Release approval criteria

[brodycj]

I think this is not clear for all members.

[purplecabbage]

There is really nothing more to it than what is listed in the voting guidelines linked from every vote thread.

When we (or at least, members of the PMC), vote on a release, we are expressing confidence that:

Our sources are properly licensed*.
We have only compatibly licensed dependencies (and appropriate NOTICE lines)*.
No IP was added without the consent of its owner**.
Archives are properly signed & hashed.
Repo tags match sha1 stated in vote email.
We believe the quality of the release is better than the previous one.

• These items are generally checked by the Release Manager. The Release Manager should state that they've checked them when they +1 the vote.

** It is the responsibility of committers to ensure that no invalid IP enters the codebase. It's not something that we need to re-check at each release.

[brodycj]

Shouldn't someone verify that the package is signed correctly? I also encountered a couple members who needed more direct step-by-step instructions.

[purplecabbage]

Archives are properly signed & hashed.