...
+1 (binding) # "binding" means you are a committer/PPMC/mentor of Pegasus. If not, "not-binding" here.
I checked:
☐ Do (yes/no) Do release files have the word incubating in their name?
☐ Are (yes/no) Are the digital signature and hashes correct?
☐ Does (yes/no) Does DISCLAIMER file exist?
☐ Do (yes/no) Do LICENSE and NOTICE files exists?
☐ Is (yes/no) Is the LICENSE and NOTICE text correct?
...
(yes/no) Is the NOTICE year correct?
...
(yes/no) Un-included software dependencies are not mentioned in LICENSE or NOTICE?
...
(yes/no) License information is not mentioned in NOTICE?
Is there any 3rd party code contained inside the release? If so:
☐ Does (yes/no) Does the software have a compatible license?
☐ Are (yes/no) Are all software licenses mentioned in LICENSE?
☐ Is (yes/no) Is the full text of the licenses (or pointers to it) in LICENSE?
Is any of this code Apache licensed? Do they have NOTICE files? If so:
☐ Have (yes/no) Have relevant parts of those NOTICE files been added to this NOTICE file?
☐ Do (yes/no) Do all source files have ASF headers?
...
(yes/no) Do the contents of the release match with what's tagged in version control?
...
(yes/no) Are there any unexpected binary files in the release?
...
(yes/no) Can you compile from source? Are the instruction clear?