Hi all, I wrote up a script for validating the release artifacts that could be used as a starting point for further releases going forward. It runs in a standalone container and verifies the signatures and checksums of the release artifacts. I based a good chunk of it on mck's PR ( https://github.com/apache/cassandra-builds/pull/32). The script also builds the source tar and runs unit tests. Lastly it runs a small Gradle-based java project that pulls from the nexus staging repo (like Bret shared) and runs basic connectivity test to a single node Cassandra cluster stood up using testcontainers (https://testcontainers.com).
Output showing validation steps: [Tue Oct 21 03:15:50 PM UTC 2025] 📄 Writing output to /output/4.19.1_1761059750_results.out [Tue Oct 21 03:15:50 PM UTC 2025] 🔑 Downloading KEYS file from https://dist.apache.org/repos/dist/release/cassandra/KEYS ... [1.630s] ✅ [Tue Oct 21 03:15:52 PM UTC 2025] 🔑 Importing all entries in KEYS file ... [0.086s] ✅ [Tue Oct 21 03:15:52 PM UTC 2025] 🔑 Trusting all entries in KEYS file ... [0.177s] ✅ [Tue Oct 21 03:15:52 PM UTC 2025] 📁 Downloading distributables from https://dist.apache.org/repos/dist/dev/cassandra/cassandra-java-driver/4.19.1 ... [1.480s] ✅ [Tue Oct 21 03:15:54 PM UTC 2025] ↳ 🔐 apache-cassandra-java-driver-4.19.1-source.tar.gz: ensuring signature matches an entry in KEYS ... [0.037s] ✅ [Tue Oct 21 03:15:54 PM UTC 2025] ↳ #⃣ apache-cassandra-java-driver-4.19.1-source.tar.gz: ensuring sha256 matches ... [0.011s] ✅ [Tue Oct 21 03:15:54 PM UTC 2025] ↳ #⃣ apache-cassandra-java-driver-4.19.1-source.tar.gz: ensuring sha512 matches ... [0.008s] ✅ [Tue Oct 21 03:15:54 PM UTC 2025] ↳ 🔐 apache-cassandra-java-driver-4.19.1.tar.gz: ensuring signature matches an entry in KEYS ... [0.081s] ✅ [Tue Oct 21 03:15:54 PM UTC 2025] ↳ #⃣ apache-cassandra-java-driver-4.19.1.tar.gz: ensuring sha256 matches ... [0.043s] ✅ [Tue Oct 21 03:15:54 PM UTC 2025] ↳ #⃣ apache-cassandra-java-driver-4.19.1.tar.gz: ensuring sha512 matches ... [0.032s] ✅ [Tue Oct 21 03:15:55 PM UTC 2025] 🏗️ Extracting apache-cassandra-java-driver-4.19.1-source.tar.gz ... [0.081s] ✅ [Tue Oct 21 03:15:55 PM UTC 2025] 🏗️ Building from source and running unit tests ... [141.692s] ✅ [Tue Oct 21 03:18:16 PM UTC 2025] 🌀 Running a basic connectivity test with artifact 4.19.1 from nexus staging repo 1423 ... [53.873s] ✅ [Tue Oct 21 03:19:10 PM UTC 2025] 🎉 Completed with all tests passing! [200.082s] 🎉 full output here: https://gist.github.com/tolbertam/e648a07e1fae9d632b7429493c779895 I'll work on finding a good way to share this script. Thank you everyone for voting! It looks like we have at least 3 PMC +1s to move forward with this after the vote closes in approximately 5 hours. We will proceed with the release if the vote holds. Thanks, Andy On Sun, Oct 19, 2025 at 12:33 PM Francisco Guerrero <[email protected]> wrote: > +1 > > On 2025/10/18 21:01:08 Abe Ratnofsky wrote: > > +1 > > > > > > > > > On Oct 18, 2025, at 08:22, Josh McKenzie <[email protected]> > wrote: > > > > > > > > > > > > > > > > > +1 > > > > > > > > > > > > > > > On Fri, Oct 17, 2025, at 5:43 PM, Dinesh Joshi wrote: > > > > > > > >> +1 > > > > >> > > > > >> > > > > > >> > > > > >> On Fri, Oct 17, 2025 at 2:38 PM Tolbert, Andy > > <[[email protected]](mailto:[email protected])> wrote: > > > > >> > > > > >>> Hi All, > > > > >>> > > > > >>> > > > > > >>> > > > > >>> As we need a two more PMC votes, I'd like to extend the vote through > > Tuesday Oct 21 at 21:30 UTC (4 days from now). > > > > >>> > > > > >>> > > > > > >>> > > > > >>> In the meantime i'm working on coming up a Docker build and script > with > > something adjacent to what was done here for verifying cassandra builds > > (<https://github.com/apache/cassandra- > > > builds/pull/32/files#diff-a636443cd5bfb43c9eddbf4ea4ce8546d63190b9326266245ab0068984fe59c1>), > > but for the java driver. Hopefully will be able to get that going this > > weekend. I'll work to share something for that soon, and hopefully > that can > > help us establish some more confidence on our release artifacts! > > > > >>> > > > > >>> > > > > > >>> > > > > >>> Thanks, > > > > >>> > > > > >>> Andy > > > > >>> > > > > >>> > > > > > >>> > > > > >>> On Thu, Oct 16, 2025 