+1 Source tarball: GPG OK, SHA-512 OK Binary dists (tgz/zip): GPG OK, SHA-512 OK Helm chart + .prov: GPG OK, SHA-512 OK Python wheel: GPG OK, SHA-512 OK; Version: 1.7.0 Git tag matches announced commit Tarball: LICENSE + NOTICE, Apache-2.0, no DISCLAIMER Maven staging (orgapachepolaris-1071): 431/431 primary artifacts — GPG OK, SHA-512 OK, failures: 0 Parent POM: org.apache.polaris:polaris:1.7.0, Apache-2.0, scm tag apache-polaris-1.7.0 Binary MANIFEST: Apache-Polaris-Build-Git-Describe: apache-polaris-1.7.0-rc1 Apache-Polaris-Build-Git-Head: 4ac2f059d1cce149453d0a5f1ff1dff980ec97cc
META-INF/LICENSE+NOTICE (rc0 -1 fix): 266/269 jars have both under META-INF. Remaining 3 are Spark -bundle.jars with LICENSE/NOTICE at jar root (same convention the verification guide excludes for Spark). Spot-checked test-fixtures-sources/javadoc: META-INF present. *I know Yufei was a bit worried about the root level notices. I know Iceberg includes the license and notice twice (root and META-INF). I don't think this is a blocker and while I wouldn't stop someone from moving or duplicating the files, I probably wouldn't do it myself :)* CI for this commit: CI/release/1.7.x success; release publish success ./gradlew assemble (Corretto 21.0.3): BUILD SUCCESSFUL Binary LICENSE: no GPL/SSPL; MIT/BSD/EPL/CDDL Category A/B only On Thu, Jul 30, 2026 at 12:48 PM Yufei Gu <[email protected]> wrote: > I validated Apache Polaris 1.7.0 rc1 on Darwin arm64 with Java 21.0.9. > > All provenance, cryptographic, build, test, and runtime checks passed: > > - Tag apache-polaris-1.7.0-rc1 resolves > to: 4ac2f059d1cce149453d0a5f1ff1dff980ec97cc > - The signed source matches that commit across 2,466 files, eight symlinks, > and 54 executable modes. > - All distribution, Helm, Python, and 429 primary Maven JAR/POM/module > signatures and SHA-512 checksums are valid. > - Signing fingerprint: F2EEEB06110BEE1397EC74CBB8960FF52D9B1312 > - The repository release verifier passed. > - ./gradlew check -PnoIntegrationTests passed with 25,548 tests, 70 > skipped, and zero failures or errors. > - All 164 Python client tests passed. > - The ASF-dist and TestPyPI wheels rebuilt byte-for-byte from the signed > source. > - The binary server started as Polaris 1.7.0, reported health UP, and > returned HTTP 401 for an unauthenticated catalog request. > > Inspection of all 269 staged Maven JARs, Rc1 fixes all 32 test-fixture > classifier omissions and all nine non-bundle Spark omissions from rc0. > However, three still lack META-INF/LICENSE and META-INF/NOTICE: > > - polaris-spark-3.5_2.12-1.7.0-bundle.jar > - polaris-spark-3.5_2.13-1.7.0-bundle.jar > - polaris-spark-4.0_2.13-1.7.0-bundle.jar > > Each contains LICENSE and NOTICE only at the archive root. Their contents > exactly match the corresponding BUNDLE-LICENSE and BUNDLE-NOTICE files in > the signed source, so the remaining problem is their location. > > ASF release policy requires licensing materials in the distribution > format’s customary location, and its release FAQ specifically states that > distributed JARs must place LICENSE and NOTICE under META-INF: > > https://www.apache.org/legal/release-policy.html#licensing-documentation > > The way we place LICENSE and NOTICE has been like that since the very > beginning (release 1.0.0). Maybe we should fix them per ASF policy. WDYT? > > Thanks, > Yufei > > > On Thu, Jul 30, 2026 at 8:10 AM Alexandre Dutra <[email protected]> wrote: > > > +1 > > > > - Automated checks (verify-release.sh) OK > > - Git tag, checksums and GPG signatures OK > > - NOTICE and LICENSE files OK > > - Smoke test binary distribution OK > > - Smoke test source distribution OK > > - Smoke test Helm chart OK > > > > Thanks, > > Alex > > > > On Thu, Jul 30, 2026 at 7:12 AM Jean-Baptiste Onofré <[email protected]> > > wrote: > > > > > > Hi everyone, > > > > > > I propose that we release the following RC as the official Apache > > > Polaris 1.7.0 release. > > > > > > This corresponds to the tag: apache-polaris-1.7.0-rc1 > > > > > > * > https://github.com/apache/polaris/commits/apache-polaris-1.7.0-rc1 > > > * > > > https://github.com/apache/polaris/tree/4ac2f059d1cce149453d0a5f1ff1dff980ec97cc > > > > > > The release tarball, signature, and checksums are here: > > > > > > * https://dist.apache.org/repos/dist/dev/polaris/1.7.0 > > > > > > Helm charts are available on: > > > > > > * https://dist.apache.org/repos/dist/dev/polaris/helm-chart/1.7.0 > > > > > > NB: you have to build the Docker images locally in order to test Helm > > charts. > > > > > > The Python CLI wheel is available on: > > > > > > * > https://dist.apache.org/repos/dist/dev/polaris/python-client/1.7.0 > > > > > > The Python CLI is also available on Test PyPI: > > > > > > * https://test.pypi.org/project/apache-polaris/1.7.0rc1/ > > > > > > You can find the KEYS file here: > > > > > > * https://downloads.apache.org/polaris/KEYS > > > > > > Convenience binary artifacts are staged on Nexus. The Maven repository > > URL is: > > > > > > * > > > https://repository.apache.org/content/repositories/orgapachepolaris-1071/ > > > > > > Please download, verify, and test according to the release > > > verification guide, which can be found at: > > > > > > * > > > https://polaris.apache.org/community/release-guides/release-verification-guide/ > > > > > > Please vote in the next 72 hours. > > > > > > [ ] +1 Release this as Apache Polaris 1.7.0 > > > [ ] +0 > > > [ ] -1 Do not release this because... > > > > > > Only PMC members have binding votes, but other community members are > > > encouraged to cast non-binding votes. > > > This vote will pass if there are 3 binding +1 votes and more binding > > > +1 votes than -1 votes. > > > > > > Regards > > > JB > > >
