+1 (non-binding) I checked the jar artifacts against the Groovy master (Groovy 6) and GROOVY_5_0_X (Groovy 5) builds. 73 tests on master and 51 on GROOVY_5_0_X were successful. These created fresh caches and have a reasonable assortment of functionality covered.
For the src and bin zip artifacts, I did manual checksum/signature checks and also checked the zip files using my GroovyPolicyMCP server and it's assessment is below. There are a couple of LICENSE/NOTICE things which I'd fix if you do a re-roll, otherwise they are probably fine to fix for next release since - your call on that one. I would guess the missing item is a doco thing and the extra one might be a license hygiene assembly issue for e.g. the with-deps artifacts. Cheers, Paul. -------- Both zips check out against the release policy. Verification is clean, and I found only two minor LICENSE nits, neither of which I'd consider a blocker. ## What passed **Integrity and signing.** Both `.sha512` files match the computed digests exactly. Both `.asc` detached signatures verify as good, made by Stefan Bodewig's EdDSA key `6A93161EB1990E8346E7BA2B23738DFD7C40DE43` (`[email protected]`), and that key is present in the accompanying KEYS file. The "not certified with a trusted signature" warning is just my throwaway keyring having no trust path — expected. **Licensing documentation.** Both packages have `LICENSE` and `NOTICE` at the root of the distribution. `LICENSE` is the full Apache License 2.0 text with third-party sections appended. `NOTICE` uses the correct mandated wording, "developed **at** The Apache Software Foundation", not the old "developed by". The `ivy-2.6.0.jar` carries `META-INF/LICENSE` and `META-INF/NOTICE`, byte-identical to the top-level copies, which satisfies the requirement that additional artifacts put licensing material in the format's customary location. **License headers.** All 513 Java files under `src/` carry the ASF header — none missing. **Binary package.** Same version number as the source release, and the jar contains only `org/apache/ivy` classes plus `module.properties`, so it bundles no third-party code. The rest of the bin zip is docs, examples, an ivy.xsd, and CycloneDX SBOMs. ## Two things worth raising **The jQuery Treeview plugin isn't listed in LICENSE.** Both zips bundle `jquery.treeview.js` (`asciidoc/js/` in src, `doc/js/` in bin). It's Treeview 1.2, copyright Jörn Zaefferer and Myles Angell, dual-licensed MIT/GPL — a separate work from jQuery core. The `LICENSE` file has a section for jQuery (John Resig) but nothing for Treeview, so it doesn't fully account for the package's exact content. The fix is a short "License for jQuery Treeview plugin" section taking the MIT option. **LICENSE and NOTICE describe JSch, which isn't bundled.** There's a full "License for JCraft JSch package" section plus a NOTICE paragraph, but no JSch code ships in either zip — it's an optional runtime dependency the user supplies. Policy is explicit that LICENSE and NOTICE must not describe materials that aren't in the package, such as separately downloaded dependencies. The ganymed mention next to it is legitimate, since `Scp.java` is genuinely derived from ganymed's SCPClient. ## One thing that looks alarming but isn't The source zip contains 339 `.jar` files under `test/`, including names like `org.eclipse.e4.core.services_1.0.0.jar`, `xercesImpl-2.6.2.jar`, and `junit-4.1.jar`. I unpacked them: every one has **zero** `.class` files — they're empty dummy artifacts used as resolver test fixtures (the Eclipse one holds a `MANIFEST.MF` and a `test.txt`). There's no third-party code hiding in there and no licensing exposure. It is a soft deviation from "a source release SHOULD not contain compiled code", but it's a SHOULD, not a MUST, and it's long-standing Ivy practice. **Bottom line:** I'd vote +1. The Treeview omission is the only item I'd actually mention on the vote thread, and it's the sort of thing normally rolled into the next release rather than being cause for a respin. On Sun, Jul 12, 2026 at 4:29 PM Stefan Bodewig <[email protected]> wrote: > > Hi all > > as announced I have created a release candidate for Ivy 2.6.0 > > tarballs: https://dist.apache.org/repos/dist/dev/ant/ivy/2.6.0/ > revision 85864 > mvn artifacts: https://dist.apache.org/repos/dist/dev/ant/ivy/2.6.0/ > > This vote will not close before 2026-07-15 6:30 UTC. > > Cheers > > Stefan > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
