Verifying a Release Candidate

Guide for anyone participating in the release vote, based on ASF Release Policy.

Validating Distributions

The release vote email includes links to:

Download the archive (.tgz), .asc, and .sha512 from the RC directory (e.g. paimon-mosaic-${RELEASE_VERSION}-rc${RC_NUM}/) and the KEYS file.

Verifying Signatures

Import the keys into your local keyring:

curl https://downloads.apache.org/paimon/KEYS -o KEYS
gpg --import KEYS

Verify the .asc file:

gpg --verify apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz.asc \
             apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz

If verification succeeds, you will see:

gpg: Signature made ...
gpg: using RSA key ...
gpg: Good signature from "Release Manager Name (CODE SIGNING KEY) <...@apache.org>"

Verifying Checksums

On macOS (shasum):

shasum -a 512 -c apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz.sha512

On Linux (sha512sum):

sha512sum -c apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz.sha512

If successful:

apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz: OK

Verifying Build

Extract the source release and verify it builds. You need Rust (stable toolchain).

tar -xzf apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz
cd paimon-mosaic-${RELEASE_VERSION}

Rust

Build and test all workspace crates:

cargo build --workspace --release
cargo test --workspace

Java

Build the Java binding (requires JDK 8+ and Maven):

cargo build --release -p paimon-mosaic-jni

Copy the built native library into the resource directory for the platform being verified. Run only the snippet for your current platform.

Linux x86_64:

mkdir -p java/src/main/resources/native/linux/x86_64
cp target/release/libpaimon_mosaic_jni.so \
  java/src/main/resources/native/linux/x86_64/

Linux aarch64:

mkdir -p java/src/main/resources/native/linux/aarch64
cp target/release/libpaimon_mosaic_jni.so \
  java/src/main/resources/native/linux/aarch64/

macOS aarch64:

mkdir -p java/src/main/resources/native/macos/aarch64
cp target/release/libpaimon_mosaic_jni.dylib \
  java/src/main/resources/native/macos/aarch64/

Windows x86_64:

mkdir -p java/src/main/resources/native/windows/x86_64
cp target/release/paimon_mosaic_jni.dll \
  java/src/main/resources/native/windows/x86_64/
cd java
mvn clean package

Python

Build and test the Python binding (requires Python 3.9+):

cargo build --release -p paimon-mosaic-ffi
cp target/release/libpaimon_mosaic_ffi.* python/mosaic/
cd python
pip install -e .
python -c "import mosaic"

C++

Build the C++ tests (requires CMake):

cargo build --release -p paimon-mosaic-ffi
cd cpp
mkdir build && cd build
cmake ..
make

Verifying LICENSE and NOTICE

Verify that:

  1. The LICENSE and NOTICE files exist in the root directory and are correct.
  2. All source files have ASF license headers.
  3. All dependencies have licenses compatible with ASL 2.0 (ASF third-party license policy).
  4. No unexpected files are included (.git, .github, .asf.yaml, .gitignore, .idea, target/ should all be excluded).

Testing Published Artifacts

Rust (crates.io)

RC tags do not publish to crates.io (dry-run only). You can test the Rust crate from the source tarball or via git tag dependency:

[dependencies]
paimon-mosaic-core = { git = "https://github.com/apache/paimon-mosaic", tag = "v${RELEASE_VERSION}-rc${RC_NUM}" }

Java (Apache Nexus Staging)

The RC tag deploys to Apache Nexus staging. To test:

  1. Find the staging repository at repository.apache.org.
  2. Add the staging repository URL to your pom.xml: 
    <repositories>
  <repository>
    <id>apache-staging</id>
    <url>https://repository.apache.org/content/repositories/orgapachepaimon-XXXX/</url>
  </repository>
</repositories>
  3. Add the dependency: 
    <dependency>
  <groupId>org.apache.paimon</groupId>
  <artifactId>mosaic</artifactId>
  <version>${RELEASE_VERSION}</version>
</dependency>
  4. Verify the JAR contains native libraries for all 4 platforms:
    • native/linux/x86_64/libpaimon_mosaic_jni.so
    • native/linux/aarch64/libpaimon_mosaic_jni.so
    • native/macos/aarch64/libpaimon_mosaic_jni.dylib
    • native/windows/x86_64/paimon_mosaic_jni.dll

Python (TestPyPI)

The RC tag publishes wheels to TestPyPI after the Rust and Java release jobs succeed. Install and verify:

pip install -i https://test.pypi.org/simple/ paimon-mosaic==${RELEASE_VERSION}rc${RC_NUM}
python -c "import mosaic; print('OK')"

Verify wheels are available for: Linux x86_64, Linux aarch64, macOS aarch64, Windows x86_64.

Voting

Votes are cast by replying to the vote email on the dev mailing list with +1, 0, or -1.

State whether your vote is binding or non-binding. Only PMC members have formally binding votes. See Apache Foundation Voting.

Include a short list of what you verified. This helps the community see what has been checked.

Checklist you can reference in your vote: