrow subprojects with their own source trees and releases. Thanks, Bryce [1] https://lists.apache.org/thread/1y29klotc8orvjd71p2trthlxxrvz30j [2] https://dist.apache.org/repos/dist/dev/arrow/
