Hi all, Thanks Sangkyoon for reporting this and Gustavo for confirming it. I prepared the releases on Ubuntu, so I missed it.
It affects 1.20.6-rc3, 2.2.2-rc2 and 2.3.1-rc2, but only building the source release with the bundled ./mvnw on macOS. The released binaries and packages are not affected, so users are not affected. I agree with you both that it isn't a blocker for these RCs, and we'll follow up on the fix in FLINK-41492 [1]. The votes continue. [1] https://issues.apache.org/jira/browse/FLINK-41492 Best, Rui Sangkyoon Nam <[email protected]> 于 2026年11月14日周六 00:36写道： > +1 (non-binding) > > - Verified the GPG signatures (key from KEYS) and SHA-512 checksums of all > 17 downloaded RC artifacts > - Source tarball matches tag release-2.3.1-rc2 except for the files the > release script excludes (.asf.yaml, .github, .idea, .gitignore files, > azure-pipelines.yml and the docs theme submodule) > - Built from source with JDK 17 (Corretto 17.0.14) on macOS arm64: ./mvnw > clean install -DskipTests -Dfast > - Started a local cluster from the binary distribution and ran the > streaming WordCount example to completion; the cluster reports 2.3.1 / > 477b1a8 > - Spot-checked orgapacheflink-1952: verified the signatures of the > flink-core and flink-python JARs > - Installed the cp311 macOS arm64 PyFlink wheel with pemja 0.5.8. Ran > pyflink/fn_execution/tests/test_state_impl.py from the source release > against it: 26 passed. > - Ran a process-mode state job and a thread-mode job with rows in > ARRAY/LIST/MAP. Both produced the expected results, covering FLINK-41106, > FLINK-41104, FLINK-41103 and FLINK-41228. > > For the Maven Wrapper bootstrap I removed /sbin from PATH, as described in > my earlier message in this thread about FLINK-41492. > > Thanks for driving the release, Rui. > > Sangkyoon > > > 2026년 11월 14일 (토) 오전 12:19, Gustavo de Morais <[email protected]>님이 > 작성: > >> Hi Sangkyoon and Rui, >> >> I checked the above and can confirm. My local runs didn't hit it because >> Maven 3.8.6 was already in my wrapper cache. IMO, I agree it doesn't need >> a >> new RC on its own. >> >> Kind regards, >> Gustavo >> >> On Fri, 13 Nov 2026 at 16:08, Sangkyoon Nam <[email protected]> >> wrote: >> >> > Hi Rui, >> > >> > A heads-up before I vote, and it applies to the 1.20.6 and 2.2.2 votes >> too: >> > on macOS 15, the bundled ./mvnw in all three source releases fails with >> > "Failed to validate Maven distribution SHA-256" before Maven starts, on >> any >> > machine where this wrapper hasn't already downloaded Maven 3.8.6. A >> Maven >> > cache from older Flink releases doesn't count, since the old wrapper >> used a >> > different directory. It's FLINK-37181 coming back. That fix shipped in >> > 1.20.3 and 2.0.1, but the FLINK-41049 backports to release-1.20, >> > release-2.2 and release-2.3 brought in the stock 3.3.2 wrapper script, >> > which calls "sha256sum -c" without the trailing "-" (fixed upstream in >> > wrapper 3.3.3). Master and release-2.4 use 3.3.4 and aren't affected, >> and >> > neither is Linux. I only checked macOS 15.3.1 on Apple silicon. >> > >> > I filed FLINK-41492 with the repro and two ways to fix it (move the >> three >> > branches to wrapper 3.3.4 like master, or add the trailing "-" to that >> one >> > line): >> > >> > >> https://www.google.com/url?q=https://issues.apache.org/jira/browse/FLINK-41492&source=gmail&ust=1794668770961000&sa=E >> > >> > Taking /sbin off PATH for one run, so the script falls back to shasum, >> > works around it, e.g. PATH=${PATH/:\/sbin/} ./mvnw -v. Later runs use >> the >> > downloaded Maven and don't need it. Since verification isn't blocked, I >> > don't think this alone needs a new RC, but it does hit the >> > build-from-source step for anyone voting from a Mac. Your call. >> > >> > Thanks, >> > Sangkyoon >> > >> > On Fri, Nov 13, 2026 10:45 PM, Gustavo de Morais < >> [email protected]> >> > wrote: >> > >> > > Hi Rui, >> > > >> > > +1 (non-binding) >> > > >> > > - checked GPG signatures and