Hi Xiao, Thanks for flagging this. I added my signing key to dev/spark/KEYS <https://dist.apache.org/repos/dist/dev/spark/KEYS>, following the release instructions <https://spark.apache.org/release-process.html#update-keys-file-with-your-code-signing-key>. The documented process copies KEYS to the release directory only after the vote passes. (and I think only PMC have privilege to edit it directly).
The vote email links to the published copy, which doesn’t yet include my key. Could you retry RC3 signature verification using the development KEYS file above? A PMC member could also update the published copy before finalization. Thanks Szehon On Mon, Oct 26, 2026 at 1:41 PM Xiao Li <[email protected]> wrote: > -1 (binding), for now. > > All RC3 signatures identify signing key: > > 9442 A261 0B63 B3F6 1860 285F 43F1 222E 5362 CCF5 > Szehon Ho <[email protected]> > > However, this key is absent from the Spark KEYS file linked in the vote: > https://downloads.apache.org/spark/KEYS > > Consequently, verification using only the advertised keyring fails with > "No public key". After independently retrieving that key, the source > signature validates, but that is not equivalent to the project's > canonical trust path. > > Please add the signing key to Spark KEYS. I can then reverify and change > my vote to +1. > > Other checks passed: > - Source SHA-512 > - Source matches v4.2.1-rc3 / 617618396087 > - No compiled binaries or unsafe archive paths > - Apache RAT > - SBT package build with JDK 17, Hive and Hive Thrift Server profiles > - VersionUtilsSuite: 5/5 tests > - Published documentation reports Spark 4.2.1 > > Xiao > > Wenchen Fan <[email protected]> 于2026年10月26日周一 12:55写道： > >> +1 >> >> On Fri, Oct 23, 2026 at 2:01 PM Uroš Bojanić <[email protected]> wrote: >> >>> +1 (non-binding) >>> >>> Verified Apache Spark 4.2.1 RC3 (tag v4.2.1-rc3, commit 61761839608): >>> >>> - Good GPG signatures and SHA512 sums on all artifacts (source, three >>> binaries, the PySpark/SparkR tarballs). >>> - Source tarball matches the tag (no jars/classes), and RELEASE in all >>> three binaries records the same commit. >>> - Built the source tarball with -Phive -Phive-thriftserver on JDK 17, >>> got a clean build across all 39 modules. >>> - Re-ran the test suites for the RC2 fixes (SPARK-60023, SPARK-60109, >>> etc.), all tests pass, including new ones. >>> - Ra smoke tests on JDK 17 and 21: Java, Scala, SQL, PySpark and Spark >>> Connect (Scala client), all look good. >>> - Sanity-checked the binary dist (RELEASE, LICENSE/NOTICE/licenses all >>> present), ran dev/check-license, RAT passes. >>> - Checked the docs: site and API docs are up for 4.2.1, and the changes >>> since 4.2.0 map to commits in this release. >>> >>> Thank you Szehon! >>> >>> On 2026-10-21 21:29 UTC [email protected] wrote: >>> > Please vote on releasing the following candidate as Apache Spark >>> version 4.2.1. >>> > >>> > The vote is open until Sat, 24 Oct 2026 15:29:43 PDT and passes if a >>> majority +1 PMC votes are cast, with >>> > a minimum of 3 +1 votes. >>> > >>> > [ ] +1 Release this package as Apache Spark 4.2.1 >>> > [ ] -1 Do not release this package because ... >>> > >>> > To learn more about Apache Spark, please see https://spark.apache.org/ >>> > >>> > The tag to be voted on is v4.2.1-rc3 (commit 61761839608): >>> > https://github.com/apache/spark/tree/v4.2.1-rc3 >>> > >>> > The release files, including signatures, digests, etc. can be found at: >>> > https://dist.apache.org/repos/dist/dev/spark/v4.2.1-rc3-bin/ >>> > >>> > Signatures used for Spark RCs can be found in this file: >>> > https://downloads.apache.org/spark/KEYS >>> > >>> > The staging repository for this release can be found at: >>> > >>> https://repository.apache.org/content/repositories/orgapachespark-1540/ >>> > >>> > The documentation corresponding to this release can be found at: >>> > https://dist.apache.org/repos/dist/dev/spark/v4.2.1-rc3-docs/ >>> > >>> > The list of bug fixes going into 4.2.1 can be found at the following >>> URL: >>> > https://issues.apache.org/jira/projects/SPARK/versions/12357191 >>> > >>> > FAQ >>> > >>> > ========================= >>> > How can I help test this release? >>> > ========================= >>> > >>> > If you are a Spark user, you can help us test this release by taking >>> > an existing Spark workload and running on this release candidate, then >>> > reporting any regressions. >>> > >>> > If you're working in PySpark you can set up a virtual env and install >>> > the current RC via "pip install >>> https://dist.apache.org/repos/dist/dev/spark/v4.2.1-rc3-bin/pyspark-4.2.1.tar.gz >>> " >>> > and see if anything important breaks. >>> > In the Java/Scala, you can add the staging repository to your >>> project's resolvers and test >>> > with the RC (make sure to clean up the artifact cache before/after so >>> > you don't end up building with an out of date RC going forward). >>> > >>> > --------------------------------------------------------------------- >>> > To unsubscribe e-mail: [email protected] >>> > >>> > >>> >>> --------------------------------------------------------------------- >>> To unsubscribe e-mail: [email protected] >>> >>>
