+1 (binding)Sent from my primitive tricorder Dear development community,
I am happy to start the VOTE thread for a Groovy 6.0.0-RC-2 release!
This release includes 44 bug fixes/improvements as outlined in the changelog:
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12318123&version=12357502
Tag: https://gitbox.apache.org/repos/asf?p=groovy.git;a=tag;h=refs/tags/GROOVY_6_0_0_RC_2
Tag commit id: 760601d45f652b90950f5dd3ba4e60f201691e11
The artifacts to be voted on are located as follows (r87406).
Source release: https://dist.apache.org/repos/dist/dev/groovy/6.0.0-RC-2/sources
Convenience binaries:
https://dist.apache.org/repos/dist/dev/groovy/6.0.0-RC-2/distribution
Temporary artifacts:
https://repository.apache.org/content/repositories/orgapachegroovy-1122
Release artifacts are signed with a key from the following file:
https://dist.apache.org/repos/dist/release/groovy/KEYS
Please vote on releasing this package as Apache Groovy 6.0.0-RC-2.
Reminder on ASF release approval requirements for PMC members:
http://www.apache.org/legal/release-policy.html#release-approval
Hints on validating checksums/signatures (but replace md5sum with sha256sum):
https://www.apache.org/info/verification.html
The vote is open for the next 72 hours and passes if a majority of at
least three +1 PMC votes are cast.
[ ] +1 Release Apache Groovy 6.0.0-RC-2
[ ] 0 I don't have a strong opinion about this, but I assume it's ok
[ ] -1 Do not release Apache Groovy 6.0.0-RC-2 because...
Here is my vote:
+1 (binding)
--------------------
my local "verify.sh dev 6.0.0-RC-2" results:
✅ KEYS Downloaded
✅ Source Distribution Verified
✅ Binary Distribution Verified
✅ Docs Distribution Verified
✅ SDK Distribution Verified
✅ Gradle Bootstrapped
✅ RAT passed
✅✅✅ Automatic verification finished.
--------------------
GroovyPolicyMCP analysis:
**Verdict: 6.0.0-RC-2 is clean. I would vote +1.** Every check on the
release checklist passed, including signatures this time.
**Tag and source**
- The annotated tag on gitbox resolves to commit
760601d45f652b90950f5dd3ba4e60f201691e11, matching the vote email, and
its parent is on origin/master.
- The source zip is identical to `git archive` at the tag. The only
absent files are the deliberate omissions: benchmark, the perf
dashboard, wrapper, governance docs, CI configs, and the ABI surface.
- No compiled code or archives in the source zip. RAT passes at the
tag. Version properties carry no SNAPSHOT.
- The JIRA changelog lists 44 unique issues, as the email says.
**Signatures and checksums**
| Location | Artifacts | Signed by
6A65176A0FB1CD0B | Checksums |
| ---------------------------------- | --------- |
-------------------------- | ----------------------------------- |
| dist.apache.org zips | 4 | 4 good
| SHA-256 match |
| Nexus staging orgapachegroovy-1122 | 297 | 297 good
| md5, sha1, sha256, sha512 all match |
**LICENSE and NOTICE**
- Binary and SDK zips: 18 of 18 license pointers resolve, no
unreferenced texts, NOTICE dated 2003-2026 with all the upstream
credits. All 88 bundled third-party jars covered, the same set as
today's snapshot.
- Docs zip: 4 of 4 pointers resolve.
- All 167 staged jars carry META-INF LICENSE and NOTICE with every
pointer resolving. Raw, shaded, grooid, sources and groovy-all-sources
declarations match their content. Sources, javadoc and groovydoc jars
contain no classes.
- The core, grooid and groovy-test-grooid jars inside the binary zip
are byte-identical to the staged ones, as are all 39 module jars in
lib/.
- All 43 poms declare the license, none reference non-Groovy SNAPSHOT
dependencies.
**SBOMs** now show 729 of 729 components licensed.
--
|
