You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@paimon.apache.org by "XiaoHongbo-Hope (via GitHub)" <gi...@apache.org> on 2026/07/20 08:30:36 UTC

[PR] build: harden release artifact licensing [paimon-rust]

XiaoHongbo-Hope opened a new pull request, #554:
URL: https://github.com/apache/paimon-rust/pull/554

   ## Summary
   
   - Commit `Cargo.lock`, use locked builds, and pin release tooling.
   - Generate reproducible dependency inventories and target-specific third-party license reports.
   - Package and byte-verify LICENSE, NOTICE, and third-party reports in Rust crates, Python archives, and Go release assets.
   - Verify Linux wheel OpenSSL libraries, native formats, architectures, versions, and legal metadata.
   - Harden Rust publishing with MSRV checks, package-content checks, tag/version validation, ordered publishing, and safe reruns.
   
   ## Background
   
   This applies the release-vote fixes from apache/paimon-full-text#17 and apache/paimon-full-text#22. Paimon Rust had the same artifact-exact legal metadata and Windows line-ending risks, plus several repository-specific gaps:
   
   - `Cargo.lock` was ignored.
   - Published Rust crates omitted test helpers and fixtures needed by packaged tests.
   - Go native assets had no matching legal sidecars.
   - Linux wheels bundled OpenSSL 1.1 shared libraries without explicit license coverage.
   
   ## Verification
   
   - `cargo deny --locked --all-features check licenses`
   - `python3.11 scripts/dependencies.py verify`
   - `python3.11 scripts/release_licenses.py --check`
   - `rustup run 1.91.0 cargo check --locked --workspace --all-targets --all-features`
   - `cargo publish --locked -p paimon -p paimon-datafusion --all-features --dry-run`
   - Rust crate package inventory checks
   - Python five-wheel and sdist verifier tests, including OpenSSL negative cases
   - Go native artifact positive and negative verifier tests
   - `cargo fmt`, Ruff, Python byte compilation, YAML parsing, and actionlint
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] build: harden release artifact licensing [paimon-rust]

Posted by "XiaoHongbo-Hope (via GitHub)" <gi...@apache.org>.
XiaoHongbo-Hope commented on PR #554:
URL: https://github.com/apache/paimon-rust/pull/554#issuecomment-5022517972

   Rust crate packaging and ordered publishing are now isolated in #562.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] build: harden release artifact licensing [paimon-rust]

Posted by "XiaoHongbo-Hope (via GitHub)" <gi...@apache.org>.
XiaoHongbo-Hope closed pull request #554: build: harden release artifact licensing
URL: https://github.com/apache/paimon-rust/pull/554


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] build: harden release artifact licensing [paimon-rust]

Posted by "XiaoHongbo-Hope (via GitHub)" <gi...@apache.org>.
XiaoHongbo-Hope commented on PR #554:
URL: https://github.com/apache/paimon-rust/pull/554#issuecomment-5022291043

   This mixed PR has been split into:
   
   - #557: unique Python RC artifact versions
   - #558: locked release dependency foundation
   - #561: Python/Go binary legal metadata
   
   The Rust multi-package dry-run failure was not reproduced: Cargo 1.91 and 1.93 validate both crates through a temporary registry, while the real publish path already uploads paimon before paimon-datafusion.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@paimon.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org