From 6a04b7b7b6142bbafa6cc03de7bfb1a3010a6761 Mon Sep 17 00:00:00 2001 From: Jark Wu Date: Sat, 19 Sep 2026 00:41:38 +0800 Subject: [PATCH 1/5] [build] Include legal files in Fluss server image Add LICENSE-bin and NOTICE-bin to the binary assembly so clean Maven builds and downstream Docker images retain the required legal files. Verify their contents and presence in CI, and document the release check.\n\nFixes #4426\n\nCo-Authored-By: Codex \nAI-Model: gpt-5\nAI-Contributed/Feature: 35/35\nAI-Contributed/UT: 0/0 AI-Contributed/Feature: 35/35 AI-Contributed/UT: 0/0 --- .github/workflows/client-integration.yml | 12 ++++++++++-- fluss-dist/src/main/assemblies/bin.xml | 17 ++++++++++++++++- tools/releasing/create_binary_release.sh | 3 --- .../how-to-release/creating-a-fluss-release.mdx | 3 +++ 4 files changed, 29 insertions(+), 6 deletions(-) diff --git a/.github/workflows/client-integration.yml b/.github/workflows/client-integration.yml index 2fb99c56f9e..562c6cf3d2b 100644 --- a/.github/workflows/client-integration.yml +++ b/.github/workflows/client-integration.yml @@ -32,6 +32,8 @@ on: - 'fluss-server/**' - 'fluss-common/**' - 'fluss-dist/**' + - 'LICENSE-bin' + - 'NOTICE-bin' - 'docker/fluss/**' - 'fluss-rust/crates/**' - 'fluss-rust/bindings/**' @@ -47,6 +49,8 @@ on: - 'fluss-server/**' - 'fluss-common/**' - 'fluss-dist/**' + - 'LICENSE-bin' + - 'NOTICE-bin' - 'docker/fluss/**' - 'fluss-rust/crates/**' - 'fluss-rust/bindings/**' @@ -90,7 +94,7 @@ jobs: # a change to this workflow itself should exercise every suite has '^\.github/workflows/client-integration\.yml' && all=true || true protocol=false; core=false; py=false; cpp=false; ex=false; gateway=false - has '^(fluss-rpc/src/main/proto/|fluss-server/|fluss-common/|fluss-dist/|docker/fluss/)' && protocol=true || true + has '^(fluss-rpc/src/main/proto/|fluss-server/|fluss-common/|fluss-dist/|LICENSE-bin$|NOTICE-bin$|docker/fluss/)' && protocol=true || true has '^(fluss-rust/crates/|fluss-rust/Cargo\.)' && core=true || true has '^fluss-rust/bindings/python/' && py=true || true has '^fluss-rust/bindings/cpp/' && cpp=true || true @@ -121,7 +125,7 @@ jobs: uses: actions/cache@v4 with: path: /tmp/fluss-dev.tar - key: fluss-dev-image-${{ hashFiles('fluss-server/**', 'fluss-common/**', 'fluss-rpc/**', 'fluss-dist/**', 'docker/fluss/**', 'pom.xml') }} + key: fluss-dev-image-${{ hashFiles('fluss-server/**', 'fluss-common/**', 'fluss-rpc/**', 'fluss-dist/**', 'LICENSE-bin', 'NOTICE-bin', 'docker/fluss/**', 'pom.xml') }} - name: Set up JDK 17 if: steps.image-cache.outputs.cache-hit != 'true' @@ -135,10 +139,14 @@ jobs: if: steps.image-cache.outputs.cache-hit != 'true' run: | ./mvnw -B --no-transfer-progress clean package -pl fluss-dist -am -DskipTests + cmp LICENSE-bin build-target/LICENSE + cmp NOTICE-bin build-target/NOTICE rm -rf docker/fluss/build-target mkdir -p docker/fluss/build-target cp -r build-target/* docker/fluss/build-target/ docker build -t fluss:dev docker/fluss + docker run --rm --network none --read-only --entrypoint /bin/sh fluss:dev \ + -c 'test -s /opt/fluss/LICENSE && test -s /opt/fluss/NOTICE' docker save fluss:dev -o /tmp/fluss-dev.tar - name: Upload server image diff --git a/fluss-dist/src/main/assemblies/bin.xml b/fluss-dist/src/main/assemblies/bin.xml index 3c1d879f086..aac59ac89e6 100644 --- a/fluss-dist/src/main/assemblies/bin.xml +++ b/fluss-dist/src/main/assemblies/bin.xml @@ -48,6 +48,21 @@ + + + ${project.basedir}/../LICENSE-bin + / + LICENSE + 0644 + + + + ${project.basedir}/../NOTICE-bin + / + NOTICE + 0644 + + ../fluss-server/target/fluss-server-${project.version}.jar @@ -91,4 +106,4 @@ - \ No newline at end of file + diff --git a/tools/releasing/create_binary_release.sh b/tools/releasing/create_binary_release.sh index 86b86313a60..8c367d7cade 100755 --- a/tools/releasing/create_binary_release.sh +++ b/tools/releasing/create_binary_release.sh @@ -70,9 +70,6 @@ make_binary_release() { $MVN clean package -Prelease -am -Dgpg.skip -Dcheckstyle.skip=true -DskipTests cd fluss-dist/target/fluss-${RELEASE_VERSION}-bin - cp ${FLUSS_DIR}/LICENSE-bin ./fluss-${RELEASE_VERSION}/LICENSE - cp ${FLUSS_DIR}/NOTICE-bin ./fluss-${RELEASE_VERSION}/NOTICE - tar $TAR_OPTIONS -czf "${dir_name}.tgz" fluss-* cp fluss-*.tgz ${RELEASE_DIR} diff --git a/website/community/how-to-release/creating-a-fluss-release.mdx b/website/community/how-to-release/creating-a-fluss-release.mdx index 3e6f1d0976d..bb7f5bf29dc 100644 --- a/website/community/how-to-release/creating-a-fluss-release.mdx +++ b/website/community/how-to-release/creating-a-fluss-release.mdx @@ -530,6 +530,9 @@ git diff --cached --quiet Then run the following commands to build and push the fluss Docker image. ```bash +$ cmp LICENSE-bin build-target/LICENSE +$ cmp NOTICE-bin build-target/NOTICE + $ rm -rf docker/fluss/build-target/ $ mkdir docker/fluss/build-target/ $ cp -r build-target/* docker/fluss/build-target From 68b02943e8983bb7ad6905fac17e4abeacab536f Mon Sep 17 00:00:00 2001 From: Jark Wu Date: Sun, 20 Sep 2026 00:27:45 +0800 Subject: [PATCH 2/5] [docs] Clarify Docker legal file verification Separate the comparison from the image build, document its purpose and expected success output, and require release managers to stop and rebuild or roll the RC when verification fails.\n\nCo-Authored-By: Codex \nAI-Model: gpt-5\nAI-Contributed/Feature: 36/36\nAI-Contributed/UT: 0/0 AI-Contributed/Feature: 36/36 AI-Contributed/UT: 0/0 --- .../creating-a-fluss-release.mdx | 36 +++++++++++++++++-- 1 file changed, 33 insertions(+), 3 deletions(-) diff --git a/website/community/how-to-release/creating-a-fluss-release.mdx b/website/community/how-to-release/creating-a-fluss-release.mdx index bb7f5bf29dc..ae7db558365 100644 --- a/website/community/how-to-release/creating-a-fluss-release.mdx +++ b/website/community/how-to-release/creating-a-fluss-release.mdx @@ -527,12 +527,42 @@ git diff --quiet && git diff --cached --quiet ``` -Then run the following commands to build and push the fluss Docker image. +#### Verify the legal files for the Fluss server image + +The Fluss server Dockerfile copies `build-target/` into `/opt/fluss/`. Before +preparing the Docker build context, verify that the Maven build produced the +top-level legal files and that they exactly match the binary distribution's +`LICENSE-bin` and `NOTICE-bin` files: + +```bash +$ cmp LICENSE-bin build-target/LICENSE && \ + cmp NOTICE-bin build-target/NOTICE && \ + echo "Fluss Docker legal files verified" +Fluss Docker legal files verified +``` + +`cmp` produces no output when the files are identical, so the success message +above is the only expected output. If either file is missing or different, the +command exits non-zero and the success message is not printed. In that case, +**do not manually copy the files and do not build or push the Docker image**. +First confirm that the checkout is still at the recorded RC commit and clean, +then regenerate `build-target` from the repository root: ```bash -$ cmp LICENSE-bin build-target/LICENSE -$ cmp NOTICE-bin build-target/NOTICE +$ mvn -B --no-transfer-progress clean package -pl fluss-dist -am -DskipTests +``` + +Run the comparison again. If it still fails, treat the problem as a release +blocker: discard or cancel the current candidate, fix the packaging through the +normal review process, increment `RC_NUM`, and rebuild the complete candidate. +Do not modify the signed RC tag or patch the Docker build context by hand. + +#### Build and push the Fluss server image +Only after the legal-file verification succeeds, prepare the Docker build +context and build and push the image: + +```bash $ rm -rf docker/fluss/build-target/ $ mkdir docker/fluss/build-target/ $ cp -r