Hi Avro team,

We noticed that the 1.12.1 release on the official download site is missing GPG 
signature (.asc) and checksum (.sha512) files for all artifacts.

Affected location: https://downloads.apache.org/avro/avro-1.12.1/

What's missing:
  - Top-level: avro-src-1.12.1.tar.gz.asc, avro-src-1.12.1.tar.gz.sha512, 
avro-doc-1.12.1.tar.gz.asc, avro-doc-1.12.1.tar.gz.sha512
  - Language subdirectories (java/, py/, etc.): all .asc and .sha512 files are 
absent

For comparison, the 1.12.0 release at 
https://downloads.apache.org/avro/avro-1.12.0/ has the correct .asc and .sha512 
files for every artifact.

Per the Apache Release Policy 
(https://www.apache.org/legal/release-policy.html), all official releases must 
be accompanied by cryptographic signatures. Could the release manager upload 
the missing signature and checksum files?

Thanks,
Jun and Johan



SLB-Private

Reply via email to