Re: [MENTORS] Potential issue with GitHub releases

> What we do is add the official release files next to it when we remove
the pre-release tag.

Yeah - we did it too, and thought it was allowed, but there are certain
risks - like immutability and confusion over what is official - from what I
understand. Also this is a bit different than the "official download page"
- following the official infra docs
https://infra.apache.org/release-download-pages.html - where you are
supposed to have instructions on how to verify the releases and automated
CDN etc.
Like many ASF policies, this one is prone to interpretation  - so I will
leave it to others to agree what's "allowed" - but in our case we
overwhelmingly are for removing those files from GH, so we just will :).

J.



On Mon, May 4, 2026 at 7:15 PM Hans Van Akelyen <[email protected]>
wrote:

> Hi all,
>
> Following this thread as it affects us too.
>
> It is indeed a shame that you can’t remove the artifacts that GitHub
> creates. What we do is add the official release files next to it when we
> remove the pre-release tag.
> https://github.com/apache/hop/releases I thought this was allowed.
>
> Kr,
> Hans
>
> On Mon, 4 May 2026 at 18:02, Jarek Potiuk <[email protected]> wrote:
>
> > I would remove “may” since these will differ almost always.
> >
> > Great point. Thanks !
> >
> > On Mon, May 4, 2026 at 5:37 PM Dave Fisher <[email protected]> wrote:
> >
> > >
> > >
> > > > On May 4, 2026, at 8:15 AM, Jarek Potiuk <[email protected]> wrote:
> > > >
> > > > Damn,
> > > >
> > > > It seems that no matter what we do - "source" links will always
> appear
> > > > there (after some time :X). But then, we do not have to upload "our"
> > > > packages there.
> > > >
> > > > This is what I proposed to the Airflow PMC. Perhaps we can take it as
> > an
> > > > example of how it can be "clearly" marked? (you can see it in my
> > Airflow
> > > > fork) [1]:
> > > >
> > > > The only authoritative source for Apache Airflow 3.2.1 release
> > > > artifacts is the official downloads page at:
> > > >
> > > >
> > >
> >
> https://airflow.apache.org/docs/apache-airflow/3.2.1/installation/installing-from-sources.html
> > > > That page lists the source tarballs, wheels, detached .asc
> signatures,
> > > > and .sha512 checksums published by the ASF, with instructions for
> > > > verifying each — including the project's signing keys at
> > > > https://downloads.apache.org/airflow/KEYS.
> > > >
> > > > Note: the "Source code (zip)" and "Source code (tar.gz)" attachments
> > > > on this page are GitHub-generated snapshots of the git tag. They are
> > > > not official ASF releases, are not signed, and may differ
> > > > from the canonical artifacts on the downloads page above.
> > >
> > > I would remove “may” since these will differ almost always.
> > >
> > > Best,
> > > Dave
> > >
> > > >
> > > > [1]
> > > >
> > >
> >
> https://github.com/potiuk/airflow/releases/tag/release-rendering-test-3.2.1
> > > > -
> > > >
> > > >
> > > > On Sun, May 3, 2026 at 10:37 PM Jarek Potiuk <[email protected]>
> wrote:
> > > >
> > > >>> And sorry for getting your name wrong - autocorrect can be the
> worse
> > > >> sometimes
> > > >> No problem, it happens to me all the time, Josef ;)
> > > >>
> > > >> Regarding GitHub releases, I’ve confirmed it is possible to maintain
> > > >> release pages containing only release notes without attached
> binaries.
> > > >> Airflow is currently running a lazy consensus [1] to remove binaries
> > > from
> > > >> GitHub and instead provide links to our official download page [2]
> and
> > > >> PyPI. We will include a note that our PyPI packages are bit-to-bit
> > > >> identical to the SVN artifacts and have passed all required checks
> and
> > > >> votes.
> > > >>
> > > >> I believe this is the best approach because it maintains the
> > familiarity
> > > >> of GitHub release notes for users while eliminating concerns
> regarding
> > > >> artifact immutability or multiple "sources of truth." You can see a
> > > preview
> > > >> of the throwaway script to do in this PR [3] and a live example on
> my
> > > >> private fork [4].
> > > >>
> > > >> [1]
> https://lists.apache.org/thread/5x55mvorsrkc4ny16v55d71bbs9djm6y
> > > >> [2] https://infra.apache.org/release-download-pages.html
> > > >> [3] https://github.com/apache/airflow/pull/66314
> > > >> [4]
> > > >>
> > >
> >
> https://github.com/potiuk/airflow/releases/tag/release-rendering-test-3.2.1
> > > >>
> > > >> Thanks,
> > > >> Jarek
> > > >>
> > > >> On Sun, May 3, 2026 at 6:59 PM Jean-Baptiste Onofré <
> [email protected]>
> > > >> wrote:
> > > >>
> > > >>> Hi Justin,
> > > >>>
> > > >>> I will check but I guess it's the "default" GH Release. Let me
> check
> > on
> > > >>> the
> > > >>> podliings I mentor.
> > > >>>
> > > >>> Regards
> > > >>> JB
> > > >>>
> > > >>> On Sat, May 2, 2026 at 12:10 PM Justin Mclean <
> > > [email protected]>
> > > >>> wrote:
> > > >>>
> > > >>>> Hi,
> > > >>>>
> > > >>>> I also checked current podlings against the Incubator GitHub
> > > >>> distribution
> > > >>>> guidance:
> > > >>>> https://incubator.apache.org/guides/distribution.html#github
> > > >>>>
> > > >>>> The following podlings appear to have GitHub Releases that may
> need
> > > >>>> cleanup/extra info added:
> > > >>>> - Burr
> > > >>>> - Casbin
> > > >>>> - Fluss
> > > >>>> - GraphAr
> > > >>>> - Hamilton
> > > >>>> - Iggy
> > > >>>> - OzHera
> > > >>>> - ResilientDB
> > > >>>>
> > > >>>> Again, this was done with a script and could be incomplete or
> > > incorrect.
> > > >>>>
> > > >>>> Could mentors and PPMCs please check that GitHub Releases include
> > the
> > > >>>> incubating disclaimer where needed, and that RCs, nightlies, and
> > > >>> snapshots
> > > >>>> etc are marked as GitHub pre-releases?
> > > >>>>
> > > >>>> Thanks,
> > > >>>> Justin
> > > >>>>
> > ---------------------------------------------------------------------
> > > >>>> To unsubscribe, e-mail: [email protected]
> > > >>>> For additional commands, e-mail:
> [email protected]
> > > >>>>
> > > >>>>
> > > >>>
> > > >>
> > >
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: [email protected]
> > > For additional commands, e-mail: [email protected]
> > >
> > >
> >
>