-1 (binding)
I found a release-blocking licensing-documentation issue in the staged
Maven repository.
I inspected all 269 staged JARs. 44 do not contain both META-INF/LICENSE
and META-INF/NOTICE:
* 32 test-fixtures-{sources,javadoc}.jar artifacts across 16 modules:
polaris-admin, polaris-async-api, polaris-async-vertx, polaris-core,
polaris-nodes-impl, polaris-persistence-nosql-api,
polaris-persistence-nosql-cdi-weld,
polaris-persistence-nosql-correctness,
polaris-persistence-nosql-impl,
polaris-persistence-nosql-inmemory,
polaris-persistence-nosql-maintenance-impl,
polaris-persistence-nosql-metastore,
polaris-persistence-nosql-metastore-maintenance,
polaris-persistence-nosql-mongodb,
polaris-persistence-nosql-realms-spi, and polaris-runtime-service.
* 12 Spark artifacts: the main, sources, Javadoc, and bundle JARs for
polaris-spark-3.5_2.12, polaris-spark-3.5_2.13, and
polaris-spark-4.0_2.13. The three bundle JARs place LICENSE and
NOTICE at the archive root; the other nine lack the ASF pair.
This is not newly introduced in 1.7.0 rc0: the released 1.6.0 Maven
artifacts have the identical 44-artifact pattern. However, 1.5.0 and
1.4.1 included the required META-INF files in all 32 test-fixture
source/Javadoc classifiers, showing that portion is a regression.
ASF release policy requires each package to provide LICENSE and NOTICE
in the customary location, and specifically requires JARs to place
them in META-INF:
https://www.apache.org/legal/release-policy.html#licensing-documentation
The project's automatic verifier succeeds, but its JAR-content check
only matches conventional main and -sources JARs and explicitly
excludes all polaris-spark artifacts, so it does not detect these
omissions.
Other validation completed successfully:
* apache-polaris-1.7.0-rc0 resolves to
d1c9aff170772fb60295ea362024a7e605a29fbd.
* The signed source archive exactly matches the tag's 2,474 Git
files/symlinks and contains no unexpected compiled binaries.
* All announced signatures and checksums validate against the
published KEYS. Signing fingerprint:
F2EEEB06110BEE1397EC74CBB8960FF52D9B1312.
* The standard release verifier completed successfully.
* ./gradlew check -PnoIntegrationTests passed from a fresh source
extraction after rerunning one flaky OPA test.
* 164 Python client tests passed, and the staged wheel was reproduced
byte-for-byte.
* The staged admin CLI and server started successfully; server health
was UP.
A separate non-blocking concern is that client/python/pyproject.toml
still declares version 1.6.0 in the signed 1.7.0 source. The release
target stamps 1.7.0 and reproduced the staged wheel, but this should
also be corrected in the next RC.
Yufei
On Tue, Jul 28, 2026 at 1:32 PM Jean-Baptiste Onofré <[email protected]>
wrote:
> Hi everyone,
>
> I propose that we release the following RC as the official Apache
> Polaris 1.7.0 release.
>
> This corresponds to the tag: apache-polaris-1.7.0-rc0
>
> * https://github.com/apache/polaris/commits/apache-polaris-1.7.0-rc0
> *
> https://github.com/apache/polaris/tree/d1c9aff170772fb60295ea362024a7e605a29fbd
>
> The release tarball, signature, and checksums are here:
>
> * https://dist.apache.org/repos/dist/dev/polaris/1.7.0
>
> Helm charts are available on:
>
> * https://dist.apache.org/repos/dist/dev/polaris/helm-chart/1.7.0
>
> NB: you have to build the Docker images locally in order to test Helm
> charts.
>
> The Python CLI wheel is available on:
>
> * https://dist.apache.org/repos/dist/dev/polaris/python-client/1.7.0
>
> The Python CLI is also available on Test PyPI:
>
> * https://test.pypi.org/project/apache-polaris/1.7.0rc0/
>
> You can find the KEYS file here:
>
> * https://downloads.apache.org/polaris/KEYS
>
> Convenience binary artifacts are staged on Nexus. The Maven repository URL
> is:
>
> *
> https://repository.apache.org/content/repositories/orgapachepolaris-1070/
>
> Please download, verify, and test according to the release
> verification guide, which can be found at:
>
> *
> https://polaris.apache.org/community/release-guides/release-verification-guide/
>
> Please vote in the next 72 hours.
>
> [ ] +1 Release this as Apache Polaris 1.7.0
> [ ] +0
> [ ] -1 Do not release this because...
>
> Only PMC members have binding votes, but other community members are
> encouraged to cast non-binding votes.
> This vote will pass if there are 3 binding +1 votes and more binding
> +1 votes than -1 votes.
>
> Regards
> JB
>
