[VOTE] Release 1.12.0, release candidate #2

[Robert Metzger]

Hi everyone,

It seems that all blockers for 1.12.0 have been resolved, this is the first
voting release candidate.

Please review and vote on the release candidate #2 for the version 1.12.0,
as follows:

[ ] +1, Approve the release
[ ] -1, Do not approve the release (please provide specific comments)


The complete staging area is available for your review, which includes:
* JIRA release notes [1a], and website release notes [1b]
* the official Apache source release and binary convenience releases to be
deployed to dist.apache.org [2], which are signed with the key with
fingerprint D9839159 [3],
* all artifacts to be deployed to the Maven Central Repository [4],
* source code tag "release-1.12.0-rc2" [5]

We will soon publish the PR for the release announcement blog post!

The vote will be open for at least 72 hours (Friday 7:35am CET). It is
adopted by majority approval, with at least 3 PMC affirmative votes.

Thanks,
Dian & Robert

[1a]
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12315522&version=12348263
[1b] https://github.com/apache/flink/pull/14195
[2] https://dist.apache.org/repos/dist/dev/flink/flink-1.12.0-rc2/
[3] https://dist.apache.org/repos/dist/release/flink/KEYS
[4] https://repository.apache.org/content/repositories/orgapacheflink-1403
[5] https://github.com/apache/flink/releases/tag/release-1.12.0-rc2

[Chesnay Schepler-3]

-1

-The flink-python jar contains 2 license files in the root directory and
another 2 in the META-INF directory. This should be reduced down to 1
under META-INF. I'm inclined to block the release on this because the
root license is BSD.
- The flink-python jar appears to bundle lz4 (native libraries under
win32/, linux/ and darwin/), but this is neither listed in the NOTICE
nor do we have an /explicit/ license file for it.

Other minor things that we should address in the future:
- opt/python contains some LICENSE files that should instead be placed
under licenses/
- licenses/ contains a stray "ASM" file containing the ASM license. It's
not a /problem /(because it is identical with our intended copy), but it
indicates that something is amiss. This seems to originate from the
flink-python jar, which bundles some beam stuff, which bundles
bytebuddy, which bundles this license file. From what I can tell
bytebuddy is not actually bundling ASM though; they just bundle the
license for whatever reason. It is not listed as bundled in the
flink-python NOTICE though, so I wouldn't block the release on it.


On 12/1/2020 7:35 AM, Robert Metzger wrote:

> Hi everyone,
>
> It seems that all blockers for 1.12.0 have been resolved, this is the first
> voting release candidate.
>
> Please review and vote on the release candidate #2 for the version 1.12.0,
> as follows:
>
> [ ] +1, Approve the release
> [ ] -1, Do not approve the release (please provide specific comments)
>
>
> The complete staging area is available for your review, which includes:
> * JIRA release notes [1a], and website release notes [1b]
> * the official Apache source release and binary convenience releases to be
> deployed to dist.apache.org [2], which are signed with the key with
> fingerprint D9839159 [3],
> * all artifacts to be deployed to the Maven Central Repository [4],
> * source code tag "release-1.12.0-rc2" [5]
>
> We will soon publish the PR for the release announcement blog post!
>
> The vote will be open for at least 72 hours (Friday 7:35am CET). It is
> adopted by majority approval, with at least 3 PMC affirmative votes.
>
> Thanks,
> Dian & Robert
>
> [1a]
> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12315522&version=12348263
> [1b] https://github.com/apache/flink/pull/14195
> [2] https://dist.apache.org/repos/dist/dev/flink/flink-1.12.0-rc2/
> [3] https://dist.apache.org/repos/dist/release/flink/KEYS
> [4] https://repository.apache.org/content/repositories/orgapacheflink-1403
> [5] https://github.com/apache/flink/releases/tag/release-1.12.0-rc2
>

[Robert Metzger]

Thanks a lot for checking the release candidate so quickly.
I agree that the BSD License file in the root of the jar is a red flag.
I filed a ticket for addressing the issues Chesnay found:
https://issues.apache.org/jira/browse/FLINK-20442

I'm hereby officially cancelling this release candidate.

On Tue, Dec 1, 2020 at 1:04 PM Chesnay Schepler <[hidden email]> wrote:

> -1
>
> -The flink-python jar contains 2 license files in the root directory and
> another 2 in the META-INF directory. This should be reduced down to 1 under
> META-INF. I'm inclined to block the release on this because the root
> license is BSD.
> - The flink-python jar appears to bundle lz4 (native libraries under
> win32/, linux/ and darwin/), but this is neither listed in the NOTICE nor
> do we have an *explicit* license file for it.
>
> Other minor things that we should address in the future:
> - opt/python contains some LICENSE files that should instead be placed
> under licenses/
> - licenses/ contains a stray "ASM" file containing the ASM license. It's
> not a *problem *(because it is identical with our intended copy), but it
> indicates that something is amiss. This seems to originate from the
> flink-python jar, which bundles some beam stuff, which bundles bytebuddy,
> which bundles this license file. From what I can tell bytebuddy is not
> actually bundling ASM though; they just bundle the license for whatever
> reason. It is not listed as bundled in the flink-python NOTICE though, so I
> wouldn't block the release on it.
>
>
> On 12/1/2020 7:35 AM, Robert Metzger wrote:
>
> Hi everyone,
>
> It seems that all blockers for 1.12.0 have been resolved, this is the first
> voting release candidate.
>
> Please review and vote on the release candidate #2 for the version 1.12.0,
> as follows:
>
> [ ] +1, Approve the release
> [ ] -1, Do not approve the release (please provide specific comments)
>
>
> The complete staging area is available for your review, which includes:
> * JIRA release notes [1a], and website release notes [1b]
> * the official Apache source release and binary convenience releases to be
> deployed to dist.apache.org [2], which are signed with the key with
> fingerprint D9839159 [3],
> * all artifacts to be deployed to the Maven Central Repository [4],
> * source code tag "release-1.12.0-rc2" [5]
>
> We will soon publish the PR for the release announcement blog post!
>
> The vote will be open for at least 72 hours (Friday 7:35am CET). It is
> adopted by majority approval, with at least 3 PMC affirmative votes.
>
> Thanks,
> Dian & Robert
>
> [1a]https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12315522&version=12348263
> [1b] https://github.com/apache/flink/pull/14195
> [2] https://dist.apache.org/repos/dist/dev/flink/flink-1.12.0-rc2/
> [3] https://dist.apache.org/repos/dist/release/flink/KEYS
> [4] https://repository.apache.org/content/repositories/orgapacheflink-1403
> [5] https://github.com/apache/flink/releases/tag/release-1.12.0-rc2
>
>
>