+1 (pending KEYS fix) Verified the source release: - sha512 and the OpenPGP signature are good; LICENSE/NOTICE present. - Built the full reactor from source with JDK 17 — unit tests pass (1142 tests, 0 failures / 0 errors).
One thing blocks independent verification: your signing key (Alex O'Ree, 98AD2E19BFF4106D) isn't in the published KEYS — it's absent from dist/release/jspwiki/KE 1 new message (ctrl+End) ↓ ache.org), and the only copy on the public keyservers is the expired one. The signature only verifies against the KEYS bundled inside the release zip, which can't Arturo On Sun, Aug 16, 2026 at 10:40 PM Alex O'Ree <[email protected]> wrote: > This is a release vote for Apache JSPWiki, version 2.12.5. The vote will > be open for at least 72 hours from now. > > This is a revision of the previous attempt that addresses some issues > flagged by the community. Namely the one change in behavior can now be > reverted if necessary. > > It fixes the following issues: > > https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310732&version=2.12.5 > > NOTE: all issues with this release are for undisclosed security issues. > Login is required to see the issues list and it is restricted to dev team > members > > You can see a curated changelog at > https://jspwiki-wiki.apache.org/Wiki.jsp?page=NewIn2.12.5 > > Note that we are voting upon the source (tag), binaries are provided for > convenience. > > Everybody is encouraged to vote. > > Source and binary files: > https://dist.apache.org/repos/dist/dev/jspwiki/2.12.5-RC1 > > Nexus staging repo: > https://repository.apache.org/content/repositories/orgapachejspwiki-1039 > > The tag to be voted upon: > https://github.com/apache/jspwiki/tree/2.12.5-RC1 > > JSPWiki's KEYS file containing PGP keys we use to sign the release: > https://www.apache.org/dist/jspwiki/KEYS > > == Reproducible Builds == > JSPWiki should follow Reproducible Builds ( > https://reproducible-builds.org/). > In order to verify > artifacts' build reproducibility, please use > > mvn verify artifact:compare -Dreference.repo= > https://repository.apache.org/content/repositories/staging/ > > *** Please download, test and vote: > > [ ] +1 Approve the release > [ ] 0 Don't mind > [ ] -1 Disapprove the release (please provide specific comments) > > +1 for me >
