Release Verification Issues v1.4.0

[Adnan Hemani via dev <de...@polaris.apache.org>]

Hi all,

While I have successfully generated the release materials for the RC0 of
Polaris v1.4.0, I am facing a few issues when running the
`verify-release.sh` script.

1. A file descriptor resource leak causes the script to deadlock during the
Signature and Checksum verification of the Maven repo. I've opened #4024
[1] to suggest a fix to this issue.

2. Getting errors on all artifacts: "Locally built and staged Maven
repository artifact XXX differ". I've verified I'm using the same Java
version to compile locally. So far, my hunch is that some asymmetric
differences exist between how the code is assembled in the GitHub workflow
and how we assemble it locally, perhaps relating to the "-PjarWithGitInfo"
and "-Prelease" flags. I really have no clue why this may be happening...

3. The verify-release script is complaining that the LICENSE and NOTICE
files are not found in "META-INF/" for the Spark connector jars. My
understanding is that #3912 [2] may be causing this. I'm not sure if there
was a decision that LICENSE/NOTICE files do not need to be placed there?
But if not, is there a bug in #3912 that needs fixing?

Here is a link to the GitHub Actions run that produces the materials I was
attempting to verify:
https://github.com/apache/polaris/actions/runs/23222125467

[1] https://github.com/apache/polaris/pull/4024
[2] https://github.com/apache/polaris/pull/3912

Best,
Adnan Hemani

Re: Release Verification Issues v1.4.0

[Jean-Baptiste Onofré <jb...@nanthrax.net>]

Hi Adnan,

Since this is a new artifact, I believe we need a follow-up PR to address
the issue. I will perform another review of the legal requirements for this
artifact and, if necessary, create a follow-up PR for the release script.

I am currently working on this and will keep you posted.

In the meantime, let's prepare the release this week so we can move forward
with a vote early next week.

Regards,
JB

On Tue, Mar 24, 2026 at 7:07 AM Adnan Hemani via dev <de...@polaris.apache.org>
wrote:

> Hi JB,
>
> PR #3912 is the one I believe has created the LICENSE/NOTICE failure in the
> verification script. Are you saying you believe this warning is safe to
> ignore?
>
> We can surely continue next week with manual process for release if
> required.
>
> Best,
> Adnan Hemani
>
> On Mon, Mar 23, 2026 at 10:06 PM Jean-Baptiste Onofré <jb...@nanthrax.net>
> wrote:
>
> > Hi all,
> >
> > We are currently behind schedule for the 1.4.0 release. I propose that we
> > prioritize this release immediately so we can submit it for a vote as
> soon
> > as possible.
> >
> > Here is a quick update:
> >
> > 1. PR #3912 regarding the Spark plugin LICENSE/NOTICE has been merged. I
> > am performing a final review, but we should be set on this.
> > 2. I am currently reviewing PR #4024 regarding release verification and
> > expect to finish today.
> >
> > I propose a deadline of the end of this week for this release. If we
> > continue to encounter issues with the release scripts, we can move
> forward
> > with a manual process.
> >
> > Thoughts?
> >
> > Regards,
> > JB
> >
> > On Thu, Mar 19, 2026 at 5:28 AM Jean-Baptiste Onofré <jb...@nanthrax.net>
> > wrote:
> >
> >> HI Adnan
> >>
> >> Thanks for the update.
> >>
> >> 1. About #4024, I'm a bit surprised it happens now. I don't know a
> change
> >> explaining this. Let me take a look on the PR.
> >> 2. If it defers, it can be because the reproducible build is "broken".
> >> Let me execute the verify locally.
> >> 3.The release script expects that all distributed artifacts include
> >> LICENSE/NOTICE. #3912 seems to remove that for the Spark plugin. I
> didn't
> >> review #3912 and there's not a lot of details about the change. It
> didn't
> >> happen before because it's the first time we distribute the Spark
> plugin.
> >> Same here: I need to take a look.
> >>
> >> I will keep you posted asap (I'm traveling back home this morning, I
> >> should have time this afternoon to investigate).
> >>
> >> Regards
> >> JB
> >>
> >> On Thu, Mar 19, 2026 at 4:26 AM Adnan Hemani via dev <
> >> dev@polaris.apache.org> wrote:
> >>
> >>> Hi all,
> >>>
> >>> While I have successfully generated the release materials for the RC0
> of
> >>> Polaris v1.4.0, I am facing a few issues when running the
> >>> `verify-release.sh` script.
> >>>
> >>> 1. A file descriptor resource leak causes the script to deadlock during
> >>> the
> >>> Signature and Checksum verification of the Maven repo. I've opened
> #4024
> >>> [1] to suggest a fix to this issue.
> >>>
> >>> 2. Getting errors on all artifacts: "Locally built and staged Maven
> >>> repository artifact XXX differ". I've verified I'm using the same Java
> >>> version to compile locally. So far, my hunch is that some asymmetric
> >>> differences exist between how the code is assembled in the GitHub
> >>> workflow
> >>> and how we assemble it locally, perhaps relating to the
> >>> "-PjarWithGitInfo"
> >>> and "-Prelease" flags. I really have no clue why this may be
> happening...
> >>>
> >>> 3. The verify-release script is complaining that the LICENSE and NOTICE
> >>> files are not found in "META-INF/" for the Spark connector jars. My
> >>> understanding is that #3912 [2] may be causing this. I'm not sure if
> >>> there
> >>> was a decision that LICENSE/NOTICE files do not need to be placed
> there?
> >>> But if not, is there a bug in #3912 that needs fixing?
> >>>
> >>> Here is a link to the GitHub Actions run that produces the materials I
> >>> was
> >>> attempting to verify:
> >>> https://github.com/apache/polaris/actions/runs/23222125467
> >>>
> >>> [1] https://github.com/apache/polaris/pull/4024
> >>> [2] https://github.com/apache/polaris/pull/3912
> >>>
> >>> Best,
> >>> Adnan Hemani
> >>>
> >>
>

