You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@polaris.apache.org by Adnan Hemani via dev <de...@polaris.apache.org> on 2026/04/20 23:41:04 UTC
[VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Hi all,
I propose that we release the following RC as the official Apache Polaris
Python CLI 1.4.0 release.
SVN: https://dist.apache.org/repos/dist/dev/polaris/python-client/1.4.0/
Test PyPI: https://test.pypi.org/project/apache-polaris/1.4.0rc1/
Starting with Apache Polaris 1.5.0, the CLI should be released alongside
all other release artifacts within the full Polaris Release Candidate. Work
to make this happen can be found here:
https://github.com/apache/polaris/pull/4220
Please vote in the next 72 hours.
[ ] +1 Release this as Apache Polaris 1.4.0
[ ] +0
[ ] -1 Do not release this because...
Only PMC members have binding votes, but other community members are
encouraged to cast non-binding votes.
This vote will pass if there are 3 binding +1 votes and more binding +1
votes than -1 votes.
Best,
Adnan Hemani
Re: [VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Posted by Jean-Baptiste Onofré <jb...@nanthrax.net>.
+1 (bindiing)
I checked:
- source distribution
-- signature and checksum are good
-- LICENSE and NOTICE are correct
-- ASF header is present in all expected files
-- No binary/compiled file found in the source distribution
- whl distribution
-- signature and checksum are good
-- LICENSE and NOTICE are correct
-- RECORD integrity is good
-- METADATA is good
Regards
JB
On Tue, Apr 21, 2026 at 1:41 AM Adnan Hemani via dev <de...@polaris.apache.org>
wrote:
> Hi all,
>
> I propose that we release the following RC as the official Apache Polaris
> Python CLI 1.4.0 release.
>
> SVN: https://dist.apache.org/repos/dist/dev/polaris/python-client/1.4.0/
> Test PyPI: https://test.pypi.org/project/apache-polaris/1.4.0rc1/
>
> Starting with Apache Polaris 1.5.0, the CLI should be released alongside
> all other release artifacts within the full Polaris Release Candidate. Work
> to make this happen can be found here:
> https://github.com/apache/polaris/pull/4220
>
> Please vote in the next 72 hours.
>
> [ ] +1 Release this as Apache Polaris 1.4.0
> [ ] +0
> [ ] -1 Do not release this because...
>
> Only PMC members have binding votes, but other community members are
> encouraged to cast non-binding votes.
> This vote will pass if there are 3 binding +1 votes and more binding +1
> votes than -1 votes.
>
> Best,
> Adnan Hemani
>
Re: [VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Posted by Yong Zheng <yo...@gmail.com>.
Yeah, not sure. While I was following validation commands, this was failing due to the extra paths.
@JB, thoughts as you may know better?
Thanks,
Yong
> On Apr 21, 2026, at 12:23 PM, Adnan Hemani via dev <de...@polaris.apache.org> wrote:
>
> hmm ok - I'm really not sure about this. It may be because I ran the
> signing commands from a directory further out - but I'm unclear whether
> this is a blocking issue? Is anyone sure about this?
>
> Best,
> Adnan Hemani
>
>> On Tue, Apr 21, 2026 at 6:02 AM Yong Zheng <yo...@gmail.com> wrote:
>>
>> The path is “ client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl”
>> in the checksum file. But should it be
>> “apache_polaris-1.4.0rc1-py3-none-any.whl” instead?
>>
>> Thanks,
>> Yong
>>
>>>> On Apr 21, 2026, at 12:03 AM, Yong Zheng <yz...@apache.org> wrote:
>>>
>>> client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl
>>
Re: [VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Posted by Adnan Hemani via dev <de...@polaris.apache.org>.
hmm ok - I'm really not sure about this. It may be because I ran the
signing commands from a directory further out - but I'm unclear whether
this is a blocking issue? Is anyone sure about this?
Best,
Adnan Hemani
On Tue, Apr 21, 2026 at 6:02 AM Yong Zheng <yo...@gmail.com> wrote:
> The path is “ client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl”
> in the checksum file. But should it be
> “apache_polaris-1.4.0rc1-py3-none-any.whl” instead?
>
> Thanks,
> Yong
>
> > On Apr 21, 2026, at 12:03 AM, Yong Zheng <yz...@apache.org> wrote:
> >
> > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl
>
Re: [VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Posted by Yong Zheng <yo...@gmail.com>.
The path is “ client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl” in the checksum file. But should it be “apache_polaris-1.4.0rc1-py3-none-any.whl” instead?
Thanks,
Yong
> On Apr 21, 2026, at 12:03 AM, Yong Zheng <yz...@apache.org> wrote:
>
> client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl
[CANCEL] [VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Posted by Adnan Hemani via dev <de...@polaris.apache.org>.
Thanks Jonas for this summary. I will make the changes noted here in a new
RC2 and am closing this thread for the time being.
Best,
Adnan Hemani
On Wed, Apr 22, 2026 at 9:17 PM Honah J. <ho...@apache.org> wrote:
> Hi all,
>
> Thanks Adnan for driving the RC, and thanks to everyone for verifying!
>
> Adding an additional point from an offline discussion: In RC2, we should
> only include the wheel distribution for python client, because the Python
> client's sdist (tar.gz) includes a spec file copied from Apache Iceberg and
> client's LICENSE/NOTICE currently does not properly document that. The
> wheel is universal, so itself should still work in most use cases.
>
> Best regards,
> Jonas
>
> On Wed, Apr 22, 2026 at 11:09 AM Dmitri Bourlatchkov <di...@apache.org>
> wrote:
>
> > Hi All,
> >
> > I agree that the missing Licence _name_ in package info is not a blocker.
> >
> > From my POV the main issue is mutable files, which makes signatures
> > useless.
> >
> > +1 to RC2.
> >
> > Cheers,
> > Dmitri.
> >
> > On Wed, Apr 22, 2026 at 11:22 AM Jean-Baptiste Onofré <jb...@nanthrax.net>
> > wrote:
> >
> > > Usually we don't put the rc in the staged artifacts, exactly to avoid
> to
> > > change the checksum files after (only the vote should have RC, not the
> > > artifacts).
> > >
> > > I don't consider the License in package info as a blocker (the actual
> > > LICENSE file is included), but clearly to be fixed.
> > >
> > > Regarding, these issues, I suggest to cancel this vote to prepare a
> clean
> > > RC2 with clean artifacts and updated package info.
> > >
> > > Regards
> > > JB
> > >
> > >
> > > On Wed, Apr 22, 2026 at 4:02 PM Dmitri Bourlatchkov <di...@apache.org>
> > > wrote:
> > >
> > > > Hi JB,
> > > >
> > > > Thanks for fixing the checksum files. They pass validation now.
> > > Signatures
> > > > are OK too. The package installs fine.
> > > >
> > > > However, I still vote -1 because of the RC tags and missing "License"
> > in
> > > > package info (details below).
> > > >
> > > > 1) SHA files still reference files with "rc1" in the name. If we
> > publish
> > > > them, we'll have to modify the content after voting, which is not
> nice.
> > > >
> > > > $ cat apache_polaris-1.4.0rc1.tar.gz.sha512
> > > >
> > > >
> > >
> >
> 5c8b2d967965e9b578ca1e4e3e5d659a5bd5cdb3ee2ae1622a2eae95605e5e8683902b5d3044736220eb48c29d4dd70275eab95528270ebbb411a8e71f8c159c
> > > > apache_polaris-1.4.0rc1.tar.gz
> > > >
> > > > 2) Python package info still shows a version with "rc1" after
> > > installation.
> > > > As I noted before, I believe this will require re-packaging after the
> > > vote
> > > > (to avoid "RC" in the final release).
> > > >
> > > > $ venv/bin/pip show apache-polaris
> > > > Name: apache-polaris
> > > > Version: 1.4.0rc1
> > > > Summary: Apache Polaris
> > > > Home-page:
> > > > Author:
> > > > Author-email: Apache Software Foundation <de...@polaris.apache.org>
> > > > License:
> > > > Location:
> > > > /home/dmitri/Downloads/pol-cli-rc1/venv/lib/python3.12/site-packages
> > > > Requires: boto3, prettytable, pydantic, python-dateutil, pyyaml,
> > > > typing-extensions, urllib3
> > > > Required-by:
> > > >
> > > > Confirmed manually: the "rc1" tag is present in PKG-INFO inside the
> > > signed
> > > > archive too. So, removing the RC tag will require re-signing and will
> > > > invalidate signature checks during the vote.
