Thanks for the context, Russel and JB! Each package MUST provide a LICENSE file and a NOTICE file which account > for the package's exact content. LICENSE and NOTICE MUST NOT provide > information about materials which are not bundled in the package, such as > separately downloaded dependencies.
For source packages, LICENSE and NOTICE MUST be located at the root of the > distribution. For additional packages, they MUST be located in the > distribution format's customary location for licensing materials, such as > the META-INF directory of Java "jar" files. I double-checked the ASF policy; it looks like putting them at the root for the source package is OK, while the META-INF directory may be the preferred location for jar files. The language here isn't very clear to me though. I'd rather trust you and follow what other ASF projects. +1 on RC1 then. Yufei On Thu, Jul 30, 2026 at 1:33 PM Jean-Baptiste Onofré <[email protected]> wrote: > I can do the “dual location improvement” (not fix) on main for 1.8.0 > release if you want. > > Certainly not a blocker anyway. > > Le jeu. 30 juil. 2026 à 22:31, Jean-Baptiste Onofré <[email protected]> a > écrit : > > > And by the way there’s reason why projects use the root folder: when you > > shade you can keep the the original license/notice. > > > > So I don’t understand why you are worried about that now (maybe AI helped > > to verify the artifacts but AI tools are not always right ;)): > > 1. I did this since 1.0.0 and it has been validated during incubation > > period. > > 2. This is correct and valid (used in several projects). > > > > Regards > > JB > > > > > > > > Le jeu. 30 juil. 2026 à 19:48, Yufei Gu <[email protected]> a écrit : > > > >> I validated Apache Polaris 1.7.0 rc1 on Darwin arm64 with Java 21.0.9. > >> > >> All provenance, cryptographic, build, test, and runtime checks passed: > >> > >> - Tag apache-polaris-1.7.0-rc1 resolves > >> to: 4ac2f059d1cce149453d0a5f1ff1dff980ec97cc > >> - The signed source matches that commit across 2,466 files, eight > >> symlinks, > >> and 54 executable modes. > >> - All distribution, Helm, Python, and 429 primary Maven JAR/POM/module > >> signatures and SHA-512 checksums are valid. > >> - Signing fingerprint: F2EEEB06110BEE1397EC74CBB8960FF52D9B1312 > >> - The repository release verifier passed. > >> - ./gradlew check -PnoIntegrationTests passed with 25,548 tests, 70 > >> skipped, and zero failures or errors. > >> - All 164 Python client tests passed. > >> - The ASF-dist and TestPyPI wheels rebuilt byte-for-byte from the signed > >> source. > >> - The binary server started as Polaris 1.7.0, reported health UP, and > >> returned HTTP 401 for an unauthenticated catalog request. > >> > >> Inspection of all 269 staged Maven JARs, Rc1 fixes all 32 test-fixture > >> classifier omissions and all nine non-bundle Spark omissions from rc0. > >> However, three still lack META-INF/LICENSE and META-INF/NOTICE: > >> > >> - polaris-spark-3.5_2.12-1.7.0-bundle.jar > >> - polaris-spark-3.5_2.13-1.7.0-bundle.jar > >> - polaris-spark-4.0_2.13-1.7.0-bundle.jar > >> > >> Each contains LICENSE and NOTICE only at the archive root. Their > contents > >> exactly match the corresponding BUNDLE-LICENSE and BUNDLE-NOTICE files > in > >> the signed source, so the remaining problem is their location. > >> > >> ASF release policy requires licensing materials in the distribution > >> format’s customary location, and its release FAQ specifically states > that > >> distributed JARs must place LICENSE and NOTICE under META-INF: > >> > >> > https://www.apache.org/legal/release-policy.html#licensing-documentation > >> > >> The way we place LICENSE and NOTICE has been like that since the very > >> beginning (release 1.0.0). Maybe we should fix them per ASF policy. > WDYT? > >> > >> Thanks, > >> Yufei > >> > >> > >> On Thu, Jul 30, 2026 at 8:10 AM Alexandre Dutra <[email protected]> > >> wrote: > >> > >> > +1 > >> > > >> > - Automated checks (verify-release.sh) OK > >> > - Git tag, checksums and GPG signatures OK > >> > - NOTICE and LICENSE files OK > >> > - Smoke test binary distribution OK > >> > - Smoke test source distribution OK > >> > - Smoke test Helm chart OK > >> > > >> > Thanks, > >> > Alex > >> > > >> > On Thu, Jul 30, 2026 at 7:12 AM Jean-Baptiste Onofré <[email protected] > > > >> > wrote: > >> > > > >> > > Hi everyone, > >> > > > >> > > I propose that we release the following RC as the official Apache > >> > > Polaris 1.7.0 release. > >> > > > >> > > This corresponds to the tag: apache-polaris-1.7.0-rc1 > >> > > > >> > > * > >> https://github.com/apache/polaris/commits/apache-polaris-1.7.0-rc1 > >> > > * > >> > > >> > https://github.com/apache/polaris/tree/4ac2f059d1cce149453d0a5f1ff1dff980ec97cc > >> > > > >> > > The release tarball, signature, and checksums are here: > >> > > > >> > > * https://dist.apache.org/repos/dist/dev/polaris/1.7.0 > >> > > > >> > > Helm charts are available on: > >> > > > >> > > * > https://dist.apache.org/repos/dist/dev/polaris/helm-chart/1.7.0 > >> > > > >> > > NB: you have to build the Docker images locally in order to test > Helm > >> > charts. > >> > > > >> > > The Python CLI wheel is available on: > >> > > > >> > > * > >> https://dist.apache.org/repos/dist/dev/polaris/python-client/1.7.0 > >> > > > >> > > The Python CLI is also available on Test PyPI: > >> > > > >> > > * https://test.pypi.org/project/apache-polaris/1.7.0rc1/ > >> > > > >> > > You can find the KEYS file here: > >> > > > >> > > * https://downloads.apache.org/polaris/KEYS > >> > > > >> > > Convenience binary artifacts are staged on Nexus. The Maven > repository > >> > URL is: > >> > > > >> > > * > >> > > >> > https://repository.apache.org/content/repositories/orgapachepolaris-1071/ > >> > > > >> > > Please download, verify, and test according to the release > >> > > verification guide, which can be found at: > >> > > > >> > > * > >> > > >> > https://polaris.apache.org/community/release-guides/release-verification-guide/ > >> > > > >> > > Please vote in the next 72 hours. > >> > > > >> > > [ ] +1 Release this as Apache Polaris 1.7.0 > >> > > [ ] +0 > >> > > [ ] -1 Do not release this because... > >> > > > >> > > Only PMC members have binding votes, but other community members are > >> > > encouraged to cast non-binding votes. > >> > > This vote will pass if there are 3 binding +1 votes and more binding > >> > > +1 votes than -1 votes. > >> > > > >> > > Regards > >> > > JB > >> > > >> > > >