Re: Release Verification Issues v1.4.0

[Adnan Hemani via dev <de...@polaris.apache.org>]

Hi JB,

PR #3912 is the one I believe has created the LICENSE/NOTICE failure in the
verification script. Are you saying you believe this warning is safe to
ignore?

We can surely continue next week with manual process for release if
required.

Best,
Adnan Hemani

On Mon, Mar 23, 2026 at 10:06 PM Jean-Baptiste Onofré <jb...@nanthrax.net>
wrote:

> Hi all,
>
> We are currently behind schedule for the 1.4.0 release. I propose that we
> prioritize this release immediately so we can submit it for a vote as soon
> as possible.
>
> Here is a quick update:
>
> 1. PR #3912 regarding the Spark plugin LICENSE/NOTICE has been merged. I
> am performing a final review, but we should be set on this.
> 2. I am currently reviewing PR #4024 regarding release verification and
> expect to finish today.
>
> I propose a deadline of the end of this week for this release. If we
> continue to encounter issues with the release scripts, we can move forward
> with a manual process.
>
> Thoughts?
>
> Regards,
> JB
>
> On Thu, Mar 19, 2026 at 5:28 AM Jean-Baptiste Onofré <jb...@nanthrax.net>
> wrote:
>
>> HI Adnan
>>
>> Thanks for the update.
>>
>> 1. About #4024, I'm a bit surprised it happens now. I don't know a change
>> explaining this. Let me take a look on the PR.
>> 2. If it defers, it can be because the reproducible build is "broken".
>> Let me execute the verify locally.
>> 3.The release script expects that all distributed artifacts include
>> LICENSE/NOTICE. #3912 seems to remove that for the Spark plugin. I didn't
>> review #3912 and there's not a lot of details about the change. It didn't
>> happen before because it's the first time we distribute the Spark plugin.
>> Same here: I need to take a look.
>>
>> I will keep you posted asap (I'm traveling back home this morning, I
>> should have time this afternoon to investigate).
>>
>> Regards
>> JB
>>
>> On Thu, Mar 19, 2026 at 4:26 AM Adnan Hemani via dev <
>> dev@polaris.apache.org> wrote:
>>
>>> Hi all,
>>>
>>> While I have successfully generated the release materials for the RC0 of
>>> Polaris v1.4.0, I am facing a few issues when running the
>>> `verify-release.sh` script.
>>>
>>> 1. A file descriptor resource leak causes the script to deadlock during
>>> the
>>> Signature and Checksum verification of the Maven repo. I've opened #4024
>>> [1] to suggest a fix to this issue.
>>>
>>> 2. Getting errors on all artifacts: "Locally built and staged Maven
>>> repository artifact XXX differ". I've verified I'm using the same Java
>>> version to compile locally. So far, my hunch is that some asymmetric
>>> differences exist between how the code is assembled in the GitHub
>>> workflow
>>> and how we assemble it locally, perhaps relating to the
>>> "-PjarWithGitInfo"
>>> and "-Prelease" flags. I really have no clue why this may be happening...
>>>
>>> 3. The verify-release script is complaining that the LICENSE and NOTICE
>>> files are not found in "META-INF/" for the Spark connector jars. My
>>> understanding is that #3912 [2] may be causing this. I'm not sure if
>>> there
>>> was a decision that LICENSE/NOTICE files do not need to be placed there?
>>> But if not, is there a bug in #3912 that needs fixing?
>>>
>>> Here is a link to the GitHub Actions run that produces the materials I
>>> was
>>> attempting to verify:
>>> https://github.com/apache/polaris/actions/runs/23222125467
>>>
>>> [1] https://github.com/apache/polaris/pull/4024
>>> [2] https://github.com/apache/polaris/pull/3912
>>>
>>> Best,
>>> Adnan Hemani
>>>
>>

Re: Release Verification Issues v1.4.0

[Jean-Baptiste Onofré <jb...@nanthrax.net>]

Hi all,

We are currently behind schedule for the 1.4.0 release. I propose that we
prioritize this release immediately so we can submit it for a vote as soon
as possible.

