On Sun, 19 Apr 2026 at 02:22, Gary Gregory <[email protected]> wrote:
> On Sat, Apr 18, 2026, 21:03 Alex Herbert <[email protected]> wrote: > > > On Sat, 18 Apr 2026 at 22:52, Gary Gregory <[email protected]> > wrote: > > > > > I see the following revapi errors: > > > https://gist.github.com/garydgregory/1c47721f4745b1f3ffdf373dd068ad80 > > > > > > Gary > > > > > > > That is a large list of errors that seem to indicate that revapi has not > > linked up to the separation of the core module and the client-api. For > > example the error: > > > > [ERROR] java.class.noLongerImplementsInterface: class > > org.apache.commons.rng.core.BaseProvider: Class no longer implements > > interface 'org.apache.commons.rng.RestorableUniformRandomProvider'. > > > > > https://revapi.org/revapi-java/differences.html#java.class.noLongerImplementsInterface > > > > But look in the file in the downloaded source archive: > > > > > > > commons-rng-core/src/main/java/org/apache/commons/rng/core/BaseProvider.java > > > > --- cut --- > > public abstract class BaseProvider > > implements RestorableUniformRandomProvider > > --- cut --- > > > > So revapi is not finding the client-api code. > > > > Can you let me know the command you used to generate this? > > > > > IIRC, I ran a default build and then: > > mvn revapi:check > > Gary > Thanks. Does the same machine/platform work on git master? I traced the history of revapi. It was required due to a reorganisation of the codebase in RNG-176 for v1.5 where japicmp did not work. The relevant commit is: --- commit f3df9db1005142c24cb96ea0b9807282166d3718 RNG-176: Remove redundant methods from core module The methods are now present as default implementations in the client-api UniformRandomProvider. This requires JApiCmp is disabled as it does not recognise the change as compatible. Binary compatibility is checked by revapi which allows this change. --- After this release both plugins were kept as their reports show changes between versions in a different presentation and I find both complimentary, rather than one making the other redundant. Note: The Jira ticket has more details on the binary compatibility of the change from 1.4 to 1.5 [1]. japicmp only uses two jar files (old and new). Since commons-rng has multiple modules, reorganisation between modules is not recognised. This is still the case as the change from 1.4 to 1.5 is marked as not binary compatible [2]. This is correct when looking at single jar files. But when looking at the dependency stack within commons-rng packages of the same version it is not correct. The multi-module setup must use the same version for all packages. This is why we publish a Bill of Materials (BOM). Alex [1] https://issues.apache.org/jira/browse/RNG-176?focusedCommentId=17534949&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-17534949 [2] https://www.japicmp.de/cmp?groupId=org.apache.commons&artifactId=commons-rng-core&oldVersion=1.4&newVersion=1.5 > > > > I've just downloaded the commons-rng-1.7-src.tar.gz from the dist staging > > site and it builds using the default mvn command using: > > > > Apache Maven 3.9.4 (dfbb324ad4a7c8fb0bf182e6d91b0ae20e3d2dd9) > > Maven home: /Users/ah403/mvn/mvn > > Java version: 17.0.17, vendor: Eclipse Adoptium, runtime: > > /Library/Java/JavaVirtualMachines/temurin-17.jdk/Contents/Home > > Default locale: en_GB, platform encoding: UTF-8 > > OS name: "mac os x", version: "26.3.1", arch: "aarch64", family: "mac" > > > > Default goal is 'clean verify javadoc:javadoc'. Note that the javadoc > > plugin is set to fail on warnings so this is run in the default goal to > > pick up errors. Most plugins are activated by executions in the pom to > > lifecycle phases, or by a profile triggered by a file (this is how revapi > > is triggered). I can verify that japicmp and revapi do run on my clean > > builds for each module. > > > > I've looked at the difference between git master and the 1.7-release > > branch. The diff does not have any changes to revapi configuration. It is > > version changes in the pom, release notes, changes.xml and download page > > updates. > > > > The revapi plugin does not appear to be reproducible or deterministic. > The > > config file to ignore changes has two