at 8:42 PM Bret McGuire > > <[[email protected]](mailto:[email protected])> wrote: > > > > >>> > > > > >>>> +1 from me as well for the release overall. > > > > >>>> > > > > >>>> > > > > > >>>> > > > > >>>> Steps I took to validate are pretty similar to what was on Andy's > > list: > > > > >>>> > > > > >>>> > > > > > >>>> > > > > >>>> * Validated all checksums > > > > >>>> * Ran a simple test app with dependencies from the staging Maven > repo > > > > >>>> * Ran a DataStax Jenkins job (to confirm all integration tests > and DSE > > functionality) > > > > >>>> > > > > >>>> > > > > >>>> > > > > > >>>> > > > > >>>> For the record: the following might be useful if you're Gradle- > > inclined: > > > > >>>> > > > > >>>> > > > > > >>>> > > > > >>>>> repositories { > > > > >>>>> > > > > >>>>> mavenCentral() > > > > >>>>> > > > > >>>>> maven { > > > > >>>>> > > > > >>>>> url = > > uri("< > https://repository.apache.org/content/repositories/orgapachecassandra-1423/ > >") > > > > >>>>> > > > > >>>>> } > > > > >>>>> > > > > >>>>> } > > > > >>>> > > > > >>>> > > > > > >>>> > > > > >>>> \- Bret - > > > > >>>> > > > > >>>> > > > > > >>>> > > > > >>>> On Thu, Oct 16, 2025 at 2:42 PM Bret McGuire > > <[[email protected]](mailto:[email protected])> wrote: > > > > >>>> > > > > >>>>> +1 to the list Andy put out. That's pretty much the same set of > > steps I work through when I validate a given release. > > > > >>>>> > > > > >>>>> > > > > > >>>>> > > > > >>>>> With respect to the point raised by Abe, he and Andy and I > spent some > > time talking about this elsewhere. The source tarball is correct; it > includes > > source for everything. Abe did point out that the distribution tarball > in SVN > > doesn't have dependent JARs for all subprojects. This is something we > can > > fix, but it's also probably a good start to a conversation about what > role we > > want the distribution tarball to play and whether we need it at all > anymore. > > Further discussion is _definitely_ required there, but the upshot is > that no > > changes are required for this release; we can move forward with the > artifacts > > Andy has already uploaded. > > > > >>>>> > > > > >>>>> > > > > > >>>>> > > > > >>>>> Which in turn reminds me that _I_ need to validate this guy and > give > > a +1... on to that now! > > > > >>>>> > > > > >>>>> > > > > > >>>>> > > > > >>>>> \- Bret - > > > > >>>>> > > > > >>>>> > > > > > >>>>> > > > > >>>>> On Thu, Oct 16, 2025 at 9:42 AM Tolbert, Andy > > <[[email protected]](mailto:[email protected])> wrote: > > > > >>>>> > > > > >>>>>> Hi Abe, > > > > >>>>>> > > > > >>>>>> > > > > > >>>>>> > > > > >>>>>> Good catch! I assume you mean the main distribution > > (<https://dist.apache.org/repos/dist/dev/cassandra/cassandra-java- > > driver/4.19.1/apache-cassandra-java-driver-4.19.1.tar.gz>; which also > includes > > src zips), it does look like there are some modules missing from the > > distribution pom that should probably be included; It's likely that > these > > modules were never added to the distribution build when they were > introduced > > and no one has noticed until now. Let me see if I can fix that and make > > another go at this. > > > > >>>>>> > > > > >>>>>> > > > > > >>>>>> > > > > >>>>>> <https://github.com/apache/cassandra-java- > > driver/blob/4.x/distribution/pom.xml#L47-L69> > > > > >>>>>> > > > > >>>>>> > > > > > >>>>>> > > > > >>>>>> Just did a spot check and it looks like the source tar is > including > > everything since it's just grabbing everything with exception to some > > dotfiles. > > > > >>>>>> > > > > >>>>>> > > > > > >>>>>> > > > > >>>>>> Thanks, > > > > >>>>>> > > > > >>>>>> Andy > > > > >>>>>> > > > > >>>>>> > > > > > >>>>>> > > > > >>>>>> > > > > > >>>>>> > > > > >>>>>> On Thu, Oct 16, 2025 at 9:18 AM Abe Ratnofsky > > <[[email protected]](mailto:[email protected])> wrote: > > > > >>>>>> > > > > >>>>>>> Agree it would be helpful to have a standardized script. > > > > >>>>>>> > > > > >>>>>>> > > > > > >>>>>>> > > > > >>>>>>> Maybe a noob question, but why do the source artifact > distributions > > only contain (core, query-builder, mapper-processor, mapper-runtime) and > not > > (metrics, guava, etc) which do have source files in-tree? > > > > >
