Skip to content

Source Release Checklist

Jump to bottom
Ed Espino edited this page Jun 6, 2025 · 4 revisions

Source Release Checklist

This page provides a structured checklist for preparing and validating a source release of Apache Cloudberry (Incubating). It is intended for use by the Release Manager, PPMC members, and contributors to ensure all required steps are followed prior to initiating a release vote.

ℹ️ This checklist reflects the current ASF Incubator policy. Until graduation, Cloudberry must meet all incubator-specific requirements for source releases.

1. Preparation & Tagging

  • Version number has been agreed upon and follows SemVer (e.g., 2.0.0-incubating)
  • Release candidate is tagged in Git (e.g., v2.0.0-incubating)
  • All version numbers are updated appropriately in source and docs
  • Release artifacts are generated from a clean tagged commit

2. Source Artifact Assembly

  • A .tar.gz source archive has been created using git archive (not from a working directory)
  • Archive includes required top-level files:
    • LICENSE
    • NOTICE
    • DISCLAIMER
    • README
  • No binary files are included (e.g., .jar, .exe, .so, .dll)
  • File names include the word incubating

3. Signing & Checksums

  • GPG signatures have been created for all artifacts (.asc)
  • SHA-512 checksums have been generated (.sha512)
  • The GPG key used is published on a public keyserver and linked to the ASF ID

4. License & Dependency Audit

  • ASF RAT (Release Audit Tool) has been run and verified. The following is run in the root source directory:
mvn apache-rat:check
  • All new source files contain ASF license headers
  • Dependencies are reviewed for license compatibility (Apache License 2.0 or ASF-compatible)
  • Third-party LICENSE/NOTICE adjustments (if applicable) are present

5. ASF Distribution Prep

  • Artifacts have been uploaded to the staging area: https://dist.apache.org/repos/dist/dev/incubator/cloudberry/
  • Directory includes:
    • .tar.gz source archive
    • .asc GPG signature
    • .sha512 checksum
  • Artifacts are named using the pattern:
    apache-cloudberry-<version>-incubating-rcN.src.tar.gz

6. Community Verification & Review

  • Email sent to [email protected] for community testing
  • Reviewers can verify and build from source using provided instructions
  • At least one non-RM committer has verified the build

7. Ready for Voting

  • PPMC vote thread composed ([VOTE] Release Apache Cloudberry (Incubating) x.y.z RCn)
  • Email includes:
    • Artifact links
    • GPG keys
    • SHA-512 instructions
    • How to verify the source build
  • Reminder: Once passed, a vote must also be initiated on [email protected] for IPMC approval

⏭️ Next Steps

Once all checklist items are marked complete, you may begin the Voting Process.

Clone this wiki locally