> > > >
> > > > 3) Licence name is missing from package info.
> > > >
> > > > 4) (minor) Home-page and author email are missing from package info
> > > >
> > > > Sorry for being picky, but I believe these matters are important.
> > > >
> > > > Cheers,
> > > > Dmitri.
> > > >
> > > > On Wed, Apr 22, 2026 at 1:32 AM Jean-Baptiste Onofré <
> jb@nanthrax.net>
> > > > wrote:
> > > >
> > > > > Hi folks,
> > > > >
> > > > > 1. The checksums are basically correct (in terms of pure checksum),
> > you
> > > > can
> > > > > verify for instance with this sha512 content:
> > > > >
> > > > >
> > > > >
> > > >
> > >
> >
> 5c8b2d967965e9b578ca1e4e3e5d659a5bd5cdb3ee2ae1622a2eae95605e5e8683902b5d3044736220eb48c29d4dd70275eab95528270ebbb411a8e71f8c159c
> > > > > apache_polaris-1.4.0rc1.tar.gz
> > > > >
> > > > > for instance.
> > > > >
> > > > > 2. Usually, to simplify the check, the path in the sha512 should
> use
> > a
> > > > > relative local path (that's the issue here: the sha512 file should
> a
> > > > > relative path but relative to the root folder).
> > > > > 3. Since the checksums are correct, we can update dist.apache.org
> to
> > > use
> > > > > the related one level path. I fixed the sha512 files on
> > > dist.apache.org.
> > > > >
> > > > > @Yong and @Dmitri can you check again? It should be fine by default
> > > now.
> > > > >
> > > > > Regards
> > > > > JB
> > > > >
> > > > > On Wed, Apr 22, 2026 at 2:19 AM Dmitri Bourlatchkov <
> > dimas@apache.org>
> > > > > wrote:
> > > > >
> > > > > > Correction: I found the key. Signatures are OK.
> > > > > >
> > > > > > Still, the other issues remain.
> > > > > >
> > > > > > Cheers,
> > > > > > Dmitri.
> > > > > >
> > > > > > On Tue, Apr 21, 2026 at 8:06 PM Dmitri Bourlatchkov <
> > > dimas@apache.org>
> > > > > > wrote:
> > > > > >
> > > > > > > Hi Adnan,
> > > > > > >
> > > > > > > -1 (binding)
> > > > > > >
> > > > > > > Sorry for nitpicks, but checksums do not easily match based on
> > data
> > > > in
> > > > > > > dist - file paths are not aligned:
> > > > > > >
> > > > > > > $ sha512sum -c *.sha512
> > > > > > > sha512sum:
> > > > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl:
> > > > > > No
> > > > > > > such file or directory
> > > > > > > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl:
> > FAILED
> > > > > open
> > > > > > > or read
> > > > > > > sha512sum: WARNING: 1 listed file could not be read
> > > > > > > sha512sum: client/python/dist/apache_polaris-1.4.0rc1.tar.gz:
> No
> > > such
> > > > > > file
> > > > > > > or directory
> > > > > > > client/python/dist/apache_polaris-1.4.0rc1.tar.gz: FAILED open
> or
> > > > read
> > > > > > > sha512sum: WARNING: 1 listed file could not be read
> > > > > > >
> > > > > > > Signature verification failed:
> > > > > > >
> > > > > > > $ gpg --verify apache_polaris-1.4.0rc1-py3-none-any.whl.asc
> > > > > > > apache_polaris-1.4.0rc1-py3-none-any.whl
> > > > > > > gpg: Signature made Tue 21 Apr 2026 01:30:38 AM EDT
> > > > > > > gpg: using RSA key
> > > > > > 81010346A868FB157879A81354F298C6A64BECCC
> > > > > > > gpg: Can't check signature: No public key
> > > > > > >
> > > > > > > I downloaded the latest KEYS file... Did I miss something?..
> What
> > > is
> > > > > this
> > > > > > > RSA key?
> > > > > > >
> > > > > > > Also file names contain "rc1", which I think is still not
> great.
> > I
> > > > > > believe
> > > > > > > the RC set of files on dist/dev should be exactly as the final
> > set
> > > of
> > > > > > > release files if the vote is successful, right?
> > > > > > >
> > > > > > > Cheers,
> > > > > > > Dmitri.
> > > > > > >
> > > > > > > On Tue, Apr 21, 2026 at 1:38 AM Adnan Hemani via dev <
> > > > > > > dev@polaris.apache.org> wrote:
> > > > > > >
> > > > > > >> Uploaded the source distribution on dist.apache.org.
> > > > > > >>
> > > > > > >> Yong, I'm not sure what you're pointing out. Can you explain
> > > > further?
> > > > > > >>
> > > > > > >> Best,
> > > > > > >> Adnan Hemani
> > > > > > >>
> > > > > > >> On Mon, Apr 20, 2026 at 10:03 PM Yong Zheng <
> yzheng@apache.org>
> > > > > wrote:
> > > > > > >>
> > > > > > >> > Maybe wrong path in the sha512:
> > > > > > >> > cat apache_polaris-1.4.0rc1-py3-none-any.whl.sha512
> > > > > > >> >
> > > > > > >>
> > > > > >
> > > > >
> > > >
> > >
> >
> beedace582c330e2602a643364fbf5806c3c7564897384f42e1ac546ed69e06c64cb29d7ab32787b05078785416c387be6ce66ce63e20ba6ebf9a36d16332e7d
> > > > > > >> > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl
> > > > > > >> >
> > > > > > >> > Thanks,
> > > > > > >> > Yong Zheng
> > > > > > >> >
> > > > > > >> > On 2026/04/20 23:41:04 Adnan Hemani via dev wrote:
> > > > > > >> > > Hi all,
> > > > > > >> > >
> > > > > > >> > > I propose that we release the following RC as the official
> > > > Apache
> > > > > > >> Polaris
> > > > > > >> > > Python CLI 1.4.0 release.
> > > > > > >> > >
> > > > > > >> > > SVN:
> > > > > > >>
> > > https://dist.apache.org/repos/dist/dev/polaris/python-client/1.4.0/
> > > > > > >> > > Test PyPI:
> > > > https://test.pypi.org/project/apache-polaris/1.4.0rc1/
> > > > > > >> > >
> > > > > > >> > > Starting with Apache Polaris 1.5.0, the CLI should be
> > released
> > > > > > >> alongside
> > > > > > >> > > all other release artifacts within the full Polaris
> Release
> > > > > > Candidate.
> > > > > > >> > Work
> > > > > > >> > > to make this happen can be found here:
> > > > > > >> > > https://github.com/apache/polaris/pull/4220
> > > > > > >> > >
> > > > > > >> > > Please vote in the next 72 hours.
> > > > > > >> > >
> > > > > > >> > > [ ] +1 Release this as Apache Polaris 1.4.0
> > > > > > >> > > [ ] +0
> > > > > > >> > > [ ] -1 Do not release this because...
> > > > > > >> > >
> > > > > > >> > > Only PMC members have binding votes, but other community
> > > members
> > > > > are
> > > > > > >> > > encouraged to cast non-binding votes.
> > > > > > >> > > This vote will pass if there are 3 binding +1 votes and
> more
> > > > > binding
> > > > > > >> +1
> > > > > > >> > > votes than -1 votes.
> > > > > > >> > >
> > > > > > >> > > Best,
> > > > > > >> > > Adnan Hemani
> > > > > > >> > >
> > > > > > >> >
> > > > > > >>
> > > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
>
Re: [VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Posted by "Honah J." <ho...@apache.org>.
Hi all,
Thanks Adnan for driving the RC, and thanks to everyone for verifying!
Adding an additional point from an offline discussion: In RC2, we should
only include the wheel distribution for python client, because the Python
client's sdist (tar.gz) includes a spec file copied from Apache Iceberg and
client's LICENSE/NOTICE currently does not properly document that. The
wheel is universal, so itself should still work in most use cases.
Best regards,
Jonas
On Wed, Apr 22, 2026 at 11:09 AM Dmitri Bourlatchkov <di...@apache.org>
wrote:
> Hi All,
>
> I agree that the missing Licence _name_ in package info is not a blocker.
>
> From my POV the main issue is mutable files, which makes signatures
> useless.
>
> +1 to RC2.
>
> Cheers,
> Dmitri.
