PGP signature now verified.

I'll change my vote to a 0 assuming the md5 and/or sha1 files makes it
to dist. :-)



On 25 April 2016 at 07:52, Reto Gmür <[email protected]> wrote:
> Hi Stian
>
> Thanks for reviewing the release candidate.
>
> The *.asc file was indeed a duplicate of the zip, I've replaced it.
>
> The md5 is in the mail only as it seems pointless to make this available
> over the same channel as the file it allows verifying. Only verifying
> the gpg-signature gives a reasonable degree of certainty that the file
> is genuine.
>
> Your other criticism is indeed justified but doesn't seem to be in any
> way related to the specific release. And given that it was like that in
> all the previous releases and considering that a major tidying up should
> take place after releasing I would say that they are no impediment to
> releasing this now.
>
> Cheers,
> Reto
>
> On Sun, 24 Apr 2016, at 20:40, Stian Soiland-Reyes wrote:
>> I agree on the principle for this release :-)
>>
>> But sorry, this was a -1 for me. (unbinding)
>>
>> I could not check
>> http://home.apache.org/~reto/clerezza-release-201604/201604-1-src.zip.asc
>> is it is just a duplicate the ZIP file, not the much smaller .asc file
>> - so I can't verify the signature.
>>
>>
>> Probably a home.apache.org httpd issue..which btw should not be used
>> for release candidates anymore.
>>
>> Perhaps using https://dist.apache.org/repos/dist/dev/clerezza/ would
>> work better? It would also then be clearer as to what would end up on
>> https://dist.apache.org/repos/dist/release/clerezza/ as what folder
>> and filenames - I must admit "201604-1-src.zip" is not an ideal
>> filename for me (apache-clerezza-partial-201604-1-src.zip ?)
>>
>> *.md5 and *.sha1 files are also missing.
>>
>>
>>
>> Checked:
>>
>> -1 pgp signature
>> -1 sha1 signature file missing
>> -1 src archive includes pom.xml.releaseBackup files
>> 0 md5 matches (but *.md5 file missing)
>> +1 mvn clean install -> BUILD SUCCESS
>> +1 git tag (commit) 2a3643d2b51e74f43d2a3c921f95f61fad355d94 matches
>> src (for the included modules)
>> +1 no binaries in src (beyond 3 pngs)
>> -1 rdf/jena/facade/src/site/resources/images/clerezza.png is the logo
>> of former http://www.trialox.org as shown on
>> https://startupmonitor.ch/startups/1007/trialox/   - is this Apache
>> licensed? Not mentioned in NOTICE. Why should an Apache product be
>> Trialox branded?
>> +1 mvn staging repository jar filenames match */target/*jar (+javadoc)
>> -1 apache-rat check not too happy (missing headers include
>> src/assembly/source-release.xml, some test resources and
>> rdf/jena/tdb.storage/src/test/java/org/apache/clerezza/rdf/jena/tdb/storage/*.java
>> - last one causes my -1 here)
>>
>>
>> For the RAT check I would expect the XML apache header in *.xml and
>> *.rdf  and with # in *.nt (or these test resources should be
>> rat-excluded). *.java must always have headers.
>>
>>
>> btw - that trialox 'clerrezza.png' is also duplicated in:
>>
>> ./utils.customproperty/src/site/resources/images/clerezza.png
>> ./templating.seedsnipe/src/site/resources/images/clerezza.png
>> ./rdf/core/src/site/resources/images/clerezza.png
>> ./rdf/jena/facade/src/site/resources/images/clerezza.png
>> ./platform/usermanager/src/site/resources/images/clerezza.png
>> ./platform/usermanager.webinterface/src/site/resources/images/clerezza.png
>> ./platform/typepriority/src/site/resources/images/clerezza.png
>> ./platform/typehandlerspace/src/site/resources/images/clerezza.png
>> ./platform/launcher.virtuoso/src/site/resources/images/clerezza.png
