You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@fory.apache.org by ch...@apache.org on 2026/10/07 03:44:01 UTC
(fory) branch main updated: fix(release): archive RC tags without temporary license commits (#4134)
This is an automated email from the ASF dual-hosted git repository.
chaokunyang pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/fory.git
The following commit(s) were added to refs/heads/main by this push:
new dcf8d24f2 fix(release): archive RC tags without temporary license commits (#4134)
dcf8d24f2 is described below
commit dcf8d24f2c0c2a502d405ef0fb9d49b973dc9137
Author: Shawn Yang <sh...@gmail.com>
AuthorDate: Wed Oct 7 11:43:56 2026 +0800
fix(release): archive RC tags without temporary license commits (#4134)
Source releases currently rewrite `LICENSE`, create a temporary commit,
archive it, and reset the branch. The resulting tarball contains an
unpublished commit ID and cannot be reproduced directly from the RC tag.
Move benchmark-only attribution into `benchmarks/LICENSE`, retaining the
core Kryo attribution in the root license. Build source artifacts
directly from an explicit `--rc-tag`, without modifying tracked files or
Git refs, and update the release instructions to verify the embedded
commit ID. This follows [PJ Fanning's suggestion in the 1.7.7 RC1
vote](https://lists.apache.org/thread/zb2yzboxf28lz7wm0zlvscqvn0pntp62).
Validation:
- Ran the actual `ci/release.py build -v 0.0.0 --rc-tag ...` command for
lightweight and annotated tags in a local fixture repository, with HEAD
advanced beyond the tags and an ephemeral GPG test key.
- Both archives match direct `git archive` output byte for byte, contain
the tagged commit ID and unchanged root license, exclude benchmarks, and
pass signature/SHA-512 verification. Branch, HEAD, refs, reflogs, and
working tree remain unchanged.
- Verified all eight benchmark attribution paths were preserved, with
Apache/Kryo license texts and core attribution intact.
- Ruff, Prettier, markdownlint, and `git diff --check` pass.
---
.agents/skills/fory-release/SKILL.md | 12 ++-
LICENSE | 11 ---
LICENSE => benchmarks/LICENSE | 142 +++++------------------------------
ci/release.py | 67 +++++------------
4 files changed, 47 insertions(+), 185 deletions(-)
diff --git a/.agents/skills/fory-release/SKILL.md b/.agents/skills/fory-release/SKILL.md
index 1f2a2bc7c..a2941d399 100644
--- a/.agents/skills/fory-release/SKILL.md
+++ b/.agents/skills/fory-release/SKILL.md
@@ -172,20 +172,28 @@ incomplete runs as successful.
### 7. Build the ASF source release
-Start from the clean release branch. The build temporarily commits release-archive changes and resets them, so verify that it restores the original commit and clean tree.
+Start from the clean release branch and build the exact RC tag. The build must
+archive that tag without changing tracked files, creating commits, or moving Git
+refs. Benchmark-specific attribution belongs in `benchmarks/LICENSE`, alongside
+the benchmark sources excluded from the archive; do not rewrite the root
+`LICENSE` during packaging.
```bash
test -z "$(git status --porcelain)"
before_build="$(git rev-parse HEAD)"
-python3 ci/release.py build -v "$release_version"
+test "$(git rev-parse "${rc_tag}^{commit}")" = "$release_commit"
+python3 ci/release.py build -v "$release_version" --rc-tag "$rc_tag"
test "$(git rev-parse HEAD)" = "$before_build"
test -z "$(git status --porcelain)"
test -f "dist/apache-fory-${release_version}-src.tar.gz"
test -f "dist/apache-fory-${release_version}-src.tar.gz.asc"
test -f "dist/apache-fory-${release_version}-src.tar.gz.sha512"
+test "$(gzip -dc "dist/apache-fory-${release_version}-src.tar.gz" | git get-tar-commit-id)" = "$release_commit"
```
The build command verifies the generated PGP signature and SHA-512 checksum.
+The archive must match a direct `git archive` of the RC tag, including its
+embedded commit ID and unmodified root `LICENSE`.
### 8. Commit the source release to ASF Subversion
diff --git a/LICENSE b/LICENSE
index 936b8dd64..66d9a4878 100644
--- a/LICENSE
+++ b/LICENSE
@@ -235,10 +235,6 @@ The text of each license is the standard Apache 2.0 license.