Here is a quick update:

1. PR #3912 regarding the Spark plugin LICENSE/NOTICE has been merged. I am
performing a final review, but we should be set on this.
2. I am currently reviewing PR #4024 regarding release verification and
expect to finish today.

I propose a deadline of the end of this week for this release. If we
continue to encounter issues with the release scripts, we can move forward
with a manual process.

Thoughts?

Regards,
JB

On Thu, Mar 19, 2026 at 5:28 AM Jean-Baptiste Onofré <jb...@nanthrax.net>
wrote:

> HI Adnan
>
> Thanks for the update.
>
> 1. About #4024, I'm a bit surprised it happens now. I don't know a change
> explaining this. Let me take a look on the PR.
> 2. If it defers, it can be because the reproducible build is "broken". Let
> me execute the verify locally.
> 3.The release script expects that all distributed artifacts include
> LICENSE/NOTICE. #3912 seems to remove that for the Spark plugin. I didn't
> review #3912 and there's not a lot of details about the change. It didn't
> happen before because it's the first time we distribute the Spark plugin.
> Same here: I need to take a look.
>
> I will keep you posted asap (I'm traveling back home this morning, I
> should have time this afternoon to investigate).
>
> Regards
> JB
>
> On Thu, Mar 19, 2026 at 4:26 AM Adnan Hemani via dev <
> dev@polaris.apache.org> wrote:
>
>> Hi all,
>>
>> While I have successfully generated the release materials for the RC0 of
>> Polaris v1.4.0, I am facing a few issues when running the
>> `verify-release.sh` script.
>>
>> 1. A file descriptor resource leak causes the script to deadlock during
>> the
>> Signature and Checksum verification of the Maven repo. I've opened #4024
>> [1] to suggest a fix to this issue.
>>
>> 2. Getting errors on all artifacts: "Locally built and staged Maven
>> repository artifact XXX differ". I've verified I'm using the same Java
>> version to compile locally. So far, my hunch is that some asymmetric
>> differences exist between how the code is assembled in the GitHub workflow
>> and how we assemble it locally, perhaps relating to the "-PjarWithGitInfo"
>> and "-Prelease" flags. I really have no clue why this may be happening...
>>
>> 3. The verify-release script is complaining that the LICENSE and NOTICE
>> files are not found in "META-INF/" for the Spark connector jars. My
>> understanding is that #3912 [2] may be causing this. I'm not sure if there
>> was a decision that LICENSE/NOTICE files do not need to be placed there?
>> But if not, is there a bug in #3912 that needs fixing?
>>
>> Here is a link to the GitHub Actions run that produces the materials I was
>> attempting to verify:
>> https://github.com/apache/polaris/actions/runs/23222125467
>>
>> [1] https://github.com/apache/polaris/pull/4024
>> [2] https://github.com/apache/polaris/pull/3912
>>
>> Best,
>> Adnan Hemani
>>
>

Re: Release Verification Issues v1.4.0

[Jean-Baptiste Onofré <jb...@nanthrax.net>]

HI Adnan

Thanks for the update.

1. About #4024, I'm a bit surprised it happens now. I don't know a change
explaining this. Let me take a look on the PR.
2. If it defers, it can be because the reproducible build is "broken". Let
me execute the verify locally.
3.The release script expects that all distributed artifacts include
LICENSE/NOTICE. #3912 seems to remove that for the Spark plugin. I didn't
review #3912 and there's not a lot of details about the change. It didn't
happen before because it's the first time we distribute the Spark plugin.
Same here: I need to take a look.

I will keep you posted asap (I'm traveling back home this morning, I should
have time this afternoon to investigate).

Regards
JB

On Thu, Mar 19, 2026 at 4:26 AM Adnan Hemani via dev <de...@polaris.apache.org>
wrote:

> Hi all,
>
> While I have successfully generated the release materials for the RC0 of
> Polaris v1.4.0, I am facing a few issues when running the
> `verify-release.sh` script.
>
> 1. A file descriptor resource leak causes the script to deadlock during the
> Signature and Checksum verification of the Maven repo. I've opened #4024
> [1] to suggest a fix to this issue.
>
> 2. Getting errors on all artifacts: "Locally built and staged Maven
> repository artifact XXX differ". I've verified I'm using the same Java
> version to compile locally. So far, my hunch is that some asymmetric
> differences exist between how the code is assembled in the GitHub workflow
> and how we assemble it locally, perhaps relating to the "-PjarWithGitInfo"
> and "-Prelease" flags. I really have no clue why this may be happening...
>
> 3. The verify-release script is complaining that the LICENSE and NOTICE
> files are not found in "META-INF/" for the Spark connector jars. My
> understanding is that #3912 [2] may be causing this. I'm not sure if there
> was a decision that LICENSE/NOTICE files do not need to be placed there?
> But if not, is there a bug in #3912 that needs fixing?
>
> Here is a link to the GitHub Actions run that produces the materials I was
> attempting to verify:
> https://github.com/apache/polaris/actions/runs/23222125467
>
> [1] https://github.com/apache/polaris/pull/4024
> [2] https://github.com/apache/polaris/pull/3912
>
> Best,
> Adnan Hemani
>