+1 (binding)
Apache Commons JEXL 3.7.1 RC1 looks good to me. Checked: - The git tag commit is 9a03752243dcf81ea9e2bebdcdb59e18eb2b43bc, and the source archive has the same content as the tag. - The SHA-512 files and GPG signatures of the 4 dist archives (bin and src, zip and tar.gz) are OK. The SHA-512 values also match those in the vote email. - The Maven staging repo (orgapachecommons-1970) is OK: - signatures, md5 and sha1 are good for all 9 artifacts - the 7 SHA-512 values listed in the vote email match - Signatures are from key 530AA5F25C25011F, imported from https://downloads.apache.org/commons/KEYS. - The default mvn build from the source archive passes, including the RAT check (0 unapproved files). 1215 tests ran with 0 failures, 0 errors and 4 skipped. - The build is reproducible: mvn clean verify artifact:compare against the staging repo gives 7 of 7 files matching, with the SPDX file ignored. This needs JDK 25 and -Duser.timezone=UTC. With other JDKs (8 and 27) or a non-UTC timezone, the jars differ in compiler output or zip timestamps. - mvn clean install site passes. The RAT report shows 0 unapproved files. - The japicmp report was reviewed, and I regenerated it locally with the same result. All changes are additive, with no removals and no binary-incompatible changes. - The binary archives were checked: - the tar.gz and zip have identical content - the jars are byte-identical to the staging artifacts - LICENSE and NOTICE are present - a smoke test of commons-jexl3-3.7.1.jar evaluating expressions and scripts passes on Java 8 and 25 Environment: - Apache Maven 3.9.4 - Zulu JDK 1.8.0_432, 25.0.4.1 and 27 (the main build ran on 8, the reproducibility check on 25) - macOS 26.7.1, arm64 (Darwin 25.6.0) Thank you, Henrib --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
