Hi sebb, Thank you for the feedback.
I understand that the KEYS file should be maintained only in the release directory going forward, and that it should be moving from the dev area to the release area once the release is approved. I will ensure that: - After the release vote passes, the KEYS file is moved from https://dist.apache.org/repos/dist/dev/incubator/geaflow/KEYS to https://dist.apache.org/repos/dist/release/incubator/geaflow/KEYS - The KEYS file in the release directory will be the canonical and maintained version thereafter, and no longer kept in sync with the dev tree to avoid divergence. - Any keys used to sign past or current releases will be retained indefinitely, as required for verifying archived releases. Thanks again for the guidance! sebb <[email protected]> 于2025年10月29日周三 01:55写道： > I just created > https://dist.apache.org/repos/dist/release/incubator/geaflow/ > which will be required to publish the release once it has been > approved. > > Note that the KEYS file should be referenced from > > https://downloads.apache.org/incubator/geaflow/KEYS > > This can be created by moving the file from > > https://dist.apache.org/repos/dist/dev/incubator/geaflow/KEYS > to > https://dist.apache.org/repos/dist/release/incubator/geaflow/KEYS > > The KEYS file should be maintained in > https://dist.apache.org/repos/dist/release/incubator/geaflow/KEYS > going forward. > If it is also present in the dev tree it is all too easy for the files > to get out of step. > Remember that keys that have been used to sign a release should never > be removed from the KEYS file, otherwise archived releases cannot be > checked. > > On Tue, 28 Oct 2025 at 10:26, Ed Espino <[email protected]> wrote: > > > > Apache GeaFlow 0.7.0-incubating RC1 - Vote Report > > ================================================== > > > > Vote: -1 (binding) > > > > > > CRITICAL ISSUES > > =============== > > > > 1. Missing Required Files > > -------------------------- > > - NOTICE file: MISSING (required per Apache policy) > > - DISCLAIMER file: MISSING (required for incubator releases) > > > > Reference: https://incubator.apache.org/policy/incubation.html > > > > > > 2. Incubator Naming Violations > > ------------------------------- > > Per the Incubator Release Checklist: > > > https://cwiki.apache.org/confluence/display/INCUBATOR/Incubator+Release+Checklist > > > > - Artifact naming: apache-geaflow-0.7.0-src.tar.gz > > MUST be: apache-geaflow-0.7.0-incubating-src.tar.gz > > > > - Directory naming: apache-geaflow-0.7.0-src/ > > MUST be: apache-geaflow-0.7.0-incubating-src/ > > > > - Built artifacts: All JARs lack "incubating" in filenames > > Example: geaflow-assembly-0.7.0.jar > > Note: JAR naming is "suggested but optional" per policy, but > recommended > > for consistency > > > > > > 3. License Header Compliance > > ----------------------------- > > Apache RAT identified 194 files without Apache license headers, > including: > > - Documentation files (.md, .rst) > > - Frontend assets (JavaScript, CSS) > > - Configuration files (.yaml, .proto) > > > > RAT report can be reproduced with: mvn apache-rat:check > > > > > > VERIFIED SUCCESSFULLY > > ===================== > > > > [X] GPG signatures valid (all 2 artifacts) > > [X] SHA512 checksums valid (all 2 artifacts) > > [X] LICENSE file present (Apache License 2.0) > > [X] Source builds successfully (10-20 min build time) > > [X] Functional testing passed (GQL loop detection demo) > > > > > > RECOMMENDATION > > ============== > > > > The release must be rejected due to 4 critical Apache Incubator policy > > violations. While the source code quality is verified (builds and runs > > correctly), the release artifacts do not meet incubator requirements. > > > > The Release Manager should: > > 1. Add NOTICE and DISCLAIMER files > > 2. Re-cut artifacts with "incubating" in names > > 3. Review RAT findings and add license headers or exclusions where > > appropriate > > 4. Submit RC2 for vote > > > > -- > > Ed Espino > > Apache Cloudberry (Incubating) & MADlib > > > > > > On Mon, Oct 27, 2025 at 11:44 PM Qiang Zhou <[email protected]> wrote: > > > > > * We apologize for resending this message due to the format issues. The > > > last email sent is invalid. * > > > > > > Hi everyone, > > > > > > The Apache GeaFlow community has voted and approved the release of > Apache > > > GeaFlow v0.7.0-rc1 (Incubating). We are now kindly requesting the IPMC > > > members to review and vote for this release. > > > > > > Apache GeaFlow community vote thread: > > > > > > - https://lists.apache.org/thread/ryw8xwlgtc920xrk9y90gmffwmrrsq06 > > > > > > Vote result thread: > > > > > > - https://lists.apache.org/thread/b3rz8hmhtqdncjhs5m3qylg1ypmkpxr8 > > > > > > This corresponds to the tag: v0.7.0-rc1. > > > > > > - https://github.com/apache/geaflow/commits/v0.7.0-rc1 > > > - > > > > > > > https://github.com/apache/geaflow/tree/8c1c52b307dec5d3f82481e3000c72e698b97fc7 > > > > > > The release zip package, signature, and checksum are here: > > > > > > - https://dist.apache.org/repos/dist/dev/incubator/geaflow/v0.7.0-rc1/ > > > <https://dist.apache.org/repos/dist/dev/incubator/geaflow/v0.7.0-rc1/> > > > > > > You can find the KEYS file here: > > > > > > - https://dist.apache.org/repos/dist/dev/incubator/geaflow/KEYS > > > <https://dist.apache.org/repos/dist/dev/incubator/geaflow/KEYS> > > > > > > The Maven staging repository: > > > > > > - > > > > https://repository.apache.org/content/repositories/orgapachegeaflow-1007 > > > > > > Please download, verify and test. > > > > > > The vote is open for at least 72 hours. > > > > > > [ ] +1 approve > > > [ ] +0 no opinion > > > [ ] -1 disapprove with the reason > > > > > > To learn more about Apache GeaFlow, please see > https://geaflow.apache.org/ > > > . > > > > > > Kind Regards, > > > loogn > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