build-target/* docker/fluss/build-target From 8f5d383ea213fea41a9bc32c527bd1d8f83073ae Mon Sep 17 00:00:00 2001 From: Jark Wu Date: Sun, 20 Sep 2026 00:34:50 +0800 Subject: [PATCH 3/5] [docs] Streamline Docker legal file verification AI-Contributed/Feature: 0/36 AI-Contributed/UT: 0/0 --- .../creating-a-fluss-release.mdx | 36 ++++++------------- 1 file changed, 10 insertions(+), 26 deletions(-) diff --git a/website/community/how-to-release/creating-a-fluss-release.mdx b/website/community/how-to-release/creating-a-fluss-release.mdx index ae7db558365..f2c5b5d0113 100644 --- a/website/community/how-to-release/creating-a-fluss-release.mdx +++ b/website/community/how-to-release/creating-a-fluss-release.mdx @@ -527,12 +527,9 @@ git diff --quiet && git diff --cached --quiet ``` -#### Verify the legal files for the Fluss server image - -The Fluss server Dockerfile copies `build-target/` into `/opt/fluss/`. Before -preparing the Docker build context, verify that the Maven build produced the -top-level legal files and that they exactly match the binary distribution's -`LICENSE-bin` and `NOTICE-bin` files: +Before preparing the Docker build context, verify that the Maven-generated +legal files exactly match the binary distribution's `LICENSE-bin` and +`NOTICE-bin` files: ```bash $ cmp LICENSE-bin build-target/LICENSE && \ @@ -541,26 +538,13 @@ $ cmp LICENSE-bin build-target/LICENSE && \ Fluss Docker legal files verified ``` -`cmp` produces no output when the files are identical, so the success message -above is the only expected output. If either file is missing or different, the -command exits non-zero and the success message is not printed. In that case, -**do not manually copy the files and do not build or push the Docker image**. -First confirm that the checkout is still at the recorded RC commit and clean, -then regenerate `build-target` from the repository root: - -```bash -$ mvn -B --no-transfer-progress clean package -pl fluss-dist -am -DskipTests -``` - -Run the comparison again. If it still fails, treat the problem as a release -blocker: discard or cancel the current candidate, fix the packaging through the -normal review process, increment `RC_NUM`, and rebuild the complete candidate. -Do not modify the signed RC tag or patch the Docker build context by hand. - -#### Build and push the Fluss server image - -Only after the legal-file verification succeeds, prepare the Docker build -context and build and push the image: +`cmp` is silent when both files match, so the success message above is the only +expected output. If either comparison fails, stop the release, verify that the +checkout is still at the recorded RC commit and clean, and rerun +`mvn -B --no-transfer-progress clean package -pl fluss-dist -am -DskipTests`; +if it still fails, fix the packaging and create a new RC instead of copying the +files manually; only after the verification succeeds should you prepare the +Docker build context and build and push the image: ```bash $ rm -rf docker/fluss/build-target/ From 7bf9639ce473538cc75f56220f1597e8211e5337 Mon Sep 17 00:00:00 2001 From: Jark Wu Date: Sun, 20 Sep 2026 09:27:06 +0800 Subject: [PATCH 4/5] [docs] Clarify when to reuse a release candidate AI-Contributed/Feature: 0/11 AI-Contributed/UT: 0/0 --- .../how-to-release/creating-a-fluss-release.mdx | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/website/community/how-to-release/creating-a-fluss-release.mdx b/website/community/how-to-release/creating-a-fluss-release.mdx index f2c5b5d0113..0f9c306a812 100644 --- a/website/community/how-to-release/creating-a-fluss-release.mdx +++ b/website/community/how-to-release/creating-a-fluss-release.mdx @@ -540,11 +540,12 @@ Fluss Docker legal files verified `cmp` is silent when both files match, so the success message above is the only expected output. If either comparison fails, stop the