>> ./platform/launcher.tdb/src/site/resources/images/clerezza.png
>> ./platform/launcher.storageless.parent/platform.launcher.storageless/src/site/resources/images/clerezza.png
>> ./platform/launcher.sesame/src/site/resources/images/clerezza.png
>> ./platform/launcher.mulgara/src/site/resources/images/clerezza.png
>> ./platform/dashboard/platform.dashboard.core/src/site/resources/images/clerezza.png
>> ./platform/accountcontrolpanel/platform.accountcontrolpanel.core/src/site/resources/images/clerezza.png
>>
>> e.g.
>> https://github.com/apache/clerezza/blob/master/rdf/jena/facade/src/site/resources/images/clerezza.png
>>
>>
>> Tested with:
>>
>> Apache Maven 3.3.9 (bb52d8502b132ec0a5a3f4c09453c07478323dc5;
>> 2015-11-10T16:41:47+00:00)
>> Maven home: /home/stain/software/maven
>> Java version: 1.8.0_72-internal, vendor: Oracle Corporation
>> Java home: /usr/lib/jvm/java-8-openjdk-amd64/jre
>> Default locale: en_GB, platform encoding: UTF-8
>> OS name: "linux", version: "3.16.0-67-generic", arch: "amd64", family:
>> "unix"
>>
>> On 23 April 2016 at 12:24, Reto Gmür <[email protected]> wrote:
>> > Hi all,
>> >
>> > This is bug-fix release that fixes the wrong handling of literals with
>> > language in stable-serializer as well as in jena bindings, it also
>> > updates the rdf-commons dependency in rdf.core (to reduce potential
>> > maven dependency conflicts).
>> >
>> > It contains the following artifacts that shall be released to maven
>> > central:
>> >
>> > -rdf/jena/commons
>> > -rdf/jena/facade
>> > -rdf/jena/parser
>> > -rdf/jena/serializer
>> > -rdf/jena/sparql
>> > -rdf/jena/storage
>> > -rdf/jena/tdb.storage
>> > -rdf/core
>> > -rdf/stable.serializer
>> > -provisioning/rdf
>> > -provisioning/rdf.tdb
>> > -provisioning/platform.content
>> > -provisioning/launchers/content-launcher
>> > -provisioning/launchers/linked-data-launcher
>> >
>> > It also contains the integration tests at:
>> >
>> > - provisioning/launchers/tests
>> >
>> > that can be used to verify that the build is working but that are not to
>> > be releases to maven central (see notes below).
>> >
>> > Staging repo is here:
>> > https://repository.apache.org/content/repositories/orgapacheclerezza-1012
>> >
>> > The source release is here:
>> > http://home.apache.org/~reto/clerezza-release-201604/201604-1-src.zip
>> >
>> > The signature is here:
>> > http://home.apache.org/~reto/clerezza-release-201604/201604-1-src.zip.asc
>> >
>> > MD5 (201604-1-src.zip) = 57a2d72f836a592bbdb86feda7755ddd
>> >
>> > The keys are here:
>> > https://dist.apache.org/repos/dist/release/clerezza/KEYS
>> >
>> > The GIT tag is:
>> > 201604
>> >
>> > Note on building:
>> >
>> > - unzip 201604-1-src.zip
>> > - cd clerezza/releases/201604/
>> > - mvn install
>> >
>> > The source zip also contains tests which unfortunately could not be
>> > released because they depend on
>> > org.apache.stanbol.commons.testing.jarexec 1.0.0 which has not yet been
>> > released. Because of this running the tests requires some manual steps:
>> >
>> > - cd ../../provisioning/launchers/tests/content-launcher-tests
>> > - remove "-SNAPSHOT" from all clerezza dependencies in pom.xml
>> > - mvn test
>> >
>> > The vote is open for at least 48 hours.
>> >
>> > Cheers,
>> > Reto
>>
>>
>>
>> --
>> Stian Soiland-Reyes
>> Apache Taverna (incubating), Apache Commons RDF (incubating)
>> http://orcid.org/0000-0001-9842-9718



-- 
Stian Soiland-Reyes
Apache Taverna (incubating), Apache Commons RDF (incubating)
http://orcid.org/0000-0001-9842-9718

Reply via email to