sections, one for 1.5 and now for > > 1.7. Both have the same id. This may be causing an issue if the two > > sections are being merged non-deterministically. I cannot know as I > cannot > > reproduce the issue to experiment with fixing it. > > > > I see two options: > > > > - Reproduce this on git master, fix it, and cut a new release > > - Remove use of revapi > > > > I actually like revapi. It is far more configurable than japicmp, and > > reports on semantic, binary and source compatibility issues. But it is > not > > doing me any favours here. > > > > To allow for the first option, can you run a build on git master please. > If > > that fails on revapi then it is a platform dependent issue as github > > actions, and my builds, have been OK with the current setup. > > > > Thanks, > > > > Alex > > > > > > > > > > > > On Thu, Apr 16, 2026 at 10:18 AM Alex Herbert < > [email protected]> > > > wrote: > > > > > > > > I noticed the revapi differences reports were empty. However the raw > > HTML > > > > contains actual differences between the 1.6 and 1.7 release. > > > > > > > > The HTML is missing a <table> tag at the start of each section > showing > > > > differences. Thus the rows are not rendered in a browser. > > > > > > > > A dive into the source code for the revapi maven plugin that > generates > > > this > > > > report shows it has not changed for 12 years and it does initiate a > > table > > > > at the correct point: > > > > > > > > > > > > > > https://github.com/revapi/revapi/blame/9ed5780461749706433bc1cdcef8023ad49046a9/revapi-maven-plugin/src/main/java/org/revapi/maven/ReportMojo.java#L605 > > > > > > > > There must be some incompatibility somewhere in the dependencies used > > by > > > > the revapi report MOJO. I looked at the dependencies for 1.6 (where > the > > > > report worked) and 1.7 where it did not using: > > > > > > > > mvn dependency:resolve-plugins > > > > > > > > Notable differences in the report output object provided > > > > by org.apache.maven.doxia.sink.Sink: > > > > > > > > RNG 1.7: > > > > > > > > org.revapi:revapi-maven-plugin:jar:0.15.1 > > > > [INFO] org.apache.maven.doxia:doxia-sink-api:jar:2.0.0-M10 > > > > [INFO] org.apache.maven.doxia:doxia-site-renderer:jar:2.0.0-M16 > > > > [INFO] org.apache.maven.doxia:doxia-core:jar:2.0.0-M8 > > > > [INFO] org.apache.maven.doxia:doxia-site-model:jar:2.0.0-M16 > > > > [INFO] org.apache.maven.doxia:doxia-skin-model:jar:2.0.0-M16 > > > > [INFO] org.apache.maven.doxia:doxia-module-xhtml5:jar:2.0.0-M8 > > > > [INFO] > > org.apache.maven.doxia:doxia-integration-tools:jar:2.0.0-M16 > > > > [INFO] org.apache.maven.doxia:doxia-module-apt:jar:2.0.0-M8 > > > > [INFO] org.apache.maven.doxia:doxia-module-xdoc:jar:2.0.0-M8 > > > > > > > > RNG 1.6: > > > > > > > > org.revapi:revapi-maven-plugin:jar:0.15.0 > > > > [INFO] org.apache.maven.doxia:doxia-sink-api:jar:1.10 > > > > [INFO] org.apache.maven.doxia:doxia-logging-api:jar:1.10 > > > > [INFO] org.apache.maven.doxia:doxia-site-renderer:jar:1.10 > > > > [INFO] org.apache.maven.doxia:doxia-core:jar:1.10 > > > > [INFO] org.apache.maven.doxia:doxia-decoration-model:jar:1.10 > > > > [INFO] org.apache.maven.doxia:doxia-skin-model:jar:1.10 > > > > [INFO] org.apache.maven.doxia:doxia-module-xhtml:jar:1.10 > > > > [INFO] org.apache.maven.doxia:doxia-module-xhtml5:jar:1.10 > > > > > > > > The site renderer doxia has changed major version and in 1.7 also > has a > > > > mismatch of versions. Commons skin 5.2.0 now requires doxia 2.0. So > the > > > > update to doxia somehow has broken this report. I was not able to > find > > a > > > > way to fix this using dependency includes. Note that changing the > > revapi > > > > plugin back to 0.15.0 did not fix this issue. > > > > > > > > The simple fix is to open each of the reports and add the <table> tag > > > after > > > > the </h3> tag in this section. I copied the tag used in the report on > > the > > > > site for 1.6: > > > > > > > > <table border="0" class="bodyTable table table-striped > table-bordered"> > > > > > > > > I have updated the staged site so the reports now render their > contents > > > so > > > > you can identify API changes. These should match those displayed by > > > > japicmp. Note both compatibility plugins are