+1 I checked:
- Signatures on all four archives verify with key 36878574 1958DE96 98FFDF4E 8FEC6F9C BA59703C from KEYS (RSA 4096, no SHA-1 digests) - SHA-512 and SHA-256 checksums match, and LICENSE and NOTICE are in every archive - No compiled files in the source archives, and the source tar.gz matches the roller-6.1.7-rc4 tag (69d0d5ee) - Built from source with the full test suite: 464 tests, 0 failures (JDK 21, Maven 3.9.8) - The binary roller.war has the same jars, JSPs and resources as my source build and records the tag commit - Ran it in Jetty with Derby and ran master's Playwright suite against it (setup token, register, create weblog, publish, media upload, OPML import, authoring dialogs, XML-RPC and AtomPub). All tests passed after updating four selectors for the 6.1.x UI. - Clicked through all five bundled themes, comments, search, feeds, and the blogroll and weblog description escaping fixes One pre-existing issue worth a follow-up: if the admin's session is lost after the setup token is accepted but before the first user registers, the token can't be reused and a restart is needed to get a new one. Matt > On Oct 30, 2026, at 15:22, Dave <[email protected]> wrote: > > Please review and vote on Apache Roller 6.1.7, release candidate 4. > > Source and convenience binary artifacts: > https://dist.apache.org/repos/dist/dev/roller/roller-6.1/v6.1.7/ (r88934) > > Source tag: roller-6.1.7-rc4, commit > 69d0d5eefd8e6ffcdb3630f0c8affb9453c308ba > https://github.com/apache/roller/tree/roller-6.1.7-rc4 > > KEYS: https://downloads.apache.org/roller/KEYS > Signing fingerprint: 3687 8574 1958 DE96 98FF DF4E 8FEC 6F9C BA59 703C > > Release notes: > https://github.com/apache/roller/blob/roller-6.1.7-rc4/CHANGES.md > Please read "Behaviour changes worth reading before upgrading" before you > upgrade a live site. > > To check signatures, checksums, LICENSE/NOTICE and the source build, you > can use the script on master: > https://github.com/apache/roller/blob/master/skills/roller-release/scripts/check-release.sh > (check-release.sh <download-dir> --build). Do not use the copy in the RC4 > source archive. On large archives it can wrongly report that LICENSE and > NOTICE are missing. > > The vote stays open for at least 72 hours, until at least Tuesday, November > 3, 2026, 12:00 UTC. > > [ ] +1 Release this candidate > [ ] +0 No opinion > [ ] -1 Do not release, because ... > > Dave Johnson
