Apache Release Process compliance tracker for 0.42.0

[andreahlert]

Hey, everybody! Trying to get familiar with the project, I noticed that the release compliance work is spread across several disconnected issues and PRs, making it hard to get a clear picture of what's done and what's still missing.
Since 0.41.0-incubating already passed IPMC vote and is published, and 0.42.0 has RC0 and RC1
staged, I thought it would be useful to put everything in one place.

Done

• Source package via git archive with GPG signing and SHA-512 checksums
• sdist and wheel build automation (scripts/apache_release.py)
• LICENSE (Apache 2.0 + MIT for deep-researcher), NOTICE, DISCLAIMER at root
• LICENSE/NOTICE in wheel via pyproject.toml license-files
• GPG .asc signatures on all artifacts
• SHA-512 checksums on all artifacts
• GPG key setup guide (scripts/setup_keys.sh, 4096-bit RSA)
• KEYS file published at dist/release
• .rat-excludes configured for Apache RAT
• Automated verification script (scripts/verify_apache_artifacts.py)
• Upload to dist/dev/incubator/burr/ via SVN
• [VOTE] email template generation
• Voter verification docs in scripts/README.md
• "incubating" in source archive and sdist names
• -src suffix in source archive name
• Release config tests (tests/test_release_config.py)
• Successful IPMC vote and publication for 0.41.0

Open gaps

• sdist uses -sdist instead of -src in filename (add -src to the name of the source releases #635) — both 0.41.0 and 0.42.0 RC1 use apache-burr-{v}-incubating-sdist.tar.gz. The convention in other podlings (e.g.
  BiFroMQ) is -src
• Copyright lines in ASF headers (why do we have copyrights in Apache Source Headers? #638) — open question, needs decision on whether individual copyrights should appear alongside the ASF boilerplate
• LICENSE-wheel omits MIT license info (0.42 RC omits MIT License info from LICENSE-wheel #712) — 0.42 RC wheel's LICENSE file does not include the MIT license details for bundled dependencies
• No command to promote approved RC from dist/dev to dist/release — done manually today
• No automated voter build/test script — voters follow manual steps from README

Non-issues (verified)

• Wheel filename without "incubating": apache_burr-0.42.0-py3-none-any.whl — the Incubator distribution guide does not require "incubating" in convenience binary filenames.
  The 0.41.0 release passed vote with this same naming
• Source archive naming: already uses -src correctly. The 0.41.0 used apache-burr-0.41.0-incubating.tar.gz without -src, but 0.42.0 RC1 already has it fixed

Related issues

Issue	Status	Topic
#603	Closed	Release scripts for apache
#635	Closed	Add -src to source release names
#638	Closed	Copyrights in Apache Source Headers
#589	Open	Remove 3rd-party references from PMC sites
#639	Closed	Files without apache license headers
#640	Closed (wontfix)	Release naming apache-burr
#641	Closed	Incorrect license in wheel
#712	Open	0.42 RC omits MIT License info from LICENSE-wheel

PRs that contributed

PR	Status	Topic
#595	Merged	Initial release scripts
#599	Merged	SVN push updates
#604	Merged	Dependency groups for release
#609	Merged	Release scripts rewrite
#628	Merged	Script fixes for release
#630	Merged	Fix voter workflow in README
#651	Merged	0.42.0 release prep

References

• Apache Release Policy
• Incubator Release Management
• Release Publishing
• Release Distribution
• 0.41.0-incubating RC3 VOTE thread
• 0.41.0 published artifacts
• 0.42.0 RC1 staged artifacts

[andreahlert]

@elijahbenizzy @skrawcz @pjfanning I put together this checklist based on the Apache Release Policy docs and what's already in the repo/SVN. Could you take a look at the open gaps and confirm if they're accurate? Also happy to pick up any of these if needed.

[skrawcz]

Seems about right.

[andreahlert]

Labels migrated to new taxonomy (#692).

[elijahbenizzy]

Right this is great, thank you! I'm not as concerned about the gaps there. But glad we're tracking. If you feel like contributing you're welcome!