Hi Tison, Thank you for the detailed review.
We acknowledge the binding -1 and will cancel the RC1 vote. We will prepare a new release candidate after addressing all the reported issues: 1. Sign the artifacts with a key whose primary UID uses an @apache.org email address. 2. Regenerate the SHA-512 file with LF line endings and verify it on macOS. 3. Apply the DISCLAIMER and NOTICE fixes. 4. Replace the legacy source headers with the standard ASF license header and run a complete license-header check. We will restart the podling vote with RC2 after the fixes and verification are complete. Thanks again, Yanrui Zhang ________________________________ 发件人: Zili Chen <[email protected]> 发送时间: 2026年7月22日 20:22 收件人: [email protected] <[email protected]> 主题: Re: [VOTE] Release Apache Casbin 3.11.0-incubating RC1 -1 (binding) I found the following issues: 1. The artifacts should be signed with an apache.org email. Currently, it is signed with: apache-casbin-3.11.0-incubating-src.tar.gz gpg: Signature made Thu Jul 2 00:05:33 2026 CST gpg: using EDDSA key D1FDB0BA62C6E0FB005131F30A243CC4CB3E06F4 gpg: Good signature from "Yang Luo <[email protected]>" [unknown] D1FDB0BA62C6E0FB005131F30A243CC4CB3E06F4 2. The checksum file contains "\r\n" trailing newline, which cause (on macOS): $ shasum -c apache-casbin-3.11.0-incubating-src.tar.gz.sha512 : No such file or directory0-incubating-src.tar.gz : FAILED open or readincubating-src.tar.gz shasum: WARNING: 1 listed file could not be read 3. The DISCLAIMER and NOTICE can be improved, see [1]. [1] https://github.com/apache/casbin/pull/1741 4. I found most files have license header: // Copyright 2017 The casbin Authors. All Rights Reserved. // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. Since the SGA and IP clearance are done for Casbin, you'd prefer to change all these license headers as: // Licensed to the Apache Software Foundation (ASF) under one // or more contributor license agreements. See the NOTICE file // distributed with this work for additional information // regarding copyright ownership. The ASF licenses this file // to you under the Apache License, Version 2.0 (the // "License"); you may not use this file except in compliance // with the License. You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, // software distributed under the License is distributed on an // "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY // KIND, either express or implied. See the License for the // specific language governing permissions and limitations // under the License. Other parts generally look good. Best, tison. On 2026/07/17 14:13:48 Yanrui Zhang wrote: > Hello Incubator Community, > > > The Apache Casbin community has voted and approved the release of Apache > Casbin (Incubating) 3.11.0-incubating RC1. We are now requesting IPMC > members to review and vote on this release. > > Casbin community vote thread: > https://lists.apache.org/thread/8qdrgy59hdtwmt5rc1z4ox3q22wxx0kt Casbin > community vote result thread: > https://lists.apache.org/thread/fx2625oxdjbp3dg7r2lj01t7v1md9gx6 The > release candidate: > https://dist.apache.org/repos/dist/dev/incubator/casbin/3.11.0-incubating-rc1/ > Release artifacts: - apache-casbin-3.11.0-incubating-src.tar.gz - > apache-casbin-3.11.0-incubating-src.tar.gz.asc - > apache-casbin-3.11.0-incubating-src.tar.gz.sha512 Git commit hash: > 95656679eac1caad13179bd209bbc87a2e8e6002 Git commit: > https://github.com/apache/casbin/commit/95656679eac1caad13179bd209bbc87a2e8e6002 > The source artifact is signed with the following GPG key: > D1FDB0BA62C6E0FB005131F30A243CC4CB3E06F4 The public KEYS file: > https://downloads.apache.org/incubator/casbin/KEYS The source release has > been verified with: - SHA-512 checksum verification - GPG signature > verification - Source archive content check, including LICENSE, NOTICE, > DISCLAIMER, go.mod, and go.sum - go test ./... More details about the > Incubator release checklist: > https://cwiki.apache.org/confluence/display/INCUBATOR/Incubator+Release+Checklist > Steps to verify the release: https://www.apache.org/info/verification.html > The vote will remain open for at least 72 hours and requires at least three > binding +1 votes from IPMC members to pass. Please vote accordingly: [ ] +1 > approve [ ] +0 no opinion [ ] -1 disapprove (please provide a reason) > Thanks, Yanrui Zhang > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