>
> On Wed, Apr 22, 2026 at 11:22 AM Jean-Baptiste Onofré <jb...@nanthrax.net>
> wrote:
>
> > Usually we don't put the rc in the staged artifacts, exactly to avoid to
> > change the checksum files after (only the vote should have RC, not the
> > artifacts).
> >
> > I don't consider the License in package info as a blocker (the actual
> > LICENSE file is included), but clearly to be fixed.
> >
> > Regarding, these issues, I suggest to cancel this vote to prepare a clean
> > RC2 with clean artifacts and updated package info.
> >
> > Regards
> > JB
> >
> >
> > On Wed, Apr 22, 2026 at 4:02 PM Dmitri Bourlatchkov <di...@apache.org>
> > wrote:
> >
> > > Hi JB,
> > >
> > > Thanks for fixing the checksum files. They pass validation now.
> > Signatures
> > > are OK too. The package installs fine.
> > >
> > > However, I still vote -1 because of the RC tags and missing "License"
> in
> > > package info (details below).
> > >
> > > 1) SHA files still reference files with "rc1" in the name. If we
> publish
> > > them, we'll have to modify the content after voting, which is not nice.
> > >
> > > $ cat apache_polaris-1.4.0rc1.tar.gz.sha512
> > >
> > >
> >
> 5c8b2d967965e9b578ca1e4e3e5d659a5bd5cdb3ee2ae1622a2eae95605e5e8683902b5d3044736220eb48c29d4dd70275eab95528270ebbb411a8e71f8c159c
> > > apache_polaris-1.4.0rc1.tar.gz
> > >
> > > 2) Python package info still shows a version with "rc1" after
> > installation.
> > > As I noted before, I believe this will require re-packaging after the
> > vote
> > > (to avoid "RC" in the final release).
> > >
> > > $ venv/bin/pip show apache-polaris
> > > Name: apache-polaris
> > > Version: 1.4.0rc1
> > > Summary: Apache Polaris
> > > Home-page:
> > > Author:
> > > Author-email: Apache Software Foundation <de...@polaris.apache.org>
> > > License:
> > > Location:
> > > /home/dmitri/Downloads/pol-cli-rc1/venv/lib/python3.12/site-packages
> > > Requires: boto3, prettytable, pydantic, python-dateutil, pyyaml,
> > > typing-extensions, urllib3
> > > Required-by:
> > >
> > > Confirmed manually: the "rc1" tag is present in PKG-INFO inside the
> > signed
> > > archive too. So, removing the RC tag will require re-signing and will
> > > invalidate signature checks during the vote.
> > >
> > > 3) Licence name is missing from package info.
> > >
> > > 4) (minor) Home-page and author email are missing from package info
> > >
> > > Sorry for being picky, but I believe these matters are important.
> > >
> > > Cheers,
> > > Dmitri.
> > >
> > > On Wed, Apr 22, 2026 at 1:32 AM Jean-Baptiste Onofré <jb...@nanthrax.net>
> > > wrote:
> > >
> > > > Hi folks,
> > > >
> > > > 1. The checksums are basically correct (in terms of pure checksum),
> you
> > > can
> > > > verify for instance with this sha512 content:
> > > >
> > > >
> > > >
> > >
> >
> 5c8b2d967965e9b578ca1e4e3e5d659a5bd5cdb3ee2ae1622a2eae95605e5e8683902b5d3044736220eb48c29d4dd70275eab95528270ebbb411a8e71f8c159c
> > > > apache_polaris-1.4.0rc1.tar.gz
> > > >
> > > > for instance.
> > > >
> > > > 2. Usually, to simplify the check, the path in the sha512 should use
> a
> > > > relative local path (that's the issue here: the sha512 file should a
> > > > relative path but relative to the root folder).
> > > > 3. Since the checksums are correct, we can update dist.apache.org to
> > use
> > > > the related one level path. I fixed the sha512 files on
> > dist.apache.org.
> > > >
> > > > @Yong and @Dmitri can you check again? It should be fine by default
> > now.
> > > >
> > > > Regards
> > > > JB
> > > >
> > > > On Wed, Apr 22, 2026 at 2:19 AM Dmitri Bourlatchkov <
> dimas@apache.org>
> > > > wrote:
> > > >
> > > > > Correction: I found the key. Signatures are OK.
> > > > >
> > > > > Still, the other issues remain.
> > > > >
> > > > > Cheers,
> > > > > Dmitri.
> > > > >
> > > > > On Tue, Apr 21, 2026 at 8:06 PM Dmitri Bourlatchkov <
> > dimas@apache.org>
> > > > > wrote:
> > > > >
> > > > > > Hi Adnan,
> > > > > >
> > > > > > -1 (binding)
> > > > > >
> > > > > > Sorry for nitpicks, but checksums do not easily match based on
> data
> > > in
> > > > > > dist - file paths are not aligned:
> > > > > >
> > > > > > $ sha512sum -c *.sha512
> > > > > > sha512sum:
> > > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl:
> > > > > No
> > > > > > such file or directory
> > > > > > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl:
> FAILED
> > > > open
> > > > > > or read
> > > > > > sha512sum: WARNING: 1 listed file could not be read
> > > > > > sha512sum: client/python/dist/apache_polaris-1.4.0rc1.tar.gz: No
> > such
> > > > > file
> > > > > > or directory
> > > > > > client/python/dist/apache_polaris-1.4.0rc1.tar.gz: FAILED open or
> > > read
> > > > > > sha512sum: WARNING: 1 listed file could not be read
> > > > > >
> > > > > > Signature verification failed:
> > > > > >
> > > > > > $ gpg --verify apache_polaris-1.4.0rc1-py3-none-any.whl.asc
> > > > > > apache_polaris-1.4.0rc1-py3-none-any.whl
> > > > > > gpg: Signature made Tue 21 Apr 2026 01:30:38 AM EDT
> > > > > > gpg: using RSA key
> > > > > 81010346A868FB157879A81354F298C6A64BECCC
> > > > > > gpg: Can't check signature: No public key
> > > > > >
> > > > > > I downloaded the latest KEYS file... Did I miss something?.. What
> > is
> > > > this
> > > > > > RSA key?
> > > > > >
> > > > > > Also file names contain "rc1", which I think is still not great.
> I
> > > > > believe
> > > > > > the RC set of files on dist/dev should be exactly as the final
> set
> > of
> > > > > > release files if the vote is successful, right?
> > > > > >
> > > > > > Cheers,
> > > > > > Dmitri.
> > > > > >
> > > > > > On Tue, Apr 21, 2026 at 1:38 AM Adnan Hemani via dev <
> > > > > > dev@polaris.apache.org> wrote:
> > > > > >
> > > > > >> Uploaded the source distribution on dist.apache.org.
> > > > > >>
> > > > > >> Yong, I'm not sure what you're pointing out. Can you explain
> > > further?
> > > > > >>
> > > > > >> Best,
> > > > > >> Adnan Hemani
> > > > > >>
> > > > > >> On Mon, Apr 20, 2026 at 10:03 PM Yong Zheng <yz...@apache.org>
> > > > wrote:
> > > > > >>
> > > > > >> > Maybe wrong path in the sha512:
> > > > > >> > cat apache_polaris-1.4.0rc1-py3-none-any.whl.sha512
> > > > > >> >
> > > > > >>
> > > > >
> > > >
> > >
> >
> beedace582c330e2602a643364fbf5806c3c7564897384f42e1ac546ed69e06c64cb29d7ab32787b05078785416c387be6ce66ce63e20ba6ebf9a36d16332e7d
> > > > > >> > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl
> > > > > >> >
> > > > > >> > Thanks,
> > > > > >> > Yong Zheng
> > > > > >> >
> > > > > >> > On 2026/04/20 23:41:04 Adnan Hemani via dev wrote:
> > > > > >> > > Hi all,
> > > > > >> > >
> > > > > >> > > I propose that we release the following RC as the official
> > > Apache
> > > > > >> Polaris
> > > > > >> > > Python CLI 1.4.0 release.
> > > > > >> > >
> > > > > >> > > SVN:
> > > > > >>
> > https://dist.apache.org/repos/dist/dev/polaris/python-client/1.4.0/
> > > > > >> > > Test PyPI:
> > > https://test.pypi.org/project/apache-polaris/1.4.0rc1/
> > > > > >> > >
> > > > > >> > > Starting with Apache Polaris 1.5.0, the CLI should be
> released
> > > > > >> alongside
> > > > > >> > > all other release artifacts within the full Polaris Release
> > > > > Candidate.