Files:
java/fory-core/src/main/java/org/apache/fory/util/StringUtils.java
-* fast-serialization (https://github.com/RuedigerMoeller/fast-serialization)
- Files:
- benchmarks/java/src/main/java/org/apache/fory/benchmark/Identity2IdMap.java
-
* ray (https://github.com/ray-project/ray)
Files:
ci/format.sh
@@ -292,13 +288,6 @@ The text of each license is also included in licenses/LICENSE-[project].txt.
* kryo (https://github.com/EsotericSoftware/kryo)
Files:
- benchmarks/java/src/main/java/org/apache/fory/benchmark/data/Data.java
- benchmarks/java/src/main/java/org/apache/fory/benchmark/data/Image.java
- benchmarks/java/src/main/java/org/apache/fory/benchmark/data/Media.java
- benchmarks/java/src/main/java/org/apache/fory/benchmark/data/MediaContent.java
- benchmarks/java/src/main/java/org/apache/fory/benchmark/data/Sample.java
- benchmarks/java/src/main/java/org/apache/fory/benchmark/state/BufferType.java
- benchmarks/java/src/main/java/org/apache/fory/benchmark/state/KryoState.java
java/fory-core/src/main/java/org/apache/fory/collection/ForyObjectMap.java
java/fory-core/src/main/java/org/apache/fory/collection/IdentityMap.java
java/fory-core/src/main/java/org/apache/fory/collection/IdentityObjectIntMap.java
diff --git a/LICENSE b/benchmarks/LICENSE
similarity index 65%
copy from LICENSE
copy to benchmarks/LICENSE
index 936b8dd64..16412e41a 100644
--- a/LICENSE
+++ b/benchmarks/LICENSE
@@ -202,145 +202,39 @@
================================================================
-This product includes a number of Dependencies with separate copyright notices
-and license terms. Your use of these submodules is subject to the terms and
-conditions of the following licenses.
-
-================================================================
+This directory includes third-party source files with the following license terms.
+Paths below are relative to benchmarks/.
================================================================
Apache-2.0 licenses
================================================================
-The following components are provided under the Apache-2.0 License. See project link for details.
-The text of each license is the standard Apache 2.0 license.
-
-* guava (https://github.com/google/guava)
- Files:
- java/fory-core/src/main/java/org/apache/fory/util/Preconditions.java
- java/fory-core/src/main/java/org/apache/fory/reflect/TypeParameter.java
- java/fory-core/src/main/java/org/apache/fory/reflect/TypeRef.java
- java/fory-core/src/main/java/org/apache/fory/util/concurrency/DirectExecutorService.java
-
-* spark (https://github.com/apache/spark)
- Files:
- java/fory-core/src/main/java/org/apache/fory/codegen/Code.java
- java/fory-core/src/main/java/org/apache/fory/util/ClassLoaderUtils.java
- java/fory-format/src/main/java/org/apache/fory/format/vectorized/ArrowWriter.java
-
-* commons-io (https://github.com/apache/commons-io)
- Files:
- java/fory-core/src/main/java/org/apache/fory/io/ClassLoaderObjectInputStream.java
-
-* common-lang3 (https://github.com/apache/commons-lang)
- Files:
- java/fory-core/src/main/java/org/apache/fory/util/StringUtils.java
+The following component is provided under the Apache License, Version 2.0 above.
* fast-serialization (https://github.com/RuedigerMoeller/fast-serialization)
Files:
- benchmarks/java/src/main/java/org/apache/fory/benchmark/Identity2IdMap.java
-
-* ray (https://github.com/ray-project/ray)
- Files:
- ci/format.sh
-
-* grpc (https://github.com/grpc/grpc)
- Files:
- bazel/cython_library.bzl
-
-* dataclasses (https://github.com/ericvsmith/dataclasses)
- Files:
- python/pyfory/type_util.py (dataslots function)
-
-* abseil-cpp (https://github.com/abseil/abseil-cpp)
- Files:
- cpp/fory/thirdparty/flat_hash_map.h
-
-* jackson-annotations (https://github.com/FasterXML/jackson-annotations)
- Fory JSON implementations of the following annotation APIs are based on Jackson annotations.
