Source release checks require python3 with tomllib (Python 3.11 or newer). This is a release-tool requirement; it does not change the Python binding's supported runtime versions. Select the required interpreter before starting source packaging.
If only the Python publish job fails due to a transient PyPI or TestPyPI issue, use Re-run failed jobs on the Release workflow. The successful Rust, Java, and Python wheel jobs do not need to be repeated.
Use a complete JDK 8 for Java release packaging. On Apple silicon use its ARM64 build. The script checks the JVM actually used by Maven, uses that same JDK for JNI checks, and builds with the UTC timezone. A JDK 11 release build is rejected because its generated Javadoc adds resources that are not covered by this release's JDK 8 license layout.
Check out the exact RC tag and copy the numeric run id from its successful push-triggered Release workflow. Run the local preflight first, then repeat without --dry-run:
RELEASE_RUN_ID="12345678901"
git checkout ${RC_TAG}
@@ -240,27 +243,25 @@ Deploy Java Artifacts to Nexus Staging
./tools/deploy_java_staging.sh --release-version ${RELEASE_VERSION} --rc ${RC_NUM} --run-id ${RELEASE_RUN_ID} --dry-run
./tools/deploy_java_staging.sh --release-version ${RELEASE_VERSION} --rc ${RC_NUM} --run-id ${RELEASE_RUN_ID}The script downloads the four native artifacts and the CI java-package, checks and smoke-tests the CI JAR, then locally rebuilds and signs the Maven artifacts with the Release Manager's GPG and apache.releases.https settings. The CI main JAR is a validation reference and is not directly uploaded to Nexus; the local Maven rebuild is deployed. Record the resulting orgapachepaimon-XXXX repository id and leave it staged for the vote.
The release profile checks the main, sources and Javadoc JARs and verifies all four actual artifact signatures after GPG signing and before Nexus deployment. The signing key or subkey must be RSA with at least 2048 bits, as required by the ASF distribution policy; an RSA primary key does not make an Ed25519 signing subkey compliant. The same signature check runs before publishing the local source artifact directory. Unsigned -Dgpg.skip=true builds remain available for CI and local dry runs.
Create source release artifacts from the same commit as the RC tag:
+Run from the repository root. Create source release artifacts from the same commit as the RC tag and capture the verified output directory:
git checkout ${RC_TAG}
-cd tools
-RELEASE_VERSION=${RELEASE_VERSION} RC_TAG=${RC_TAG} ./create_source_release.shThis creates the following under tools/release/:
This creates the following under tools/release/${RC_TAG}/${RC_COMMIT_SHA}/, where RC_COMMIT_SHA is the full commit resolved from the verified signed tag:
apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz — source archiveapache-paimon-mosaic-${RELEASE_VERSION}-src.tgz.asc — GPG signatureapache-paimon-mosaic-${RELEASE_VERSION}-src.tgz.sha512 — SHA-512 checksumBuild and verification messages go to stderr; stdout contains only the absolute output directory after all checks succeed. A failed run leaves SOURCE_RELEASE_DIR empty, even if it previously held an older candidate's directory. Existing candidate output is never overwritten.
svn checkout https://dist.apache.org/repos/dist/dev/paimon/ paimon-dist-dev --depth=immediates
-cd paimon-dist-dev
-mkdir paimon-mosaic-${RELEASE_VERSION}-rc${RC_NUM}
-cp ../paimon-mosaic/tools/release/apache-paimon-mosaic-${RELEASE_VERSION}-src.* \
- paimon-mosaic-${RELEASE_VERSION}-rc${RC_NUM}/
-svn add paimon-mosaic-${RELEASE_VERSION}-rc${RC_NUM}
-svn commit -m "Add paimon-mosaic ${RELEASE_VERSION} RC${RC_NUM}"In the same shell, upload only the directory returned by source packaging. The required-variable check stops the command if packaging failed or has not run in this shell. Do not upload the parent tools/release/ directory; it may contain older candidates or legacy artifacts.
svn import "${SOURCE_RELEASE_DIR:?Source packaging must succeed first}" \
+ "https://dist.apache.org/repos/dist/dev/paimon/paimon-mosaic-${RELEASE_VERSION}-rc${RC_NUM}" \
+ -m "Add paimon-mosaic ${RELEASE_VERSION} RC${RC_NUM}"Checklist:
If the vote reveals issues:
# From the paimon-mosaic checkout
-mv tools/release "../paimon-mosaic-${RC_TAG}-artifacts"cd paimon-dist-dev
-svn remove paimon-mosaic-${RELEASE_VERSION}-rc${RC_NUM}
-svn commit -m "Remove paimon-mosaic ${RELEASE_VERSION} RC${RC_NUM} (superseded)"svn remove "https://dist.apache.org/repos/dist/dev/paimon/paimon-mosaic-${RELEASE_VERSION}-rc${RC_NUM}" \
+ -m "Remove paimon-mosaic ${RELEASE_VERSION} RC${RC_NUM} (superseded)"RC_NUM, then go back to Build a release candidate.(.*?)RC_NUM"
- )
+ assert "Keep the previous RC's local source artifacts" in retry_section
+ assert 'tools/release/${RC_TAG}/${RC_COMMIT_SHA}/' in source
+ assert 'mv tools/release' not in retry_section
def test_release_vote_gate_matches_blocking_contract() -> None:
diff --git a/tools/tests/test_verify_binary_artifact.py b/tools/tests/test_verify_binary_artifact.py
index deb54bc4..6501e495 100644
--- a/tools/tests/test_verify_binary_artifact.py
+++ b/tools/tests/test_verify_binary_artifact.py
@@ -35,6 +35,12 @@ def repository(tmp_path, monkeypatch):
"LICENSE-binary": b"JNI third-party licenses\n",
"LICENSE-binary-ffi": b"FFI third-party licenses\n",
"java/src/main/binary-resources/META-INF/NOTICE": b"Binary notices\n",
+ "java/pom.xml": (
+ b'