Verifying a Release Candidate - Paimon Mosaic

# Verifying a Release Candidate

Guide for anyone participating in the release vote, based on ASF Release Policy.

## Validating Distributions

The release vote email includes links to:

- Distribution archive: source tarball (`apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz`) on dist.apache.org dev
- Signature file: `apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz.asc`
- Checksum file: `apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz.sha512`
- KEYS file: https://downloads.apache.org/paimon/KEYS

Download the archive (`.tgz`), `.asc`, and `.sha512` from the RC directory (e.g. `paimon-mosaic-${RELEASE_VERSION}-rc${RC_NUM}/`) and the KEYS file.

## Verifying Signatures

Import the keys into your local keyring:

    curl https://downloads.apache.org/paimon/KEYS -o KEYS
    gpg --import KEYS

Verify the `.asc` file:

    gpg --verify apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz.asc \
                 apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz

If verification succeeds, you will see:

    gpg: Signature made ...
    gpg: using RSA key ...
    gpg: Good signature from "Release Manager Name (CODE SIGNING KEY) <...@apache.org>"

## Verifying Checksums

On macOS (shasum):

    shasum -a 512 -c apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz.sha512

On Linux (sha512sum):

    sha512sum -c apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz.sha512

If successful:

    apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz: OK

## Verifying Build

Extract the source release and verify it builds. You need Rust (stable toolchain).

    tar -xzf apache-paimon-mosaic-${RELEASE_VERSION}-src.tgz
    cd paimon-mosaic-${RELEASE_VERSION}

### Rust

Build and test all workspace crates:

    cargo build --workspace --release
    cargo test --workspace

### Java

Build the Java binding (requires JDK 8+ and Maven):

    cargo build --release -p paimon-mosaic-jni

Copy the built native library into the resource directory for the platform being verified. Run only the snippet for your current platform.

Linux x86_64:

    mkdir -p java/src/main/resources/native/linux/x86_64
    cp target/release/libpaimon_mosaic_jni.so \
      java/src/main/resources/native/linux/x86_64/

Linux aarch64:

    mkdir -p java/src/main/resources/native/linux/aarch64
    cp target/release/libpaimon_mosaic_jni.so \
      java/src/main/resources/native/linux/aarch64/

macOS aarch64:

    mkdir -p java/src/main/resources/native/macos/aarch64
    cp target/release/libpaimon_mosaic_jni.dylib \
      java/src/main/resources/native/macos/aarch64/

Windows x86_64:

    mkdir -p java/src/main/resources/native/windows/x86_64
    cp target/release/paimon_mosaic_jni.dll \
      java/src/main/resources/native/windows/x86_64/

    cd java
    mvn clean package

### Python

Build and test the Python binding (requires Python 3.9+):

    cargo build --release -p paimon-mosaic-ffi
    cp target/release/libpaimon_mosaic_ffi.* python/mosaic/
    cd python
    pip install -e .
    python -c "import mosaic"

### C++

Build the C++ tests (requires CMake):

    cargo build --release -p paimon-mosaic-ffi
    cd cpp
    mkdir build && cd build
    cmake ..
    make

## Verifying LICENSE and NOTICE

Verify that:

1. The LICENSE and NOTICE files exist in the root directory and are correct.
2. All source files have ASF license headers.
3. All dependencies have licenses compatible with ASL 2.0 (ASF third-party license policy).
4. No unexpected files are included (`.git`, `.github`, `.asf.yaml`, `.gitignore`, `.idea`, `target/` should all be excluded).

## Testing Published Artifacts

### Rust (crates.io)

RC tags do not publish to crates.io (dry-run only). You can test the Rust crate from the source tarball or via git tag dependency:

    [dependencies]
    paimon-mosaic-core = { git = "https://github.com/apache/paimon-mosaic", tag = "v${RELEASE_VERSION}-rc${RC_NUM}" }

### Java (Apache Nexus Staging)

The RC tag deploys to Apache Nexus staging. To test:

1. Find the staging repository at repository.apache.org.
2. Add the staging repository URL to your `pom.xml`:

       <repositories>
         <repository>
           <id>apache-staging</id>
           <url>https://repository.apache.org/content/repositories/orgapachepaimon-XXXX/</url>
         </repository>
       </repositories>

3. Add the dependency:

       <dependency>
         <groupId>org.apache.paimon</groupId>
         <artifactId>mosaic</artifactId>
         <version>${RELEASE_VERSION}</version>
       </dependency>

4. Verify the JAR contains native libraries for all 4 platforms:
   - `native/linux/x86_64/libpaimon_mosaic_jni.so`
   - `native/linux/aarch64/libpaimon_mosaic_jni.so`
   - `native/macos/aarch64/libpaimon_mosaic_jni.dylib`
   - `native/windows/x86_64/paimon_mosaic_jni.dll`

### Python (TestPyPI)

The RC tag publishes wheels to TestPyPI after the Rust and Java release jobs succeed. Install and verify:

    pip install -i https://test.pypi.org/simple/ paimon-mosaic==${RELEASE_VERSION}rc${RC_NUM}
    python -c "import mosaic; print('OK')"

Verify wheels are available for: Linux x86_64, Linux aarch64, macOS aarch64, Windows x86_64.

## Voting

Votes are cast by replying to the vote email on the dev mailing list with +1, 0, or -1.

State whether your vote is binding or non-binding. Only PMC members have formally binding votes. See Apache Foundation Voting.

Include a short list of what you verified. This helps the community see what has been checked.

Checklist you can reference in your vote:

- Validating distributions
- Verifying signatures
- Verifying checksums
- Verifying build
- Verifying LICENSE and NOTICE
- Testing published artifacts