[VOTE] Release Apache Iggy v0.10.0 rc1

[hubcio]

Hello, Apache Iggy Community,

This is a call for a vote to release Apache Iggy version 0.10.0.

Along with the Iggy Server 0.10.0, we will release these SDKs and tools from the same repository:

• Rust SDK 0.12.0, CLI 0.15.0, Connectors runtime 0.6.0, MCP server 0.6.0, Web UI 0.5.0, Bench Dashboard 0.9.0 and Kafka gateway 0.2.0.
• Python 0.10.0, Node.js 0.11.0, Java 0.10.0, C# 0.10.0, Go v0.10.0 and Swift 0.2.0 SDKs.
• C++ 0.2.0 and PHP 0.2.0 SDKs, in the source archive only.

0.10.0 brings multi-leader partitions, deferred polling, the Kafka gateway and per-stream encryption keys. It also changes the wire protocol and the data directory format. The discussion thread has a summary of the changes:
#4671

Since the discussion, per-topic replication factors (#4692), idempotent producers (#4691), grouped deferred fetches (#4683) and an external authentication callout (#4634) also landed.

Git commit for the release:
91e0206

The change list for this release:
server-0.9.0...server-0.10.0-rc.1

Git tag for the release candidate:
https://github.com/apache/iggy/releases/tag/server-0.10.0-rc.1

The release candidate:
https://dist.apache.org/repos/dist/dev/iggy/0.10.0-rc1/

The artifacts are signed with PGP key 6CBBED6E59612FCE (fingerprint 8526 A28E 7BA8 DDEC 7B08 6ED4 6CBB ED6E 5961 2FCE), which belongs to hgruszecki@apache.org. The key is in the KEYS file:
https://downloads.apache.org/iggy/KEYS

We will create the final release tags after the vote passes.

The vote will be open for at least 72 hours. It passes with at least three +1 binding votes from PMC members and more +1 binding votes than -1 binding votes.

Everyone is welcome to vote. Please state whether your vote is binding and include your platform and verification results.

Please vote accordingly:

• +1 approve
• +0 no opinion
• -1 disapprove with the reason

To learn more about Iggy, please see https://iggy.apache.org/

Checklist for reference:

• Download links are valid.
• Checksums and PGP signatures are valid.
• Source code distributions have correct names matching the current release.
• LICENSE and NOTICE files are correct.
• Files that need a license header have one.
• No compiled archives bundled in source archive.
• Can build and test the downloaded source archive.

Verify the download

curl -fLO https://downloads.apache.org/iggy/KEYS
curl -fLO https://dist.apache.org/repos/dist/dev/iggy/0.10.0-rc1/iggy-0.10.0-src.tar.gz
curl -fLO https://dist.apache.org/repos/dist/dev/iggy/0.10.0-rc1/iggy-0.10.0-src.tar.gz.asc
curl -fLO https://dist.apache.org/repos/dist/dev/iggy/0.10.0-rc1/iggy-0.10.0-src.tar.gz.sha512
gpg --import KEYS
gpg --verify iggy-0.10.0-src.tar.gz.asc iggy-0.10.0-src.tar.gz
sha512sum -c iggy-0.10.0-src.tar.gz.sha512

Build and test

To build, install Rust with rustup. The archive pins Rust 1.99.1 in rust-toolchain.toml, so cargo uses that toolchain inside the extracted directory.

On Debian/Ubuntu, install pkg-config, libhwloc-dev and libudev-dev alongside the native compiler and build tools.

tar -xzf iggy-0.10.0-src.tar.gz
cd iggy-0.10.0-src
rustup toolchain install 1.99.1
cargo build --locked
cargo test --locked

The integration tests need Docker. If tests fail because of resource contention on your machine, run them serially with cargo test --locked -- --test-threads 1. Please report failures that this does not explain in this thread.

The iggy tests use a lot of locked memory and open files. If they fail on these limits, increase the maximum kernel locked memory limit and the open file descriptor limit.

On Linux, the Apache Doris connector tests need a higher vm.max_map_count, because the Doris backend refuses to start below 2000000:

sudo sysctl -w vm.max_map_count=2000000

Optional: reproduce the source archive from Git

To reproduce the archive, clone the repository, check out commit 91e0206367aad2d30259f7d45203832b08ae84e7 or tag server-0.10.0-rc.1, and run the release script from the root directory:

./scripts/prepare-release.sh

This creates the artifact under the iggy_release directory with the following SHA-512 checksum:

799abd3c62c6b3be66409283c81d392cf366d8195b89c6d2e3d260bc7c9ebf91232eea7989994100c783e82a586b8ac4ebefdd58f7078f935fc6f09efba4170f

Different gzip implementations can produce different compressed bytes from the same tar archive. If your locally reproduced archive has a different checksum, compare its uncompressed tar using the command below. The downloaded release candidate must match its published checksum exactly.

gzip -dc iggy_release/iggy-0.10.0-src.tar.gz | sha512sum

Expected:

15f8a96f604b442f42373b44eecf882370150309c86066cc1cb3a5000d679a466b57ec4b731f56e1302ac3b76bf119fcaf4990f386de5d6b70eb9f80b5205d3f

Thanks,
Hubert

[hubcio]

from my side it's +1 (binding, Apache Iggy PMC). during release preparation i verified all aforementioned checklist points. really excited about this release.

[slbotbm]

+1

[numinnex]

+1 binding (Apache Iggy PMC)

[lukaszzborek]

+1

[krishvishal]

+1

[spetz]

+1 binding (Apache Iggy PMC)

[Xuanwo]

+1 (binding)

I checked:

• Signatures and checksums are valid
• Source tarball matches the git tag
• LICENSE and NOTICE files are present and correct; license headers OK
• No unexpected binaries in the source release
• Built and ran the consensus/protocol test suites successfully

[ygndotgg]

+1 (non-binding)

[ryankert01]

+1 (non-binding)

I checked:

• Download links are valid
• Checksums and signatures are valid
• Source tarball matches the git tag server-0.10.0-rc.1
• Can compile from source on macOS (arm64)

[kparisa]

+1 binding (Apache Iggy PMC)

• Download links are valid.
• Checksums and PGP signatures are valid.
• Source code distributions have correct names matching the current release.
• LICENSE and NOTICE files are correct.
• Files that need a license header have one.
• No compiled archives bundled in source archive.
• Can build and test the downloaded source archive.

[mmodzelewski]

+1 (non-binding)

[haubur]

+1 (non-binding). checks pass. crazy progress!

[landingpro]

+1 (non-binding)