I validated Apache Polaris 1.7.0 rc1 on Darwin arm64 with Java 21.0.9. All provenance, cryptographic, build, test, and runtime checks passed:
- Tag apache-polaris-1.7.0-rc1 resolves to: 4ac2f059d1cce149453d0a5f1ff1dff980ec97cc - The signed source matches that commit across 2,466 files, eight symlinks, and 54 executable modes. - All distribution, Helm, Python, and 429 primary Maven JAR/POM/module signatures and SHA-512 checksums are valid. - Signing fingerprint: F2EEEB06110BEE1397EC74CBB8960FF52D9B1312 - The repository release verifier passed. - ./gradlew check -PnoIntegrationTests passed with 25,548 tests, 70 skipped, and zero failures or errors. - All 164 Python client tests passed. - The ASF-dist and TestPyPI wheels rebuilt byte-for-byte from the signed source. - The binary server started as Polaris 1.7.0, reported health UP, and returned HTTP 401 for an unauthenticated catalog request. Inspection of all 269 staged Maven JARs, Rc1 fixes all 32 test-fixture classifier omissions and all nine non-bundle Spark omissions from rc0. However, three still lack META-INF/LICENSE and META-INF/NOTICE: - polaris-spark-3.5_2.12-1.7.0-bundle.jar - polaris-spark-3.5_2.13-1.7.0-bundle.jar - polaris-spark-4.0_2.13-1.7.0-bundle.jar Each contains LICENSE and NOTICE only at the archive root. Their contents exactly match the corresponding BUNDLE-LICENSE and BUNDLE-NOTICE files in the signed source, so the remaining problem is their location. ASF release policy requires licensing materials in the distribution format’s customary location, and its release FAQ specifically states that distributed JARs must place LICENSE and NOTICE under META-INF: https://www.apache.org/legal/release-policy.html#licensing-documentation The way we place LICENSE and NOTICE has been like that since the very beginning (release 1.0.0). Maybe we should fix them per ASF policy. WDYT? Thanks, Yufei On Thu, Jul 30, 2026 at 8:10 AM Alexandre Dutra <[email protected]> wrote: > +1 > > - Automated checks (verify-release.sh) OK > - Git tag, checksums and GPG signatures OK > - NOTICE and LICENSE files OK > - Smoke test binary distribution OK > - Smoke test source distribution OK > - Smoke test Helm chart OK > > Thanks, > Alex > > On Thu, Jul 30, 2026 at 7:12 AM Jean-Baptiste Onofré <[email protected]> > wrote: > > > > Hi everyone, > > > > I propose that we release the following RC as the official Apache > > Polaris 1.7.0 release. > > > > This corresponds to the tag: apache-polaris-1.7.0-rc1 > > > > * https://github.com/apache/polaris/commits/apache-polaris-1.7.0-rc1 > > * > https://github.com/apache/polaris/tree/4ac2f059d1cce149453d0a5f1ff1dff980ec97cc > > > > The release tarball, signature, and checksums are here: > > > > * https://dist.apache.org/repos/dist/dev/polaris/1.7.0 > > > > Helm charts are available on: > > > > * https://dist.apache.org/repos/dist/dev/polaris/helm-chart/1.7.0 > > > > NB: you have to build the Docker images locally in order to test Helm > charts. > > > > The Python CLI wheel is available on: > > > > * https://dist.apache.org/repos/dist/dev/polaris/python-client/1.7.0 > > > > The Python CLI is also available on Test PyPI: > > > > * https://test.pypi.org/project/apache-polaris/1.7.0rc1/ > > > > You can find the KEYS file here: > > > > * https://downloads.apache.org/polaris/KEYS > > > > Convenience binary artifacts are staged on Nexus. The Maven repository > URL is: > > > > * > https://repository.apache.org/content/repositories/orgapachepolaris-1071/ > > > > Please download, verify, and test according to the release > > verification guide, which can be found at: > > > > * > https://polaris.apache.org/community/release-guides/release-verification-guide/ > > > > Please vote in the next 72 hours. > > > > [ ] +1 Release this as Apache Polaris 1.7.0 > > [ ] +0 > > [ ] -1 Do not release this because... > > > > Only PMC members have binding votes, but other community members are > > encouraged to cast non-binding votes. > > This vote will pass if there are 3 binding +1 votes and more binding > > +1 votes than -1 votes. > > > > Regards > > JB >
