Re: [VOTE] Release Apache Casbin 3.11.0-incubating RC1

-1 (binding)

I found the following issues:

1. The artifacts should be signed with an apache.org email. Currently, it is =
signed with:

apache-casbin-3.11.0-incubating-src.tar.gz
gpg: Signature made Thu Jul  2 00:05:33 2026 CST
gpg:                using EDDSA key D1FDB0BA62C6E0FB005131F30A243CC4CB3E06F4
gpg: Good signature from "Yang Luo <[email protected]>" [unknown]
      D1FDB0BA62C6E0FB005131F30A243CC4CB3E06F4

2. The checksum file contains "\r\n" trailing newline, which cause (on macOS):

$ shasum -c apache-casbin-3.11.0-incubating-src.tar.gz.sha512
  : No such file or directory0-incubating-src.tar.gz
  : FAILED open or readincubating-src.tar.gz
  shasum: WARNING: 1 listed file could not be read

3. The DISCLAIMER and NOTICE can be improved, see [1].

[1] https://github.com/apache/casbin/pull/1741

4. I found most files have license header:

// Copyright 2017 The casbin Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

Since the SGA and IP clearance are done for Casbin, you'd prefer to change al=
l these license headers as:

// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements.  See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership.  The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License.  You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations
// under the License.

Other parts generally look good.

Best,
tison.

On 2026/07/17 14:13:48 Yanrui Zhang wrote:
> Hello Incubator Community,
>=20
>=20
> The Apache Casbin community has voted and approved the release of Apache
> Casbin (Incubating) 3.11.0-incubating RC1. We are now requesting IPMC
> members to review and vote on this release.
>=20
> Casbin community vote thread:
> https://lists.apache.org/thread/8qdrgy59hdtwmt5rc1z4ox3q22wxx0kt Casbin
> community vote result thread:
> https://lists.apache.org/thread/fx2625oxdjbp3dg7r2lj01t7v1md9gx6 The
> release candidate:
> https://dist.apache.org/repos/dist/dev/incubator/casbin/3.11.0-incubating-r=
c1/
> Release artifacts: - apache-casbin-3.11.0-incubating-src.tar.gz -
> apache-casbin-3.11.0-incubating-src.tar.gz.asc -
> apache-casbin-3.11.0-incubating-src.tar.gz.sha512 Git commit hash:
> 95656679eac1caad13179bd209bbc87a2e8e6002 Git commit:
> https://github.com/apache/casbin/commit/95656679eac1caad13179bd209bbc87a2e8=
e6002
> The source artifact is signed with the following GPG key:
> D1FDB0BA62C6E0FB005131F30A243CC4CB3E06F4 The public KEYS file:
> https://downloads.apache.org/incubator/casbin/KEYS The source release has
> been verified with: - SHA-512 checksum verification - GPG signature
> verification - Source archive content check, including LICENSE, NOTICE,
> DISCLAIMER, go.mod, and go.sum - go test ./... More details about the
> Incubator release checklist:
> https://cwiki.apache.org/confluence/display/INCUBATOR/Incubator+Release+Che=
cklist
> Steps to verify the release: https://www.apache.org/info/verification.html
> The vote will remain open for at least 72 hours and requires at least three
> binding +1 votes from IPMC members to pass. Please vote accordingly: [ ] +1
> approve [ ] +0 no opinion [ ] -1 disapprove (please provide a reason)
> Thanks, Yanrui Zhang
>=20