> > > > > >> > Work
> > > > > >> > > to make this happen can be found here:
> > > > > >> > > https://github.com/apache/polaris/pull/4220
> > > > > >> > >
> > > > > >> > > Please vote in the next 72 hours.
> > > > > >> > >
> > > > > >> > > [ ] +1 Release this as Apache Polaris 1.4.0
> > > > > >> > > [ ] +0
> > > > > >> > > [ ] -1 Do not release this because...
> > > > > >> > >
> > > > > >> > > Only PMC members have binding votes, but other community
> > members
> > > > are
> > > > > >> > > encouraged to cast non-binding votes.
> > > > > >> > > This vote will pass if there are 3 binding +1 votes and more
> > > > binding
> > > > > >> +1
> > > > > >> > > votes than -1 votes.
> > > > > >> > >
> > > > > >> > > Best,
> > > > > >> > > Adnan Hemani
> > > > > >> > >
> > > > > >> >
> > > > > >>
> > > > > >
> > > > >
> > > >
> > >
> >
>
Re: [VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Posted by Dmitri Bourlatchkov <di...@apache.org>.
Hi All,
I agree that the missing Licence _name_ in package info is not a blocker.
From my POV the main issue is mutable files, which makes signatures useless.
+1 to RC2.
Cheers,
Dmitri.
On Wed, Apr 22, 2026 at 11:22 AM Jean-Baptiste Onofré <jb...@nanthrax.net>
wrote:
> Usually we don't put the rc in the staged artifacts, exactly to avoid to
> change the checksum files after (only the vote should have RC, not the
> artifacts).
>
> I don't consider the License in package info as a blocker (the actual
> LICENSE file is included), but clearly to be fixed.
>
> Regarding, these issues, I suggest to cancel this vote to prepare a clean
> RC2 with clean artifacts and updated package info.
>
> Regards
> JB
>
>
> On Wed, Apr 22, 2026 at 4:02 PM Dmitri Bourlatchkov <di...@apache.org>
> wrote:
>
> > Hi JB,
> >
> > Thanks for fixing the checksum files. They pass validation now.
> Signatures
> > are OK too. The package installs fine.
> >
> > However, I still vote -1 because of the RC tags and missing "License" in
> > package info (details below).
> >
> > 1) SHA files still reference files with "rc1" in the name. If we publish
> > them, we'll have to modify the content after voting, which is not nice.
> >
> > $ cat apache_polaris-1.4.0rc1.tar.gz.sha512
> >
> >
> 5c8b2d967965e9b578ca1e4e3e5d659a5bd5cdb3ee2ae1622a2eae95605e5e8683902b5d3044736220eb48c29d4dd70275eab95528270ebbb411a8e71f8c159c
> > apache_polaris-1.4.0rc1.tar.gz
> >
> > 2) Python package info still shows a version with "rc1" after
> installation.
> > As I noted before, I believe this will require re-packaging after the
> vote
> > (to avoid "RC" in the final release).
> >
> > $ venv/bin/pip show apache-polaris
> > Name: apache-polaris
> > Version: 1.4.0rc1
> > Summary: Apache Polaris
> > Home-page:
> > Author:
> > Author-email: Apache Software Foundation <de...@polaris.apache.org>
> > License:
> > Location:
> > /home/dmitri/Downloads/pol-cli-rc1/venv/lib/python3.12/site-packages
> > Requires: boto3, prettytable, pydantic, python-dateutil, pyyaml,
> > typing-extensions, urllib3
> > Required-by:
> >
> > Confirmed manually: the "rc1" tag is present in PKG-INFO inside the
> signed
> > archive too. So, removing the RC tag will require re-signing and will
> > invalidate signature checks during the vote.
> >
> > 3) Licence name is missing from package info.
> >
> > 4) (minor) Home-page and author email are missing from package info
> >
> > Sorry for being picky, but I believe these matters are important.
> >
> > Cheers,
> > Dmitri.
> >
> > On Wed, Apr 22, 2026 at 1:32 AM Jean-Baptiste Onofré <jb...@nanthrax.net>
> > wrote:
> >
> > > Hi folks,
> > >
> > > 1. The checksums are basically correct (in terms of pure checksum), you
> > can
> > > verify for instance with this sha512 content:
> > >
> > >
> > >
> >
> 5c8b2d967965e9b578ca1e4e3e5d659a5bd5cdb3ee2ae1622a2eae95605e5e8683902b5d3044736220eb48c29d4dd70275eab95528270ebbb411a8e71f8c159c
> > > apache_polaris-1.4.0rc1.tar.gz
> > >
> > > for instance.
> > >
> > > 2. Usually, to simplify the check, the path in the sha512 should use a
> > > relative local path (that's the issue here: the sha512 file should a
> > > relative path but relative to the root folder).
> > > 3. Since the checksums are correct, we can update dist.apache.org to
> use
> > > the related one level path. I fixed the sha512 files on
> dist.apache.org.
> > >
> > > @Yong and @Dmitri can you check again? It should be fine by default
> now.
> > >
> > > Regards
> > > JB
> > >
> > > On Wed, Apr 22, 2026 at 2:19 AM Dmitri Bourlatchkov <di...@apache.org>
> > > wrote:
> > >
> > > > Correction: I found the key. Signatures are OK.
> > > >
> > > > Still, the other issues remain.
> > > >
> > > > Cheers,
> > > > Dmitri.
> > > >
> > > > On Tue, Apr 21, 2026 at 8:06 PM Dmitri Bourlatchkov <
> dimas@apache.org>
> > > > wrote:
> > > >
> > > > > Hi Adnan,
> > > > >
> > > > > -1 (binding)
> > > > >
> > > > > Sorry for nitpicks, but checksums do not easily match based on data
> > in
> > > > > dist - file paths are not aligned:
> > > > >
> > > > > $ sha512sum -c *.sha512
> > > > > sha512sum:
> > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl:
> > > > No
> > > > > such file or directory
> > > > > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl: FAILED
> > > open
> > > > > or read
> > > > > sha512sum: WARNING: 1 listed file could not be read
> > > > > sha512sum: client/python/dist/apache_polaris-1.4.0rc1.tar.gz: No
> such
> > > > file
> > > > > or directory
> > > > > client/python/dist/apache_polaris-1.4.0rc1.tar.gz: FAILED open or
> > read
> > > > > sha512sum: WARNING: 1 listed file could not be read
> > > > >
> > > > > Signature verification failed:
> > > > >
> > > > > $ gpg --verify apache_polaris-1.4.0rc1-py3-none-any.whl.asc
> > > > > apache_polaris-1.4.0rc1-py3-none-any.whl
> > > > > gpg: Signature made Tue 21 Apr 2026 01:30:38 AM EDT
> > > > > gpg: using RSA key
> > > > 81010346A868FB157879A81354F298C6A64BECCC
> > > > > gpg: Can't check signature: No public key
> > > > >
> > > > > I downloaded the latest KEYS file... Did I miss something?.. What
> is
> > > this
> > > > > RSA key?
> > > > >
> > > > > Also file names contain "rc1", which I think is still not great. I
> > > > believe
> > > > > the RC set of files on dist/dev should be exactly as the final set
> of
> > > > > release files if the vote is successful, right?
> > > > >
> > > > > Cheers,
> > > > > Dmitri.
> > > > >
> > > > > On Tue, Apr 21, 2026 at 1:38 AM Adnan Hemani via dev <
> > > > > dev@polaris.apache.org> wrote:
> > > > >
> > > > >> Uploaded the source distribution on dist.apache.org.
> > > > >>
> > > > >> Yong, I'm not sure what you're pointing out. Can you explain
> > further?
> > > > >>
> > > > >> Best,
> > > > >> Adnan Hemani
> > > > >>
> > > > >> On Mon, Apr 20, 2026 at 10:03 PM Yong Zheng <yz...@apache.org>
> > > wrote:
> > > > >>
> > > > >> > Maybe wrong path in the sha512:
> > > > >> > cat apache_polaris-1.4.0rc1-py3-none-any.whl.sha512
> > > > >> >
> > > > >>
> > > >
> > >
> >
> beedace582c330e2602a643364fbf5806c3c7564897384f42e1ac546ed69e06c64cb29d7ab32787b05078785416c387be6ce66ce63e20ba6ebf9a36d16332e7d
> > > > >> > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl
> > > > >> >
> > > > >> > Thanks,
> > > > >> > Yong Zheng
> > > > >> >
> > > > >> > On 2026/04/20 23:41:04 Adnan Hemani via dev wrote:
> > > > >> > > Hi all,
> > > > >> > >
> > > > >> > > I propose that we release the following RC as the official
> > Apache
> > > > >> Polaris
> > > > >> > > Python CLI 1.4.0 release.
