Hi,

+1 binding

I checked:
- incubating in name
- signatures and hashes good
- DISCLAIMER exists
- NOTICE good
- LICENSE is OK but could be improved (see below)
- Can compile from source

For the LICENSE rather than pointing to a URL of the license for Stix please 
include the license in the release. URLs can change over time and you’re not 
complying with the terms of the 3 clause BSD license it’s under.  Also licenses 
can change over time so double check the version you have included is actually 
3 clause BSD.

Some of the extra NOTICE files seem to have licensing information in them that 
should be in the LICENSE files but had to know for sure without an artefact to 
review.

The fact that you have incubating release candidate on GitHub available for 
download to the general public before the vote has finished is a big issue. [1] 
Please remove these right away and make sure this doesn’t happen again. See [2] 
for more details, in particular - "Do not include any links on the project 
website that might encourage non-developers to download and use nightly builds, 
snapshots, release candidates, or any other similar package."

Thanks,
Justin

1. https://github.com/apache/incubator-metron/releases
2. http://www.apache.org/dev/release.html#what
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Reply via email to