Re: [DISCUSS] Graduate Apache Fluss (Incubating) as a Top Level Project

Hi Justin,

> • No KEYS link pointing to https://downloads.apache.org/ was found.
> • No visible download verification instructions on the page.

We added a section with the required information to the downloads page; see https://fluss.apache.org/downloads/#verifying-downloads

--
Best,
MKO

On 2026/05/25 08:27:16 Justin Mclean wrote:
> Hi,
> 
> The project looks in good shape as a graduation candidate, but I think we have some issues here. Fuss was recently mentioned in [1], and it appears the mentors/PPMC took no action, which is itself a concern.
> 
> So your download page:
>     • No closer.lua / [preferred] links for release artifacts. The page is serving downloads but not routing through the ASF mirror network - this MUST be done. Is there a reason the project is not following policy here?
>     • Some checksum and signature links do not use https://downloads.apache.org/.
>     • No KEYS link pointing to https://downloads.apache.org/ was found.
>     • No visible download verification instructions on the page.
> 
> Docker Hub - The Docker Hub description does not include a visible incubation disclaimer text. 
> 
> Docker Hub: fluss/fluss -- needs attention - misuse of ASF trademarks.
> 
> Maven Central - The POM descriptions don't include incubation disclaimer text.
> 
> There are also some serious 3rd party branding concerns:
> 
> Ververica (the commercial company behind Apache Flink, part of Alibaba) is the biggest source of potential branding issues. The blog posts and announcements generally use "Apache Fluss™ (incubating)" correctly, with a TM symbol, which is good. 
> 
> The Ververica documentation page [1] is titled simply "Fluss" with no "Apache" prefix throughout, which doesn't meet the ASF requirement to use "Apache Fluss" on first and prominent references. It also misses a trademark statement. The blog tag page uses "Fluss" as a category tag alongside "Apache Flink”, so it's inconsistently treated: Flink gets the "Apache” prefix, but "Fluss" doesn't.
> 
> The Alibaba Cloud community blog has posts mixing pre-donation "Fluss" references with post-donation "Apache Fluss (Incubating)” references. This could create confusion about the brand's ownership. Some post-incubator articles are also incorrect, e.g. https://www.alibabacloud.com/blog/602412
> 
> Alibaba Cloud has just released a managed service for Apache Fluss. I am curious to know whether that follows the ASF's trademark and branding policies.
> 
> I also have a concern about vendor neutrality.  The project originated entirely within Alibaba Cloud, and Ververica is an Alibaba subsidiary, so they're one corporate family. Of the 14 proposed PMC members, I can see that several are Alibaba Cloud or Ververica employees. Can you provide an explicit company breakdown of all 14 PMC members, excluding mentors, counting Alibaba and Ververica as a single entity? While the figures of 8+ companies and 44 unique committers are encouraging, I think it would be helpful to have a bit more detail here.
> 
> Kind Regards,
> Justin
> 
> 1. https://lists.apache.org/thread/xnb4lhjk82y3c0zd0f622ljgjrpdlydf
> 2. https://docs.ververica.com/introduction/about-ecosystem/fluss/
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
> 
>