> > > > >> > >
> > > > >> > > SVN:
> > > > >>
> https://dist.apache.org/repos/dist/dev/polaris/python-client/1.4.0/
> > > > >> > > Test PyPI:
> > https://test.pypi.org/project/apache-polaris/1.4.0rc1/
> > > > >> > >
> > > > >> > > Starting with Apache Polaris 1.5.0, the CLI should be released
> > > > >> alongside
> > > > >> > > all other release artifacts within the full Polaris Release
> > > > Candidate.
> > > > >> > Work
> > > > >> > > to make this happen can be found here:
> > > > >> > > https://github.com/apache/polaris/pull/4220
> > > > >> > >
> > > > >> > > Please vote in the next 72 hours.
> > > > >> > >
> > > > >> > > [ ] +1 Release this as Apache Polaris 1.4.0
> > > > >> > > [ ] +0
> > > > >> > > [ ] -1 Do not release this because...
> > > > >> > >
> > > > >> > > Only PMC members have binding votes, but other community
> members
> > > are
> > > > >> > > encouraged to cast non-binding votes.
> > > > >> > > This vote will pass if there are 3 binding +1 votes and more
> > > binding
> > > > >> +1
> > > > >> > > votes than -1 votes.
> > > > >> > >
> > > > >> > > Best,
> > > > >> > > Adnan Hemani
> > > > >> > >
> > > > >> >
> > > > >>
> > > > >
> > > >
> > >
> >
>
Re: [VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Posted by Jean-Baptiste Onofré <jb...@nanthrax.net>.
Usually we don't put the rc in the staged artifacts, exactly to avoid to
change the checksum files after (only the vote should have RC, not the
artifacts).
I don't consider the License in package info as a blocker (the actual
LICENSE file is included), but clearly to be fixed.
Regarding, these issues, I suggest to cancel this vote to prepare a clean
RC2 with clean artifacts and updated package info.
Regards
JB
On Wed, Apr 22, 2026 at 4:02 PM Dmitri Bourlatchkov <di...@apache.org>
wrote:
> Hi JB,
>
> Thanks for fixing the checksum files. They pass validation now. Signatures
> are OK too. The package installs fine.
>
> However, I still vote -1 because of the RC tags and missing "License" in
> package info (details below).
>
> 1) SHA files still reference files with "rc1" in the name. If we publish
> them, we'll have to modify the content after voting, which is not nice.
>
> $ cat apache_polaris-1.4.0rc1.tar.gz.sha512
>
> 5c8b2d967965e9b578ca1e4e3e5d659a5bd5cdb3ee2ae1622a2eae95605e5e8683902b5d3044736220eb48c29d4dd70275eab95528270ebbb411a8e71f8c159c
> apache_polaris-1.4.0rc1.tar.gz
>
> 2) Python package info still shows a version with "rc1" after installation.
> As I noted before, I believe this will require re-packaging after the vote
> (to avoid "RC" in the final release).
>
> $ venv/bin/pip show apache-polaris
> Name: apache-polaris
> Version: 1.4.0rc1
> Summary: Apache Polaris
> Home-page:
> Author:
> Author-email: Apache Software Foundation <de...@polaris.apache.org>
> License:
> Location:
> /home/dmitri/Downloads/pol-cli-rc1/venv/lib/python3.12/site-packages
> Requires: boto3, prettytable, pydantic, python-dateutil, pyyaml,
> typing-extensions, urllib3
> Required-by:
>
> Confirmed manually: the "rc1" tag is present in PKG-INFO inside the signed
> archive too. So, removing the RC tag will require re-signing and will
> invalidate signature checks during the vote.
>
> 3) Licence name is missing from package info.
>
> 4) (minor) Home-page and author email are missing from package info
>
> Sorry for being picky, but I believe these matters are important.
>
> Cheers,
> Dmitri.
>
> On Wed, Apr 22, 2026 at 1:32 AM Jean-Baptiste Onofré <jb...@nanthrax.net>
> wrote:
>
> > Hi folks,
> >
> > 1. The checksums are basically correct (in terms of pure checksum), you
> can
> > verify for instance with this sha512 content:
> >
> >
> >
> 5c8b2d967965e9b578ca1e4e3e5d659a5bd5cdb3ee2ae1622a2eae95605e5e8683902b5d3044736220eb48c29d4dd70275eab95528270ebbb411a8e71f8c159c
> > apache_polaris-1.4.0rc1.tar.gz
> >
> > for instance.
> >
> > 2. Usually, to simplify the check, the path in the sha512 should use a
> > relative local path (that's the issue here: the sha512 file should a
> > relative path but relative to the root folder).
> > 3. Since the checksums are correct, we can update dist.apache.org to use
> > the related one level path. I fixed the sha512 files on dist.apache.org.
> >
> > @Yong and @Dmitri can you check again? It should be fine by default now.
> >
> > Regards
> > JB
> >
> > On Wed, Apr 22, 2026 at 2:19 AM Dmitri Bourlatchkov <di...@apache.org>
> > wrote:
> >
> > > Correction: I found the key. Signatures are OK.
> > >
> > > Still, the other issues remain.
> > >
> > > Cheers,
> > > Dmitri.
> > >
> > > On Tue, Apr 21, 2026 at 8:06 PM Dmitri Bourlatchkov <di...@apache.org>
> > > wrote:
> > >
> > > > Hi Adnan,
> > > >
> > > > -1 (binding)
> > > >
> > > > Sorry for nitpicks, but checksums do not easily match based on data
> in
> > > > dist - file paths are not aligned:
> > > >
> > > > $ sha512sum -c *.sha512
> > > > sha512sum:
> client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl:
> > > No
> > > > such file or directory
> > > > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl: FAILED
> > open
> > > > or read
> > > > sha512sum: WARNING: 1 listed file could not be read
> > > > sha512sum: client/python/dist/apache_polaris-1.4.0rc1.tar.gz: No such
> > > file
> > > > or directory
> > > > client/python/dist/apache_polaris-1.4.0rc1.tar.gz: FAILED open or
> read
> > > > sha512sum: WARNING: 1 listed file could not be read
> > > >
> > > > Signature verification failed:
> > > >
> > > > $ gpg --verify apache_polaris-1.4.0rc1-py3-none-any.whl.asc
> > > > apache_polaris-1.4.0rc1-py3-none-any.whl
> > > > gpg: Signature made Tue 21 Apr 2026 01:30:38 AM EDT
> > > > gpg: using RSA key
> > > 81010346A868FB157879A81354F298C6A64BECCC
> > > > gpg: Can't check signature: No public key
> > > >
> > > > I downloaded the latest KEYS file... Did I miss something?.. What is
> > this
> > > > RSA key?
> > > >
> > > > Also file names contain "rc1", which I think is still not great. I
> > > believe
> > > > the RC set of files on dist/dev should be exactly as the final set of
> > > > release files if the vote is successful, right?
> > > >
> > > > Cheers,
> > > > Dmitri.
> > > >
> > > > On Tue, Apr 21, 2026 at 1:38 AM Adnan Hemani via dev <
> > > > dev@polaris.apache.org> wrote:
> > > >
> > > >> Uploaded the source distribution on dist.apache.org.
> > > >>
> > > >> Yong, I'm not sure what you're pointing out. Can you explain
> further?
> > > >>
> > > >> Best,
> > > >> Adnan Hemani
> > > >>
> > > >> On Mon, Apr 20, 2026 at 10:03 PM Yong Zheng <yz...@apache.org>
> > wrote:
> > > >>
> > > >> > Maybe wrong path in the sha512:
> > > >> > cat apache_polaris-1.4.0rc1-py3-none-any.whl.sha512
> > > >> >
> > > >>
> > >
> >
> beedace582c330e2602a643364fbf5806c3c7564897384f42e1ac546ed69e06c64cb29d7ab32787b05078785416c387be6ce66ce63e20ba6ebf9a36d16332e7d
> > > >> > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl
> > > >> >
> > > >> > Thanks,
> > > >> > Yong Zheng
> > > >> >
> > > >> > On 2026/04/20 23:41:04 Adnan Hemani via dev wrote:
> > > >> > > Hi all,
> > > >> > >
> > > >> > > I propose that we release the following RC as the official
> Apache
> > > >> Polaris
> > > >> > > Python CLI 1.4.0 release.
