I can do the “dual location improvement” (not fix) on main for 1.8.0 release if you want.
Certainly not a blocker anyway. Le jeu. 30 juil. 2026 à 22:31, Jean-Baptiste Onofré <[email protected]> a écrit : > And by the way there’s reason why projects use the root folder: when you > shade you can keep the the original license/notice. > > So I don’t understand why you are worried about that now (maybe AI helped > to verify the artifacts but AI tools are not always right ;)): > 1. I did this since 1.0.0 and it has been validated during incubation > period. > 2. This is correct and valid (used in several projects). > > Regards > JB > > > > Le jeu. 30 juil. 2026 à 19:48, Yufei Gu <[email protected]> a écrit : > >> I validated Apache Polaris 1.7.0 rc1 on Darwin arm64 with Java 21.0.9. >> >> All provenance, cryptographic, build, test, and runtime checks passed: >> >> - Tag apache-polaris-1.7.0-rc1 resolves >> to: 4ac2f059d1cce149453d0a5f1ff1dff980ec97cc >> - The signed source matches that commit across 2,466 files, eight >> symlinks, >> and 54 executable modes. >> - All distribution, Helm, Python, and 429 primary Maven JAR/POM/module >> signatures and SHA-512 checksums are valid. >> - Signing fingerprint: F2EEEB06110BEE1397EC74CBB8960FF52D9B1312 >> - The repository release verifier passed. >> - ./gradlew check -PnoIntegrationTests passed with 25,548 tests, 70 >> skipped, and zero failures or errors. >> - All 164 Python client tests passed. >> - The ASF-dist and TestPyPI wheels rebuilt byte-for-byte from the signed >> source. >> - The binary server started as Polaris 1.7.0, reported health UP, and >> returned HTTP 401 for an unauthenticated catalog request. >> >> Inspection of all 269 staged Maven JARs, Rc1 fixes all 32 test-fixture >> classifier omissions and all nine non-bundle Spark omissions from rc0. >> However, three still lack META-INF/LICENSE and META-INF/NOTICE: >> >> - polaris-spark-3.5_2.12-1.7.0-bundle.jar >> - polaris-spark-3.5_2.13-1.7.0-bundle.jar >> - polaris-spark-4.0_2.13-1.7.0-bundle.jar >> >> Each contains LICENSE and NOTICE only at the archive root. Their contents >> exactly match the corresponding BUNDLE-LICENSE and BUNDLE-NOTICE files in >> the signed source, so the remaining problem is their location. >> >> ASF release policy requires licensing materials in the distribution >> format’s customary location, and its release FAQ specifically states that >> distributed JARs must place LICENSE and NOTICE under META-INF: >> >> https://www.apache.org/legal/release-policy.html#licensing-documentation >> >> The way we place LICENSE and NOTICE has been like that since the very >> beginning (release 1.0.0). Maybe we should fix them per ASF policy. WDYT? >> >> Thanks, >> Yufei >> >> >> On Thu, Jul 30, 2026 at 8:10 AM Alexandre Dutra <[email protected]> >> wrote: >> >> > +1 >> > >> > - Automated checks (verify-release.sh) OK >> > - Git tag, checksums and GPG signatures OK >> > - NOTICE and LICENSE files OK >> > - Smoke test binary distribution OK >> > - Smoke test source distribution OK >> > - Smoke test Helm chart OK >> > >> > Thanks, >> > Alex >> > >> > On Thu, Jul 30, 2026 at 7:12 AM Jean-Baptiste Onofré <[email protected]> >> > wrote: >> > > >> > > Hi everyone, >> > > >> > > I propose that we release the following RC as the official Apache >> > > Polaris 1.7.0 release. >> > > >> > > This corresponds to the tag: apache-polaris-1.7.0-rc1 >> > > >> > > * >> https://github.com/apache/polaris/commits/apache-polaris-1.7.0-rc1 >> > > * >> > >> https://github.com/apache/polaris/tree/4ac2f059d1cce149453d0a5f1ff1dff980ec97cc >> > > >> > > The release tarball, signature, and checksums are here: >> > > >> > > * https://dist.apache.org/repos/dist/dev/polaris/1.7.0 >> > > >> > > Helm charts are available on: >> > > >> > > * https://dist.apache.org/repos/dist/dev/polaris/helm-chart/1.7.0 >> > > >> > > NB: you have to build the Docker images locally in order to test Helm >> > charts. >> > > >> > > The Python CLI wheel is available on: >> > > >> > > * >> https://dist.apache.org/repos/dist/dev/polaris/python-client/1.7.0 >> > > >> > > The Python CLI is also available on Test PyPI: >> > > >> > > * https://test.pypi.org/project/apache-polaris/1.7.0rc1/ >> > > >> > > You can find the KEYS file here: >> > > >> > > * https://downloads.apache.org/polaris/KEYS >> > > >> > > Convenience binary artifacts are staged on Nexus. The Maven repository >> > URL is: >> > > >> > > * >> > >> https://repository.apache.org/content/repositories/orgapachepolaris-1071/ >> > > >> > > Please download, verify, and test according to the release >> > > verification guide, which can be found at: >> > > >> > > * >> > >> https://polaris.apache.org/community/release-guides/release-verification-guide/ >> > > >> > > Please vote in the next 72 hours. >> > > >> > > [ ] +1 Release this as Apache Polaris 1.7.0 >> > > [ ] +0 >> > > [ ] -1 Do not release this because... >> > > >> > > Only PMC members have binding votes, but other community members are >> > > encouraged to cast non-binding votes. >> > > This vote will pass if there are 3 binding +1 votes and more binding >> > > +1 votes than -1 votes. >> > > >> > > Regards >> > > JB >> > >> >