release, verify that the -checkout is still at the recorded RC commit and clean, and rerun -`mvn -B --no-transfer-progress clean package -pl fluss-dist -am -DskipTests`; -if it still fails, fix the packaging and create a new RC instead of copying the -files manually; only after the verification succeeds should you prepare the -Docker build context and build and push the image: +checkout is still at the recorded RC commit and clean, rerun +`RELEASE_VERSION=$RELEASE_VERSION releasing/create_binary_release.sh` from +`tools/`, and repeat the comparison; continue with the same RC and prepare the +Docker build context only if it then succeeds without replacing any staged or +published candidate artifacts; otherwise, fix the packaging and create a new RC +instead of patching the current one. ```bash $ rm -rf docker/fluss/build-target/ From e9cd9cc2bd088908538203c48c7463544371b31e Mon Sep 17 00:00:00 2001 From: Jark Wu Date: Sun, 20 Sep 2026 09:43:53 +0800 Subject: [PATCH 5/5] [docs] Consolidate Docker input checks AI-Contributed/Feature: 0/35 AI-Contributed/UT: 0/0 --- .../creating-a-fluss-release.mdx | 35 +++++++------------ 1 file changed, 12 insertions(+), 23 deletions(-) diff --git a/website/community/how-to-release/creating-a-fluss-release.mdx b/website/community/how-to-release/creating-a-fluss-release.mdx index 0f9c306a812..640496ae80d 100644 --- a/website/community/how-to-release/creating-a-fluss-release.mdx +++ b/website/community/how-to-release/creating-a-fluss-release.mdx @@ -517,35 +517,24 @@ If you can't login Docker ID in your region because of network issues, you can f Next, we need to build and push Docker images for the release candidates. This will enable users to easily test the new functionality using the Quickstart guide in the [Fluss documentation](https://fluss.apache.org/docs/quickstart/flink/) improving accessibility and feedback during the release validation phase. -On the image-build machine, export the recorded `RELEASE_COMMIT` and verify -that the Dockerfiles and preparation scripts are from that RC. From the -repository root, check: +On the image-build machine, export the recorded `RELEASE_COMMIT`. From the +repository root, verify that the checkout is clean, the Docker inputs come from +that RC, and the generated legal files match the binary distribution: ```bash test "$(git rev-parse HEAD)" = "${RELEASE_COMMIT:?Set the recorded RC commit}" && git diff --quiet && -git diff --cached --quiet +git diff --cached --quiet && +cmp LICENSE-bin build-target/LICENSE && +cmp NOTICE-bin build-target/NOTICE && +echo "Fluss Docker inputs verified" +Fluss Docker inputs verified ``` -Before preparing the Docker build context, verify that the Maven-generated -legal files exactly match the binary distribution's `LICENSE-bin` and -`NOTICE-bin` files: - -```bash -$ cmp LICENSE-bin build-target/LICENSE && \ - cmp NOTICE-bin build-target/NOTICE && \ - echo "Fluss Docker legal files verified" -Fluss Docker legal files verified -``` - -`cmp` is silent when both files match, so the success message above is the only -expected output. If either comparison fails, stop the release, verify that the -checkout is still at the recorded RC commit and clean, rerun -`RELEASE_VERSION=$RELEASE_VERSION releasing/create_binary_release.sh` from -`tools/`, and repeat the comparison; continue with the same RC and prepare the -Docker build context only if it then succeeds without replacing any staged or -published candidate artifacts; otherwise, fix the packaging and create a new RC -instead of patching the current one. +All checks are silent on success, so the message above is the only expected +output. If any check fails, stop and verify that the image-build machine has +checked out the intended release branch at the recorded `RELEASE_COMMIT`, then +run the checks again. ```bash $ rm -rf docker/fluss/build-target/