> > > >> > >
> > > >> > > SVN:
> > > >> https://dist.apache.org/repos/dist/dev/polaris/python-client/1.4.0/
> > > >> > > Test PyPI:
> https://test.pypi.org/project/apache-polaris/1.4.0rc1/
> > > >> > >
> > > >> > > Starting with Apache Polaris 1.5.0, the CLI should be released
> > > >> alongside
> > > >> > > all other release artifacts within the full Polaris Release
> > > Candidate.
> > > >> > Work
> > > >> > > to make this happen can be found here:
> > > >> > > https://github.com/apache/polaris/pull/4220
> > > >> > >
> > > >> > > Please vote in the next 72 hours.
> > > >> > >
> > > >> > > [ ] +1 Release this as Apache Polaris 1.4.0
> > > >> > > [ ] +0
> > > >> > > [ ] -1 Do not release this because...
> > > >> > >
> > > >> > > Only PMC members have binding votes, but other community members
> > are
> > > >> > > encouraged to cast non-binding votes.
> > > >> > > This vote will pass if there are 3 binding +1 votes and more
> > binding
> > > >> +1
> > > >> > > votes than -1 votes.
> > > >> > >
> > > >> > > Best,
> > > >> > > Adnan Hemani
> > > >> > >
> > > >> >
> > > >>
> > > >
> > >
> >
>
Re: [VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Posted by Dmitri Bourlatchkov <di...@apache.org>.
Hi JB,
Thanks for fixing the checksum files. They pass validation now. Signatures
are OK too. The package installs fine.
However, I still vote -1 because of the RC tags and missing "License" in
package info (details below).
1) SHA files still reference files with "rc1" in the name. If we publish
them, we'll have to modify the content after voting, which is not nice.
$ cat apache_polaris-1.4.0rc1.tar.gz.sha512
5c8b2d967965e9b578ca1e4e3e5d659a5bd5cdb3ee2ae1622a2eae95605e5e8683902b5d3044736220eb48c29d4dd70275eab95528270ebbb411a8e71f8c159c
apache_polaris-1.4.0rc1.tar.gz
2) Python package info still shows a version with "rc1" after installation.
As I noted before, I believe this will require re-packaging after the vote
(to avoid "RC" in the final release).
$ venv/bin/pip show apache-polaris
Name: apache-polaris
Version: 1.4.0rc1
Summary: Apache Polaris
Home-page:
Author:
Author-email: Apache Software Foundation <de...@polaris.apache.org>
License:
Location:
/home/dmitri/Downloads/pol-cli-rc1/venv/lib/python3.12/site-packages
Requires: boto3, prettytable, pydantic, python-dateutil, pyyaml,
typing-extensions, urllib3
Required-by:
Confirmed manually: the "rc1" tag is present in PKG-INFO inside the signed
archive too. So, removing the RC tag will require re-signing and will
invalidate signature checks during the vote.
3) Licence name is missing from package info.
4) (minor) Home-page and author email are missing from package info
Sorry for being picky, but I believe these matters are important.
Cheers,
Dmitri.
On Wed, Apr 22, 2026 at 1:32 AM Jean-Baptiste Onofré <jb...@nanthrax.net>
wrote:
> Hi folks,
>
> 1. The checksums are basically correct (in terms of pure checksum), you can
> verify for instance with this sha512 content:
>
>
> 5c8b2d967965e9b578ca1e4e3e5d659a5bd5cdb3ee2ae1622a2eae95605e5e8683902b5d3044736220eb48c29d4dd70275eab95528270ebbb411a8e71f8c159c
> apache_polaris-1.4.0rc1.tar.gz
>
> for instance.
>
> 2. Usually, to simplify the check, the path in the sha512 should use a
> relative local path (that's the issue here: the sha512 file should a
> relative path but relative to the root folder).
> 3. Since the checksums are correct, we can update dist.apache.org to use
> the related one level path. I fixed the sha512 files on dist.apache.org.
>
> @Yong and @Dmitri can you check again? It should be fine by default now.
>
> Regards
> JB
>
> On Wed, Apr 22, 2026 at 2:19 AM Dmitri Bourlatchkov <di...@apache.org>
> wrote:
>
> > Correction: I found the key. Signatures are OK.
> >
> > Still, the other issues remain.
> >
> > Cheers,
> > Dmitri.
> >
> > On Tue, Apr 21, 2026 at 8:06 PM Dmitri Bourlatchkov <di...@apache.org>
> > wrote:
> >
> > > Hi Adnan,
> > >
> > > -1 (binding)
> > >
> > > Sorry for nitpicks, but checksums do not easily match based on data in
> > > dist - file paths are not aligned:
> > >
> > > $ sha512sum -c *.sha512
> > > sha512sum: client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl:
> > No
> > > such file or directory
> > > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl: FAILED
> open
> > > or read
> > > sha512sum: WARNING: 1 listed file could not be read
> > > sha512sum: client/python/dist/apache_polaris-1.4.0rc1.tar.gz: No such
> > file
> > > or directory
> > > client/python/dist/apache_polaris-1.4.0rc1.tar.gz: FAILED open or read
> > > sha512sum: WARNING: 1 listed file could not be read
> > >
> > > Signature verification failed:
> > >
> > > $ gpg --verify apache_polaris-1.4.0rc1-py3-none-any.whl.asc
> > > apache_polaris-1.4.0rc1-py3-none-any.whl
> > > gpg: Signature made Tue 21 Apr 2026 01:30:38 AM EDT
> > > gpg: using RSA key
> > 81010346A868FB157879A81354F298C6A64BECCC
> > > gpg: Can't check signature: No public key
> > >
> > > I downloaded the latest KEYS file... Did I miss something?.. What is
> this
> > > RSA key?
> > >
> > > Also file names contain "rc1", which I think is still not great. I
> > believe
> > > the RC set of files on dist/dev should be exactly as the final set of
> > > release files if the vote is successful, right?
> > >
> > > Cheers,
> > > Dmitri.
> > >
> > > On Tue, Apr 21, 2026 at 1:38 AM Adnan Hemani via dev <
> > > dev@polaris.apache.org> wrote:
> > >
> > >> Uploaded the source distribution on dist.apache.org.
> > >>
> > >> Yong, I'm not sure what you're pointing out. Can you explain further?
> > >>
> > >> Best,
> > >> Adnan Hemani
> > >>
> > >> On Mon, Apr 20, 2026 at 10:03 PM Yong Zheng <yz...@apache.org>
> wrote:
> > >>
> > >> > Maybe wrong path in the sha512:
> > >> > cat apache_polaris-1.4.0rc1-py3-none-any.whl.sha512
> > >> >
> > >>
> >
> beedace582c330e2602a643364fbf5806c3c7564897384f42e1ac546ed69e06c64cb29d7ab32787b05078785416c387be6ce66ce63e20ba6ebf9a36d16332e7d
> > >> > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl
> > >> >
> > >> > Thanks,
> > >> > Yong Zheng
> > >> >
> > >> > On 2026/04/20 23:41:04 Adnan Hemani via dev wrote:
> > >> > > Hi all,
> > >> > >
> > >> > > I propose that we release the following RC as the official Apache
> > >> Polaris
> > >> > > Python CLI 1.4.0 release.
> > >> > >
> > >> > > SVN:
> > >> https://dist.apache.org/repos/dist/dev/polaris/python-client/1.4.0/
> > >> > > Test PyPI: https://test.pypi.org/project/apache-polaris/1.4.0rc1/
> > >> > >
> > >> > > Starting with Apache Polaris 1.5.0, the CLI should be released
> > >> alongside
> > >> > > all other release artifacts within the full Polaris Release
> > Candidate.
> > >> > Work
> > >> > > to make this happen can be found here:
> > >> > > https://github.com/apache/polaris/pull/4220
> > >> > >
> > >> > > Please vote in the next 72 hours.
> > >> > >
> > >> > > [ ] +1 Release this as Apache Polaris 1.4.0
> > >> > > [ ] +0
> > >> > > [ ] -1 Do not release this because...
> > >> > >
> > >> > > Only PMC members have binding votes, but other community members
> are
> > >> > > encouraged to cast non-binding votes.
> > >> > > This vote will pass if there are 3 binding +1 votes and more
> binding
> > >> +1
> > >> > > votes than -1 votes.
