Thanks for taking a look, Sean. The LICENSE file in the source tarball refers to the BSD license and includes "for details see core/src/main/java/org/apache/accumulo/core/bloomfilter" and all files there (BloomFilter.java, DynamicBloomFilter.java, and Filter.java) include the full 3-Clause BSD license in the header. Similarly, the MIT clause has "for details see server/monitor/src/main/resources/web/flot" which has a LICENSE.txt
Regarding the crypto, according to www.apache.org/dev/crypto.html#inform it looks like we need to place that disclaimer in the README and not the NOTICE file anyway. If you prefer this reading of the policy, can you file a JIRA for making these changes and set it as a blocker? Thanks. Mike On Fri, Jun 17, 2016 at 12:28 PM, Sean Busbey <[email protected]> wrote: > -1 > > good: > > * verified checksums and signatures > * source artifact corresponds to referenced commit > * source builds correctly with Oracle JDK 1.7.0_80 / Apache Maven > 3.3.9 (including unit tests, not including ITs) > > bad: > > * LICENSE in source tarball references the "3 clause BSD" and "MIT" > licenses but does not provide their text or a pointer to where the > text can be found in the artifact. > * NOTICE in the binary tarball doesn't include any of the encryption > notice stuff that's in the source tarball NOTICE (I don't know if this > information is required in the NOTICE file, but it seems like we > should be consistent for things that are equally applicable in the > two). > > > > On Tue, Jun 14, 2016 at 2:28 PM, Mike Drob <[email protected]> wrote: > > Accumulo Developers, > > > > Please consider the following candidate for Accumulo 1.7.2. > > > > All content generated via > > assemble/build.sh --create-release-candidate -P '!thrift' > > > > Git Commit: > > a49291b8aa85b81650f2b79f80b400e10b594795 > > Branch: > > 1.7.2-rc1 > > > > If this vote passes, a gpg-signed tag will be created using: > > git tag -f -m 'Apache Accumulo 1.7.2' -s rel/1.7.2 > > a49291b8aa85b81650f2b79f80b400e10b594795 > > > > Staging repo: > > > https://repository.apache.org/content/repositories/orgapacheaccumulo-1051 > > Source (official release artifact): > > > https://repository.apache.org/content/repositories/orgapacheaccumulo-1051/org/apache/accumulo/accumulo/1.7.2/accumulo-1.7.2-src.tar.gz > > Binary: > > > https://repository.apache.org/content/repositories/orgapacheaccumulo-1051/org/apache/accumulo/accumulo/1.7.2/accumulo-1.7.2-bin.tar.gz > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a > > given artifact.) > > > > All artifacts were built and staged with: > > mvn release:prepare && mvn release:perform > > > > Signing keys are available at https://www.apache.org/dist/accumulo/KEYS > > (Expected fingerprint: 6A90F817481A73C1C419B62D8F2F220786C4FB2A > > 86EDB9C33B8517228E88A8F93E48C0C6EF362B9E) > > > > Release notes (in progress) can be found at: > > https://accumulo.apache.org/release_notes/1.7.2 > > > > Please vote one of: > > [ ] +1 - I have verified and accept... > > [ ] +0 - I have reservations, but not strong enough to vote against... > > [ ] -1 - Because..., I do not accept... > > ... these artifacts as the 1.7.2 release of Apache Accumulo. > > > > This vote will end on Fri Jun 17 19:30:00 UTC 2016 > > (Fri Jun 17 15:30:00 EDT 2016 / Fri Jun 17 12:30:00 PDT 2016) > > > > Thanks! > > > > P.S. Hint: download the whole staging repo with > > wget -erobots=off -r -l inf -np -nH \ > > > > > https://repository.apache.org/content/repositories/orgapacheaccumulo-1051/ > > # note the trailing slash is needed > > > > -- > busbey >