SHA-512 checksums >> > > - RAT passes ; source matches git tag release-2.3.1-rc2 >> > > - Built from source on JDK 17 (./mvnw clean install -DskipTests >> -DskipITs >> > > -Dfast), ~31,000 unit tests across flink-core, flink-runtime, >> > > flink-table-runtime, flink-table-planner all pass >> > > - Local cluster from binary: WordCount FINISHED, SQL Client SELECT 1 >> > works, >> > > Web UI shows flink-version=2.3.1 / commit 477b1a8 >> > > - Resolved >> > > flink-clients/flink-runtime/flink-streaming-java/flink-table-api-java >> > > 2.3.1 >> > > from staging repo; jar/pom/sources + .asc all present >> > > - PyFlink wheel installs and imports cleanly >> > > - CI on the release commit is green >> > > - Verified licenses >> > > >> > > Kind regards, >> > > Gustavo >> > > >> > > On Fri, 13 Nov 2026 at 13:41, fanrui.apache.org via dev < >> > > [email protected]> wrote: >> > > >> > > > Hi everyone, >> > > > >> > > > Please review and vote on the release candidate #2 for the version >> > > > 2.3.1, as follows: >> > > > [ ] +1, Approve the release >> > > > [ ] -1, Do not approve the release (please provide specific >> comments) >> > > > >> > > > The complete staging area is available for your review, which >> includes: >> > > > * JIRA release notes [1], >> > > > * the official Apache source release and binary convenience >> releases, >> > > > including the PyFlink source distributions and 13 wheels under >> > > > python/, staged on Apache Trusted Releases (ATR) for review [2] >> and >> > > > to be deployed to dist.apache.org, which are signed with the key >> > with >> > > > fingerprint DD8E 6D70 0C7B 5D22 CEF7 11C5 57DD 44DE 3590 F304 >> [3], >> > > > * all artifacts to be deployed to the Maven Central Repository [4], >> > > > * source code tag "release-2.3.1-rc2" [5], pointing to commit >> > > > 477b1a87b7396b60e7ce39ae6b2235b18cbe1ff5, >> > > > * website pull request listing the new release and adding the >> > > > announcement blog post [6]. >> > > > >> > > > Every file of this candidate (ATR revision 00003) can be downloaded >> > > > without login from >> > > > https://releases.apache.org/download/path/flink/2.3.1/<file>, for >> > > > example >> > > > https://releases.apache.org/download/path/flink/2.3.1/flink- >> > > 2.3.1-src.tgz; >> > > > the complete file list is at [7]. >> > > > >> > > > The Python wheels were built by the GitHub Actions run [8] on the >> > > > release commit. The CI run of the release branch commit the >> candidate >> > > > is built on is [9]. >> > > > >> > > > To verify the candidate, please check the signatures and checksums >> > > > against KEYS [3], build the source release (JDK 17, or JDK 11 with >> > > > -Djdk11 -Pjava11-target; Maven 3.8.6 via the bundled ./mvnw), and >> > > > follow the checklist in [10]. >> > > > >> > > > The vote will be open for at least 72 hours (excluding the weekend), >> > > > until 2026-11-18 13:00 UTC. It is adopted by majority approval, with >> > > > at least 3 PMC affirmative votes. >> > > > >> > > > Thanks, >> > > > Rui >> > > > >> > > > [1] >> > > > https://issues.apache.org/jira/secure/ReleaseNote.jspa?versi >> > > on=12357166&projectId=12315522 >> > > > [2] https://releases.apache.org/vote/flink/2.3.1 >> > > > [3] https://dist.apache.org/repos/dist/release/flink/KEYS >> > > > [4] >> > > > >> > https://repository.apache.org/content/repositories/orgapacheflink-1952/ >> > > > [5] https://github.com/apache/flink/releases/tag/release-2.3.1-rc2 >> > > > [6] https://github.com/apache/flink-web/pull/894 >> > > > [7] >> > > > https://releases.apache.org/api/release/paths/flink/2.3.1/00 >> > > 003?limit=1000 >> > > > [8] https://github.com/apache/flink/actions/runs/43413305410 >> > > > [9] https://github.com/apache/flink/actions/runs/43388892333 >> > > > [10] >> > > > https://cwiki.apache.org/confluence/display/FLINK/Verifying+ >> > > a+Flink+Release >> > > > >> > > > This email was sent by [email protected] on the Apache Trusted >> > Releases >> > > > platform >> > > > >> > > >> > >> >