> > >> > >
> > >> > > Best,
> > >> > > Adnan Hemani
> > >> > >
> > >> >
> > >>
> > >
> >
>
Re: [VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Posted by Jean-Baptiste Onofré <jb...@nanthrax.net>.
Hi folks,
1. The checksums are basically correct (in terms of pure checksum), you can
verify for instance with this sha512 content:
5c8b2d967965e9b578ca1e4e3e5d659a5bd5cdb3ee2ae1622a2eae95605e5e8683902b5d3044736220eb48c29d4dd70275eab95528270ebbb411a8e71f8c159c
apache_polaris-1.4.0rc1.tar.gz
for instance.
2. Usually, to simplify the check, the path in the sha512 should use a
relative local path (that's the issue here: the sha512 file should a
relative path but relative to the root folder).
3. Since the checksums are correct, we can update dist.apache.org to use
the related one level path. I fixed the sha512 files on dist.apache.org.
@Yong and @Dmitri can you check again? It should be fine by default now.
Regards
JB
On Wed, Apr 22, 2026 at 2:19 AM Dmitri Bourlatchkov <di...@apache.org>
wrote:
> Correction: I found the key. Signatures are OK.
>
> Still, the other issues remain.
>
> Cheers,
> Dmitri.
>
> On Tue, Apr 21, 2026 at 8:06 PM Dmitri Bourlatchkov <di...@apache.org>
> wrote:
>
> > Hi Adnan,
> >
> > -1 (binding)
> >
> > Sorry for nitpicks, but checksums do not easily match based on data in
> > dist - file paths are not aligned:
> >
> > $ sha512sum -c *.sha512
> > sha512sum: client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl:
> No
> > such file or directory
> > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl: FAILED open
> > or read
> > sha512sum: WARNING: 1 listed file could not be read
> > sha512sum: client/python/dist/apache_polaris-1.4.0rc1.tar.gz: No such
> file
> > or directory
> > client/python/dist/apache_polaris-1.4.0rc1.tar.gz: FAILED open or read
> > sha512sum: WARNING: 1 listed file could not be read
> >
> > Signature verification failed:
> >
> > $ gpg --verify apache_polaris-1.4.0rc1-py3-none-any.whl.asc
> > apache_polaris-1.4.0rc1-py3-none-any.whl
> > gpg: Signature made Tue 21 Apr 2026 01:30:38 AM EDT
> > gpg: using RSA key
> 81010346A868FB157879A81354F298C6A64BECCC
> > gpg: Can't check signature: No public key
> >
> > I downloaded the latest KEYS file... Did I miss something?.. What is this
> > RSA key?
> >
> > Also file names contain "rc1", which I think is still not great. I
> believe
> > the RC set of files on dist/dev should be exactly as the final set of
> > release files if the vote is successful, right?
> >
> > Cheers,
> > Dmitri.
> >
> > On Tue, Apr 21, 2026 at 1:38 AM Adnan Hemani via dev <
> > dev@polaris.apache.org> wrote:
> >
> >> Uploaded the source distribution on dist.apache.org.
> >>
> >> Yong, I'm not sure what you're pointing out. Can you explain further?
> >>
> >> Best,
> >> Adnan Hemani
> >>
> >> On Mon, Apr 20, 2026 at 10:03 PM Yong Zheng <yz...@apache.org> wrote:
> >>
> >> > Maybe wrong path in the sha512:
> >> > cat apache_polaris-1.4.0rc1-py3-none-any.whl.sha512
> >> >
> >>
> beedace582c330e2602a643364fbf5806c3c7564897384f42e1ac546ed69e06c64cb29d7ab32787b05078785416c387be6ce66ce63e20ba6ebf9a36d16332e7d
> >> > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl
> >> >
> >> > Thanks,
> >> > Yong Zheng
> >> >
> >> > On 2026/04/20 23:41:04 Adnan Hemani via dev wrote:
> >> > > Hi all,
> >> > >
> >> > > I propose that we release the following RC as the official Apache
> >> Polaris
> >> > > Python CLI 1.4.0 release.
> >> > >
> >> > > SVN:
> >> https://dist.apache.org/repos/dist/dev/polaris/python-client/1.4.0/
> >> > > Test PyPI: https://test.pypi.org/project/apache-polaris/1.4.0rc1/
> >> > >
> >> > > Starting with Apache Polaris 1.5.0, the CLI should be released
> >> alongside
> >> > > all other release artifacts within the full Polaris Release
> Candidate.
> >> > Work
> >> > > to make this happen can be found here:
> >> > > https://github.com/apache/polaris/pull/4220
> >> > >
> >> > > Please vote in the next 72 hours.
> >> > >
> >> > > [ ] +1 Release this as Apache Polaris 1.4.0
> >> > > [ ] +0
> >> > > [ ] -1 Do not release this because...
> >> > >
> >> > > Only PMC members have binding votes, but other community members are
> >> > > encouraged to cast non-binding votes.
> >> > > This vote will pass if there are 3 binding +1 votes and more binding
> >> +1
> >> > > votes than -1 votes.
> >> > >
> >> > > Best,
> >> > > Adnan Hemani
> >> > >
> >> >
> >>
> >
>
Re: [VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Posted by Dmitri Bourlatchkov <di...@apache.org>.
Correction: I found the key. Signatures are OK.
Still, the other issues remain.
Cheers,
Dmitri.
On Tue, Apr 21, 2026 at 8:06 PM Dmitri Bourlatchkov <di...@apache.org>
wrote:
> Hi Adnan,
>
> -1 (binding)
>
> Sorry for nitpicks, but checksums do not easily match based on data in
> dist - file paths are not aligned:
>
> $ sha512sum -c *.sha512
> sha512sum: client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl: No
> such file or directory
> client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl: FAILED open
> or read
> sha512sum: WARNING: 1 listed file could not be read
> sha512sum: client/python/dist/apache_polaris-1.4.0rc1.tar.gz: No such file
> or directory
> client/python/dist/apache_polaris-1.4.0rc1.tar.gz: FAILED open or read
> sha512sum: WARNING: 1 listed file could not be read
>
> Signature verification failed:
>
> $ gpg --verify apache_polaris-1.4.0rc1-py3-none-any.whl.asc
> apache_polaris-1.4.0rc1-py3-none-any.whl
> gpg: Signature made Tue 21 Apr 2026 01:30:38 AM EDT
> gpg: using RSA key 81010346A868FB157879A81354F298C6A64BECCC
> gpg: Can't check signature: No public key
>
> I downloaded the latest KEYS file... Did I miss something?.. What is this
> RSA key?
>
> Also file names contain "rc1", which I think is still not great. I believe
> the RC set of files on dist/dev should be exactly as the final set of
> release files if the vote is successful, right?
>
> Cheers,
> Dmitri.
>
> On Tue, Apr 21, 2026 at 1:38 AM Adnan Hemani via dev <
> dev@polaris.apache.org> wrote:
>
>> Uploaded the source distribution on dist.apache.org.
>>
>> Yong, I'm not sure what you're pointing out. Can you explain further?
>>
>> Best,
>> Adnan Hemani
>>
>> On Mon, Apr 20, 2026 at 10:03 PM Yong Zheng <yz...@apache.org> wrote:
>>
>> > Maybe wrong path in the sha512:
>> > cat apache_polaris-1.4.0rc1-py3-none-any.whl.sha512
>> >
>> beedace582c330e2602a643364fbf5806c3c7564897384f42e1ac546ed69e06c64cb29d7ab32787b05078785416c387be6ce66ce63e20ba6ebf9a36d16332e7d
>> > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl
>> >
>> > Thanks,
>> > Yong Zheng
>> >
>> > On 2026/04/20 23:41:04 Adnan Hemani via dev wrote:
>> > > Hi all,
>> > >
>> > > I propose that we release the following RC as the official Apache
>> Polaris
>> > > Python CLI 1.4.0 release.
>> > >
>> > > SVN:
>> https://dist.apache.org/repos/dist/dev/polaris/python-client/1.4.0/
>> > > Test PyPI: https://test.pypi.org/project/apache-polaris/1.4.0rc1/
>> > >
>> > > Starting with Apache Polaris 1.5.0, the CLI should be released
>> alongside
>> > > all other release artifacts within the full Polaris Release Candidate.
>> > Work
>> > > to make this happen can be found here:
>> > > https://github.com/apache/polaris/pull/4220
>> > >
>> > > Please vote in the next 72 hours.
>> > >
>> > > [ ] +1 Release this as Apache Polaris 1.4.0
>> > > [ ] +0
>> > > [ ] -1 Do not release this because...
