i'm +1 but note that rcverify failed for me on this, here's the log below and the diff
diff '/var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX/LICENSE-2.0' '/var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX/openwhisk-runtime-docker-1.16.0/LICENSE.txt' 202a203,210 > > ======================================================================== > Apache License 2.0 > ======================================================================== > > This product bundles the files gradlew and gradlew.bat from Gradle v5.5 > which are distributed under the Apache License, Version 2.0. > For details see ./gradlew and ./gradlew.bat. > ./rcverify.sh openwhisk-runtime-docker 1.16.0 rc1 rcverify.sh (script SHA1: 6DC9 462D 3035 5FD0 ADE6 9EF9 D0DF 1A25 13E1 5CFD) working in the following directory: /var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX fetching tarball and signatures from https://dist.apache.org/repos/dist/dev/openwhisk/rc1 fetching openwhisk-runtime-docker-1.16.0-sources.tar.gz... ok fetching openwhisk-runtime-docker-1.16.0-sources.tar.gz.asc... ok fetching openwhisk-runtime-docker-1.16.0-sources.tar.gz.sha512... ok fetching apache license... ok fetching release keys... ok importing keys... ok (new keys imported (processed 14 unchanged )) gpg: key 72AF0CC22C4CF320: public key "Vincent Hou (Release manager of OpenWhisk) <houshen...@apache.org>" imported gpg: key 22907064147F886E: public key "Dave Grove <gro...@us.ibm.com>" imported gpg: key 44667BC927C86D51: public key "Rodric Rabbah <rab...@apache.org>" imported gpg: key B1457C3D7101CC78: public key "James Thomas <jamestho...@apache.org>" imported gpg: key A600E3331427515D: public key "Olivier Tardieu <tard...@apache.org>" imported gpg: key 804F627B2D1BD1A0: 6 signatures not checked due to missing keys gpg: key 804F627B2D1BD1A0: public key "Alexander Klimetschek (Adobe Work Email) <aklim...@adobe.com>" imported gpg: key 758C332F8D30E5A2: 1 signature not checked due to a missing key gpg: key 758C332F8D30E5A2: public key "Alexander Klimetschek (Apache Committer Key) <alex...@apache.org>" imported gpg: key B5B8ADA933BB2FFF: public key "Dominic Kim <styl...@apache.org>" imported gpg: key A1F071AF3F62EEFF: 3 signatures not checked due to missing keys gpg: key A1F071AF3F62EEFF: public key "keybase.io/akrabat < akra...@keybase.io>" imported gpg: key 395282A61D88D0AC: public key "Matt Rutkowski <mrutkow...@apache.org>" imported gpg: key 7050DAD4D8D21A6B: public key "Shawn Black <shawnalle...@apache.org>" imported gpg: key 1683F2D3AF54F2F1: public key "Tyson Norris <tysonnor...@apache.org>" imported gpg: key 44FA19E603F812E5: public key "Cosmin Stanciu (CODE SIGNING KEY) < stan...@apache.org>" imported gpg: key 44667BC927C86D51: "Rodric Rabbah <rab...@apache.org>" 3 new signatures gpg: Total number processed: 14 gpg: imported: 13 gpg: new signatures: 3 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: next trustdb check due at 2026-12-14 unpacking tar ball... ok cloning scancode... ok computing sha512 for openwhisk-runtime-docker-1.16.0-sources.tar.gz... ok openwhisk-runtime-docker-1.16.0-sources.tar.gz: 4195F7B3 BD4D2B9F 8D59CF1A 4AF3EA42 E9E74DE8 EB8BDB85 CF9A7EC4 064B2E66 275DEC13 6A84341B A38026C3 96E5862C 837C38A4 02B7133B 929E8F75 D5B9BF53 validating sha512... passed verifying asc... passed (signed-by: Dave Grove <dgr...@apache.org>) verifying notice... passed verifying absence of DISCLAIMER.txt passed verifying license...cmp: EOF on /var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX/LICENSE-2.0 failed (cmp -n 11358 '/var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX/LICENSE-2.0' '/var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX/openwhisk-runtime-docker-1.16.0/LICENSE.txt') verifying sources have proper headers... passed scanning for executable files... passed scanning for unexpected file types... passed scanning for archives... passed scanning for packages... passed scanning package.json for version match... passed (none detected) scanning package-lock.json for version match... passed (none detected) On Tue, Sep 3, 2024 at 1:21 PM David Grove <gro...@us.ibm.com> wrote: > Hi, > > This is a call to vote on releasing version 1.16.0 release candidate rc1 > of the following project module with artifacts built from the Git > repositories and commit IDs listed below. > > * OpenWhisk Runtime Docker: 64943d7cfb393b6d4d137569f502e61a0efd212e > > https://github.com/apache/openwhisk-runtime-docker/commit/64943d7cfb393b6d4d137569f502e61a0efd212e > > https://dist.apache.org/repos/dist/dev/openwhisk/rc1/openwhisk-runtime-docker-1.16.0-sources.tar.gz > > https://dist.apache.org/repos/dist/dev/openwhisk/rc1/openwhisk-runtime-docker-1.16.0-sources.tar.gz.asc > > https://dist.apache.org/repos/dist/dev/openwhisk/rc1/openwhisk-runtime-docker-1.16.0-sources.tar.gz.sha512 > > This release is comprised of source code distribution only. > > You can use this UNIX script to download the release and verify the > checklist below: > https://github.com/apache/openwhisk-release/blob/1f9463f/tools/rcverify.sh > > Usage: > curl -s " > https://raw.githubusercontent.com/apache/openwhisk-release/1f9463f/tools/rcverify.sh"; > -o rcverify.sh > chmod +x rcverify.sh > ./rcverify.sh openwhisk-runtime-docker 1.16.0 rc1 > > Please vote to approve this release: > > [ ] +1 Approve the release > [ ] 0 Don't care > [ ] -1 Don't release, because ... > > Release verification checklist for reference: > [ ] Download links are valid. > [ ] Checksums and PGP signatures are valid. > [ ] Source code artifacts have correct names matching the current > release. > [ ] LICENSE and NOTICE files are correct for each OpenWhisk repository. > [ ] All files have license headers as specified by OpenWhisk project > policy [1]. > [ ] No compiled archives bundled in source archive. > > This majority vote is open for at least 72 hours. > > > [1] > https://github.com/apache/openwhisk-release/blob/master/docs/license_compliance.md > >
