+1 On 9/19/26 03:52, Paul King wrote:
Dear development community, I am happy to start the VOTE thread for a Groovy 6.0.0 release! This release includes 10 bug fixes/improvements as outlined in the changelog: https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12318123&version=12357525 Tag: https://github.com/apache/groovy/tree/GROOVY_6_0_0/ Tag commit id: bc6b3cfd9f8f3397129f8ebbdf85a189d16d7360 The artifacts to be voted on are located as follows (r87671). Source release: https://dist.apache.org/repos/dist/dev/groovy/6.0.0/sources Convenience binaries: https://dist.apache.org/repos/dist/dev/groovy/6.0.0/distribution Temporary artifacts: https://repository.apache.org/content/repositories/orgapachegroovy-1125 Release artifacts are signed with a key from the following file: https://dist.apache.org/repos/dist/release/groovy/KEYS Please vote on releasing this package as Apache Groovy 6.0.0. Reminder on ASF release approval requirements for PMC members: http://www.apache.org/legal/release-policy.html#release-approval Hints on validating checksums/signatures (but replace md5sum with sha256sum): https://www.apache.org/info/verification.html The vote is open for the next 72 hours and passes if a majority of at least three +1 PMC votes are cast. [ ] +1 Release Apache Groovy 6.0.0 [ ] 0 I don't have a strong opinion about this, but I assume it's ok [ ] -1 Do not release Apache Groovy 6.0.0 because... Here is my vote: +1 (binding) ---- My local verify.sh: ✅ KEYS Downloaded ✅ Source Distribution Verified ✅ Binary Distribution Verified ✅ Docs Distribution Verified ✅ SDK Distribution Verified ✅ Gradle Bootstrapped ✅ RAT passed ✅✅✅ Automatic verification finished. GroovyPolicyMCP: **Verdict: Apache Groovy 6.0.0 is clean. I would vote +1.** Every check on the release checklist passed, and my worktree for the RAT run was removed without touching your GROOVY_6_0_X checkout. **Tag and source** - The annotated tag on gitbox and GitHub resolves to commit bc6b3cfd9f8f3397129f8ebbdf85a189d16d7360, matching the vote email. Its parent is on origin/GROOVY_6_0_X, and it carries 12 commits after RC-3, all dependency bumps and the listed fixes. - The source zip is identical to `git archive` at the tag. The only absent files are the usual deliberate omissions: benchmark, perf dashboard, wrapper, governance docs, CI configs, ABI surface. - No compiled code or archives in the source zip. The full project RAT check passes at the tag. The version is 6.0.0 with no SNAPSHOT or RC remnants in the properties, jar manifests, or poms. - The JIRA changelog lists 10 unique issues, as the email says. **Signatures and checksums** | Location | Artifacts | Signed by 6A65176A0FB1CD0B | Checksums | | ---------------------------------- | --------- | -------------------------- | ----------------------------------- | | dist.apache.org zips | 4 | 4 good | SHA-256 match | | Nexus staging orgapachegroovy-1125 | 297 | 297 good | md5, sha1, sha256, sha512 all match | The key is in the published KEYS file at dist/release/groovy. **LICENSE and NOTICE** - All four zips' LICENSE and NOTICE files are byte-identical to RC-3's. Pointers resolve 18 of 18 in binary and SDK, 6 of 6 in source, 4 of 4 in docs, with no unreferenced texts. NOTICE carries the 13 upstream credits. - The lib set changed only in versions since RC-3: JLine and jansi to 4.4.5, jcl-over-slf4j to 2.0.19, and the maven-resolver family to 2.0.23. JLine 4.4.5's pom still declares BSD-3-Clause, and the other two keep their MIT and Apache licences, so the existing LICENSE text covers them. - All 167 staged jars carry META-INF LICENSE and NOTICE with every pointer resolving. Raw, shaded, grooid, sources and groovy-all-sources declarations match their content. Sources, javadoc and groovydoc jars contain no classes. - The core, grooid and groovy-test-grooid jars in the binary zip are byte-identical to the staged ones, as are all 39 module jars in lib/, and the staged groovy-binary zip is byte-identical to the dist binary zip. - All 43 poms declare the licence with no SNAPSHOT or RC dependencies. SBOMs show 729 of 729 components licensed.