>> > >
>> > > Only PMC members have binding votes, but other community members are
>> > > encouraged to cast non-binding votes.
>> > > This vote will pass if there are 3 binding +1 votes and more binding
>> +1
>> > > votes than -1 votes.
>> > >
>> > > Best,
>> > > Adnan Hemani
>> > >
>> >
>>
>
Re: [VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Posted by Dmitri Bourlatchkov <di...@apache.org>.
Hi Adnan,
-1 (binding)
Sorry for nitpicks, but checksums do not easily match based on data in dist
- file paths are not aligned:
$ sha512sum -c *.sha512
sha512sum: client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl: No
such file or directory
client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl: FAILED open or
read
sha512sum: WARNING: 1 listed file could not be read
sha512sum: client/python/dist/apache_polaris-1.4.0rc1.tar.gz: No such file
or directory
client/python/dist/apache_polaris-1.4.0rc1.tar.gz: FAILED open or read
sha512sum: WARNING: 1 listed file could not be read
Signature verification failed:
$ gpg --verify apache_polaris-1.4.0rc1-py3-none-any.whl.asc
apache_polaris-1.4.0rc1-py3-none-any.whl
gpg: Signature made Tue 21 Apr 2026 01:30:38 AM EDT
gpg: using RSA key 81010346A868FB157879A81354F298C6A64BECCC
gpg: Can't check signature: No public key
I downloaded the latest KEYS file... Did I miss something?.. What is this
RSA key?
Also file names contain "rc1", which I think is still not great. I believe
the RC set of files on dist/dev should be exactly as the final set of
release files if the vote is successful, right?
Cheers,
Dmitri.
On Tue, Apr 21, 2026 at 1:38 AM Adnan Hemani via dev <de...@polaris.apache.org>
wrote:
> Uploaded the source distribution on dist.apache.org.
>
> Yong, I'm not sure what you're pointing out. Can you explain further?
>
> Best,
> Adnan Hemani
>
> On Mon, Apr 20, 2026 at 10:03 PM Yong Zheng <yz...@apache.org> wrote:
>
> > Maybe wrong path in the sha512:
> > cat apache_polaris-1.4.0rc1-py3-none-any.whl.sha512
> >
> beedace582c330e2602a643364fbf5806c3c7564897384f42e1ac546ed69e06c64cb29d7ab32787b05078785416c387be6ce66ce63e20ba6ebf9a36d16332e7d
> > client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl
> >
> > Thanks,
> > Yong Zheng
> >
> > On 2026/04/20 23:41:04 Adnan Hemani via dev wrote:
> > > Hi all,
> > >
> > > I propose that we release the following RC as the official Apache
> Polaris
> > > Python CLI 1.4.0 release.
> > >
> > > SVN:
> https://dist.apache.org/repos/dist/dev/polaris/python-client/1.4.0/
> > > Test PyPI: https://test.pypi.org/project/apache-polaris/1.4.0rc1/
> > >
> > > Starting with Apache Polaris 1.5.0, the CLI should be released
> alongside
> > > all other release artifacts within the full Polaris Release Candidate.
> > Work
> > > to make this happen can be found here:
> > > https://github.com/apache/polaris/pull/4220
> > >
> > > Please vote in the next 72 hours.
> > >
> > > [ ] +1 Release this as Apache Polaris 1.4.0
> > > [ ] +0
> > > [ ] -1 Do not release this because...
> > >
> > > Only PMC members have binding votes, but other community members are
> > > encouraged to cast non-binding votes.
> > > This vote will pass if there are 3 binding +1 votes and more binding +1
> > > votes than -1 votes.
> > >
> > > Best,
> > > Adnan Hemani
> > >
> >
>
Re: [VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Posted by Adnan Hemani via dev <de...@polaris.apache.org>.
Uploaded the source distribution on dist.apache.org.
Yong, I'm not sure what you're pointing out. Can you explain further?
Best,
Adnan Hemani
On Mon, Apr 20, 2026 at 10:03 PM Yong Zheng <yz...@apache.org> wrote:
> Maybe wrong path in the sha512:
> cat apache_polaris-1.4.0rc1-py3-none-any.whl.sha512
> beedace582c330e2602a643364fbf5806c3c7564897384f42e1ac546ed69e06c64cb29d7ab32787b05078785416c387be6ce66ce63e20ba6ebf9a36d16332e7d
> client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl
>
> Thanks,
> Yong Zheng
>
> On 2026/04/20 23:41:04 Adnan Hemani via dev wrote:
> > Hi all,
> >
> > I propose that we release the following RC as the official Apache Polaris
> > Python CLI 1.4.0 release.
> >
> > SVN: https://dist.apache.org/repos/dist/dev/polaris/python-client/1.4.0/
> > Test PyPI: https://test.pypi.org/project/apache-polaris/1.4.0rc1/
> >
> > Starting with Apache Polaris 1.5.0, the CLI should be released alongside
> > all other release artifacts within the full Polaris Release Candidate.
> Work
> > to make this happen can be found here:
> > https://github.com/apache/polaris/pull/4220
> >
> > Please vote in the next 72 hours.
> >
> > [ ] +1 Release this as Apache Polaris 1.4.0
> > [ ] +0
> > [ ] -1 Do not release this because...
> >
> > Only PMC members have binding votes, but other community members are
> > encouraged to cast non-binding votes.
> > This vote will pass if there are 3 binding +1 votes and more binding +1
> > votes than -1 votes.
> >
> > Best,
> > Adnan Hemani
> >
>
Re: [VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Posted by Yong Zheng <yz...@apache.org>.
Maybe wrong path in the sha512:
cat apache_polaris-1.4.0rc1-py3-none-any.whl.sha512
beedace582c330e2602a643364fbf5806c3c7564897384f42e1ac546ed69e06c64cb29d7ab32787b05078785416c387be6ce66ce63e20ba6ebf9a36d16332e7d client/python/dist/apache_polaris-1.4.0rc1-py3-none-any.whl
Thanks,
Yong Zheng
On 2026/04/20 23:41:04 Adnan Hemani via dev wrote:
> Hi all,
>
> I propose that we release the following RC as the official Apache Polaris
> Python CLI 1.4.0 release.
>
> SVN: https://dist.apache.org/repos/dist/dev/polaris/python-client/1.4.0/
> Test PyPI: https://test.pypi.org/project/apache-polaris/1.4.0rc1/
>
> Starting with Apache Polaris 1.5.0, the CLI should be released alongside
> all other release artifacts within the full Polaris Release Candidate. Work
> to make this happen can be found here:
> https://github.com/apache/polaris/pull/4220
>
> Please vote in the next 72 hours.
>
> [ ] +1 Release this as Apache Polaris 1.4.0
> [ ] +0
> [ ] -1 Do not release this because...
>
> Only PMC members have binding votes, but other community members are
> encouraged to cast non-binding votes.
> This vote will pass if there are 3 binding +1 votes and more binding +1
> votes than -1 votes.
>
> Best,
> Adnan Hemani
>
Re: [VOTE] Release Apache Polaris Python CLI 1.4.0 (rc1)
Posted by Jean-Baptiste Onofré <jb...@nanthrax.net>.
0 (binding)
dist.apache.org should contain both whl but also the source distribution,
similar to helm chart (where we have prov and source distributions).
If you add source distribution on dist (you can do it manually for now,
including signature and checksum), I can change my vote to +1.
Regards
JB
On Tue, Apr 21, 2026 at 1:41 AM Adnan Hemani via dev <de...@polaris.apache.org>
wrote:
> Hi all,
>
> I propose that we release the following RC as the official Apache Polaris
> Python CLI 1.4.0 release.
>
> SVN: https://dist.apache.org/repos/dist/dev/polaris/python-client/1.4.0/
> Test PyPI: https://test.pypi.org/project/apache-polaris/1.4.0rc1/
>
> Starting with Apache Polaris 1.5.0, the CLI should be released alongside
> all other release artifacts within the full Polaris Release Candidate. Work
> to make this happen can be found here:
> https://github.com/apache/polaris/pull/4220
>
> Please vote in the next 72 hours.
>
> [ ] +1 Release this as Apache Polaris 1.4.0
> [ ] +0
> [ ] -1 Do not release this because...
>
> Only PMC members have binding votes, but other community members are
> encouraged to cast non-binding votes.
> This vote will pass if there are 3 binding +1 votes and more binding +1
> votes than -1 votes.
>
> Best,
> Adnan Hemani
>