- Files:
- java/fory-json/src/main/java/org/apache/fory/json/annotation/JsonAnyGetter.java
- java/fory-json/src/main/java/org/apache/fory/json/annotation/JsonAnySetter.java
- java/fory-json/src/main/java/org/apache/fory/json/annotation/JsonCreator.java
- java/fory-json/src/main/java/org/apache/fory/json/annotation/JsonFormat.java
- java/fory-json/src/main/java/org/apache/fory/json/annotation/JsonIgnore.java
- java/fory-json/src/main/java/org/apache/fory/json/annotation/JsonInclude.java
- java/fory-json/src/main/java/org/apache/fory/json/annotation/JsonProperty.java
- java/fory-json/src/main/java/org/apache/fory/json/annotation/JsonPropertyOrder.java
- java/fory-json/src/main/java/org/apache/fory/json/annotation/JsonRawValue.java
- java/fory-json/src/main/java/org/apache/fory/json/annotation/JsonSubTypes.java
- java/fory-json/src/main/java/org/apache/fory/json/annotation/JsonUnwrapped.java
- java/fory-json/src/main/java/org/apache/fory/json/annotation/JsonValue.java
-
-* jackson-module-scala (https://github.com/FasterXML/jackson-module-scala)
- Fory JSON's Scala JsonEnumeration annotation implementation is based on Jackson's
- JsonScalaEnumeration annotation.
- Files:
- scala/fory-json-scala/src/main/java/org/apache/fory/json/scala/JsonEnumeration.java
-
-* wast (https://github.com/wycst/wast)
- Fory's probability-first printable-ASCII fast-path predicate is based in part on
- WAST's JSON string escape predicate.
- Files:
- java/fory-json/src/main/java/org/apache/fory/json/writer/JsonAsciiWordPredicates.java
-
+ java/src/main/java/org/apache/fory/benchmark/Identity2IdMap.java
================================================================
BSD-3-Clause licenses
================================================================
-The following components are provided under the BSD-3-Clause License. See project link for details.
-The text of each license is also included in licenses/LICENSE-[project].txt.
* kryo (https://github.com/EsotericSoftware/kryo)
Files:
- benchmarks/java/src/main/java/org/apache/fory/benchmark/data/Data.java
- benchmarks/java/src/main/java/org/apache/fory/benchmark/data/Image.java
- benchmarks/java/src/main/java/org/apache/fory/benchmark/data/Media.java
- benchmarks/java/src/main/java/org/apache/fory/benchmark/data/MediaContent.java
- benchmarks/java/src/main/java/org/apache/fory/benchmark/data/Sample.java
- benchmarks/java/src/main/java/org/apache/fory/benchmark/state/BufferType.java
- benchmarks/java/src/main/java/org/apache/fory/benchmark/state/KryoState.java
- java/fory-core/src/main/java/org/apache/fory/collection/ForyObjectMap.java
- java/fory-core/src/main/java/org/apache/fory/collection/IdentityMap.java
- java/fory-core/src/main/java/org/apache/fory/collection/IdentityObjectIntMap.java
- java/fory-core/src/main/java/org/apache/fory/collection/LongMap.java
- java/fory-core/src/main/java/org/apache/fory/collection/LongLongByteMap.java
- java/fory-core/src/main/java/org/apache/fory/collection/ObjectIntMap.java
- java/fory-core/src/main/java/org/apache/fory/type/Generics.java
- java/fory-core/src/test/java/org/apache/fory/type/GenericsTest.java
-
-================================================================
-MIT licenses
-================================================================
-The following components are provided under the MIT License. See project link for details.
-The text of each license is also included in licenses/LICENSE-[project].txt
-
-* zmij (https://github.com/vitaut/zmij)
- zmij is dual-licensed under the MIT License or the Boost Software License 1.0;
- Fory uses it under the MIT License.
- Files:
- java/fory-json/src/main/java/org/apache/fory/json/writer/FloatingDecimal.java
+ java/src/main/java/org/apache/fory/benchmark/data/Data.java
+ java/src/main/java/org/apache/fory/benchmark/data/Image.java
+ java/src/main/java/org/apache/fory/benchmark/data/Media.java
+ java/src/main/java/org/apache/fory/benchmark/data/MediaContent.java
+ java/src/main/java/org/apache/fory/benchmark/data/Sample.java
+ java/src/main/java/org/apache/fory/benchmark/state/BufferType.java
+ java/src/main/java/org/apache/fory/benchmark/state/KryoState.java
-* murmurHash3.js (https://github.com/karanlyons/murmurHash3.js)
- Files:
- javascript/packages/core/lib/murmurHash3.ts
+Copyright (c) 2008-2023, Nathan Sweet
+All rights reserved.
