Kafka

Thanks David for spotting this will raise RC4 with a fix > On 2 Oct 2026, at 09:56, David Jacot <david.jacot@gmail.com> wrote: > > Hi Omnia, > > Thanks again for running the release. > > While verifying RC3, I found an issue with the signatures of the Maven > artifacts. The source and binary artifacts are fine, as Bill reported, > but most of the Maven artifacts cannot be verified with gpg. Here is how > to reproduce it. > > Setup: > > curl -sO https://downloads.apache.org/kafka/KEYS > gpg --import KEYS > D=https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc3 > M=https://repository.apache.org/content/groups/staging/org/apache/kafka > > 1) Binary tarball (dist): OK > > curl -sO $D/kafka_2.13-4.4.0.tgz > curl -sO $D/kafka_2.13-4.4.0.tgz.asc > gpg --verify kafka_2.13-4.4.0.tgz.asc kafka_2.13-4.4.0.tgz > > gpg: Signature made Tue Sep 29 14:24:00 2026 CEST > gpg...

Thanks to David for pointing out this issue. I opened https://issues.apache.org/jira/browse/KAFKA-21208 to improve our release flow. On 2026/10/02 08:56:23 David Jacot wrote: > Hi Omnia, > > Thanks again for running the release. > > While verifying RC3, I found an issue with the signatures of the Maven > artifacts. The source and binary artifacts are fine, as Bill reported, > but most of the Maven artifacts cannot be verified with gpg. Here is how > to reproduce it. > > Setup: > > curl -sO https://downloads.apache.org/kafka/KEYS > gpg --import KEYS > D=https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc3 > M=https://repository.apache.org/content/groups/staging/org/apache/kafka > > 1) Binary tarball (dist): OK > > curl -sO $D/kafka_2.13-4.4.0.tgz > curl -sO $D/kafka_2.13-4.4.0.tgz.asc > gpg --verify kafka_2.13-4.4.0.tgz.asc kafka_2.13-4.4.0.tgz > > gpg: Signature m...

I used the staged binaries and Maven artifacts to run my smoke tests & the Strimzi tests. All seems to work fine. So +1 non-binding from me. Thanks for running the release. Thanks & Regards Jakub On Tue, Sep 29, 2026 at 2:23 PM 黃竣陽 <s7133700@gmail.com> wrote: > Hello Kafka users, developers and client-developers, > > This is the first candidate for release of Apache Kafka 4.3.2. > > This is a bugfix release in 4.3 line. > > Release notes for the 4.3.2 release: > https://dist.apache.org/repos/dist/dev/kafka/4.3.2-rc0/RELEASE_NOTES.html > > Please download, test and vote by Friday, October 2nd, 9am PT > > Kafka's KEYS file containing PGP keys we use to sign the release: > https://downloads.apache.org/kafka/KEYS > > * Release artifacts to be voted upon (source and binary): > https://dist.apache.org/repos/dist/dev/kafka/4.3.2-rc0/ > > * Docker release artifacts to be voted upon: > apach...

Hi Omnia, Thanks again for running the release. While verifying RC3, I found an issue with the signatures of the Maven artifacts. The source and binary artifacts are fine, as Bill reported, but most of the Maven artifacts cannot be verified with gpg. Here is how to reproduce it. Setup: curl -sO https://downloads.apache.org/kafka/KEYS gpg --import KEYS D=https://dist.apache.org/repos/dist/dev/kafka/4.4.0-rc3 M=https://repository.apache.org/content/groups/staging/org/apache/kafka 1) Binary tarball (dist): OK curl -sO $D/kafka_2.13-4.4.0.tgz curl -sO $D/kafka_2.13-4.4.0.tgz.asc gpg --verify kafka_2.13-4.4.0.tgz.asc kafka_2.13-4.4.0.tgz gpg: Signature made Tue Sep 29 14:24:00 2026 CEST gpg: using RSA key 1817905E3B2708B11A24B88E9AFA6F66CC8C3534 gpg: Good signature from "Omnia Ibrahim <omnia@apache.org>" [unknown] gpg: Signature notation: manu=2,2.5+1.12,0,3 gpg: WARNING: This key is not certified with a...

Hi Bill I noticed that earlier and opened a ticket for it: https://issues.apache.org/jira/browse/KAFKA-21134 It didn't get done in time for the RC, but I think that is fine since we can update the docs on kafka-site after the vote passes. Best, Chia-Ping Bill Bejeck via dev <dev@kafka.apache.org> 於 2026年10月2日週五 上午5:04寫道： > Hi Omnia, > > One thing I found (non-blocking) is all quickstart docs still reference > 4.3.0 in links, text ect. > > Thanks > > Bill > > On Thu, Oct 1, 2026 at 4:32 PM Bill Bejeck <bbejeck@apache.org> wrote: > > > Hi Omnia, > > > > Thanks for running the 4.4.0 release. > > > > I did the following to validate RC3: > > > > - Verified checksums (md5/sha1/sha512) and GPG signatures > > - Artifacts: source, binary, site-docs, RELEASE_NOTES > > - Signed by Omnia Ibrahim <omnia@apache.org> > > - Key 1817905E3B2708B11...

Hi Omnia, One thing I found (non-blocking) is all quickstart docs still reference 4.3.0 in links, text ect. Thanks Bill On Thu, Oct 1, 2026 at 4:32 PM Bill Bejeck <bbejeck@apache.org> wrote: > Hi Omnia, > > Thanks for running the 4.4.0 release. > > I did the following to validate RC3: > > - Verified checksums (md5/sha1/sha512) and GPG signatures > - Artifacts: source, binary, site-docs, RELEASE_NOTES > - Signed by Omnia Ibrahim <omnia@apache.org> > - Key 1817905E3B2708B11A24B88E9AFA6F66CC8C3534 > - Built from source with JDK 17 > - Ran the core, clients and streams unit tests > - Ran quickstarts from the bundled site-docs against the binary > distribution > - Broker quickstart > - Kafka Streams WordCount quickstart > - Used both the classic and streams (KIP-1071) group protocols > - Ran the same quickstarts against the Docker images > - apache/kafka:4.4.0-rc3 > -...

Hi Omnia, Thanks for running the 4.4.0 release. I did the following to validate RC3: - Verified checksums (md5/sha1/sha512) and GPG signatures - Artifacts: source, binary, site-docs, RELEASE_NOTES - Signed by Omnia Ibrahim <omnia@apache.org> - Key 1817905E3B2708B11A24B88E9AFA6F66CC8C3534 - Built from source with JDK 17 - Ran the core, clients and streams unit tests - Ran quickstarts from the bundled site-docs against the binary distribution - Broker quickstart - Kafka Streams WordCount quickstart - Used both the classic and streams (KIP-1071) group protocols - Ran the same quickstarts against the Docker images - apache/kafka:4.4.0-rc3 - apache/kafka-native:4.4.0-rc3 - Checked shipped jar versions for the dependency and CVE bumps - jackson-databind 2.21.7 - log4j 2.25.5 - jetty 12.0.39 - lz4-java 1.11.2 - zstd-jni 1.5.7-17 - Exercised these KIPs by hand against local clusters - Streams: - KIP-892 (WordCount with EOS a...