-* fluentpython (https://github.com/fluentpython/example-code)
- Files:
- python/pyfory/type_util.py (record_class_factory function)
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* Neither the name of Esoteric Software nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
-================================================================
-Public Domain
-================================================================
-The following components are placed in the public domain.
-The author hereby disclaims copyright to this source code.
-See project link for details.
-
-* smhasher (https://github.com/aappleby/smhasher)
- Files:
- cpp/fory/thirdparty/MurmurHash3.cc
- cpp/fory/thirdparty/MurmurHash3.h
-
-* java_util (https://github.com/yonik/java_util)
- Files:
- java/fory-core/src/main/java/org/apache/fory/util/MurmurHash3.java
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROF [...]
diff --git a/ci/release.py b/ci/release.py
index c92b6aae8..7e492bdf1 100644
--- a/ci/release.py
+++ b/ci/release.py
@@ -159,41 +159,29 @@ def prepare(v: str):
raise
-def build(v: str):
- """version format: 0.5.1"""
- logger.info("Start to prepare release artifacts for version %s", v)
+def build(v: str, rc_tag: str):
+ """Build signed source artifacts directly from a release-candidate tag."""
+ logger.info("Start to prepare release artifacts for version %s from %s", v, rc_tag)
_check_release_version(v)
+ if not re.fullmatch(rf"v{re.escape(v)}-rc\d+", rc_tag):
+ raise ValueError(f"RC tag {rc_tag} does not match release version {v}")
os.chdir(PROJECT_ROOT_DIR)
+ _check_all_committed()
if os.path.exists("dist"):
shutil.rmtree("dist")
os.mkdir("dist")
- branch = f"releases-{v}"
- # Check if branch exists, if not create it
- result = subprocess.run(
- f"git show-ref --verify --quiet refs/heads/{branch}",
- shell=True,
- capture_output=True,
- check=False,
- )
- if result.returncode == 0:
- # Branch exists, checkout
- subprocess.check_call(f"git checkout {branch}", shell=True)
- else:
- # Branch doesn't exist, create it
- subprocess.check_call(f"git checkout -b {branch}", shell=True)
src_tar = f"apache-fory-{v}-src.tar.gz"
- _check_all_committed()
- _strip_unnecessary_license()
+ # Preserve the tag's tree and commit ID so voters can reproduce the source archive.
subprocess.check_call(
- "git add LICENSE && git commit -m 'remove benchmark from license'", shell=True
- )
- subprocess.check_call(
- f"git archive --format=tar.gz "
- f"--output=dist/{src_tar} "
- f"--prefix=apache-fory-{v}-src/ {branch}",
- shell=True,
+ [
+ "git",
+ "archive",
+ "--format=tar.gz",
+ f"--output=dist/{src_tar}",
+ f"--prefix=apache-fory-{v}-src/",
+ f"refs/tags/{rc_tag}",
+ ]
)
- subprocess.check_call("git reset --hard HEAD~", shell=True)
os.chdir("dist")
logger.info("Start to generate signature")
subprocess.check_call(
@@ -222,26 +210,6 @@ def _check_all_committed():
)
-def _strip_unnecessary_license():
- with open("LICENSE", "r") as f:
- lines = f.readlines()
- new_lines = []
- line_number = 0
- while line_number < len(lines):
- line = lines[line_number]
- if "fast-serialization" in line:
- line_number += 4
- elif "benchmark" in line: # strip license in benchmark
- line_number += 1
- else:
- new_lines.append(line)
- line_number += 1
- text = "".join(new_lines)
- if lines != new_lines:
- with open("LICENSE", "w") as f:
- f.write(text)
-
-
def verify(v):
src_tar = f"apache-fory-{v}-src.tar.gz"
subprocess.check_call(f"gpg --verify {src_tar}.asc {src_tar}", shell=True)
@@ -1990,7 +1958,10 @@ def _parse_args():
"build",
description="Build release artifacts",
)
- release_parser.add_argument("-v", type=str, help="new version")
+ release_parser.add_argument("-v", type=str, required=True, help="release version")
+ release_parser.add_argument(
+ "--rc-tag", required=True, help="immutable release-candidate tag to archive"
+ )
release_parser.set_defaults(func=build)
verify_parser = subparsers.add_parser(
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org