used as historical > changes > > > to > > > > the codebase were not correctly handled by one plugin alone. IIRC > this > > > was > > > > moving a large portion of code from one package to another to be > > > > implemented as default methods on an interface. > > > > > > > > Alex > > > > > > > > > > > > On Thu, 16 Apr 2026 at 13:12, Alex Herbert <[email protected] > > > > > wrote: > > > > > > > > > We have fixed quite a few bugs and added some significant > > enhancements > > > > > since Apache Commons RNG 1.6 was released, so I would like to > release > > > > > Apache Commons RNG 1.7. > > > > > > > > > > Apache Commons RNG 1.7 RC1 is available for review here: > > > > > https://dist.apache.org/repos/dist/dev/commons/rng/1.7-RC1 > (svn > > > > > revision 83845) > > > > > > > > > > The Git tag commit for this RC is commons-rng-1.7-RC1, which you > can > > > > > browse here: > > > > > > > > > > > > > > > > https://gitbox.apache.org/repos/asf?p=commons-rng.git;a=commit;h=commons-rng-1.7-RC1 > > > > > You may checkout this tag using: > > > > > git clone https://gitbox.apache.org/repos/asf/commons-rng.git > > > > > --branch commons-rng-1.7-RC1 commons-rng-1.7-RC1 > > > > > (signature can be checked from git using 'git tag -v > > > commons-rng-1.7-RC1') > > > > > > > > > > Maven artifacts are here: > > > > > > > > > > > > > > > > https://repository.apache.org/content/repositories/orgapachecommons-1928/org/apache/commons/ > > > > > > > > > > These are the artifacts and their hashes: > > > > > > > > > > #Release SHA-512s > > > > > #Thu Apr 16 12:33:28 BST 2026 > > > > > > > > > > > > > > > > commons-rng-1.7-bin.tar.gz=9dec28282c9baf8b02f8a47fab2e74f5c2ec123dd7f62b25c1946cc2f25b3193d11b72ec40300a663f429c000840045bbeb0324556d4aadbb42e4387558e15e4 > > > > > > > > > > > > > > > > commons-rng-1.7-bin.zip=0ab05dd1a97abc14275de84a385e22f3180418dc5eafb2f4572bf121bcaf459553a540661821697b2d02103f1a14b294c453f9df003feb989402e004b48fef20 > > > > > > > > > > > > > > > > commons-rng-1.7-src.tar.gz=34408d3693ff70653fe7b6a113947930cd312ef8b15641d5f66f0a1fa1a1a84243acd7f4d053602065eb7dab0939e102431ec12b18fb96a037793dc777374ac6 > > > > > > > > > > > > > > > > commons-rng-1.7-src.zip=43c53c00080c832a68f3169909d510b983742b7feae62d5e0413135db2e24cc4082c10cfd2fb13be6ca62a8042b055255b77cac8f5e7702e5ca481dd4e025dd8 > > > > > > > > > > Signatures may be validated on a system supporting a bash Unix > shell > > by > > > > > executing: > > > > > svn co > > https://dist.apache.org/repos/dist/dev/commons/rng/1.7-RC1/ > > > > > cd 1.7-RC1 > > > > > chmod +x ./signature-validator.sh > > > > > for m in client-api core simple sampling bom; do > > > > > ./signature-validator.sh > > > > > > > > > > > https://repository.apache.org/content/repositories/orgapachecommons-1928/org/apache/commons/commons-rng-${m}/1.7/ > > > ; > > > > > done > > > > > > > > > > The source code contains examples that are not part of the public > > API. > > > > > These examples contain Java 11 modules and are enabled using a > > profile > > > (see > > > > > below). > > > > > > > > > > Note: Testing randomness using statistical thresholds results in > > > failures > > > > > at a given probability. The 'maven-surefire-plugin' is configured > to > > > re-run > > > > > tests that fail, and pass the build if they succeed within the > > allotted > > > > > number of reruns (the test will be marked as 'flaky' in the > report). > > > > > > > > > > I have tested this with 'mvn clean install' and 'mvn clean package > > > site > > > > > site:stage -Pexamples' using: > > > > > > > > > > Apache Maven 3.9.9 (8e8579a9e76f7d015ee5ec7bfcdc97d260186937) > > > > > Maven home: /Users/ah403/software/apache-maven-3 > > > > > Java version: 11.0.29, vendor: Homebrew, runtime: > > > > > /opt/homebrew/Cellar/openjdk@11 > > > /11.0.29/libexec/openjdk.jdk/Contents/Home > > > > > Default locale: en_GB, platform encoding: UTF-8 > > > > > OS name: "mac os x", version: "15.7.5", arch: "aarch64", family: > > "mac" > > > > > > > > > > Details of changes since 1.6 are in the release notes: > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/commons/rng/1.7-RC1/RELEASE-NOTES.txt > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/commons/rng/1.7-RC1/site/changes.html > > > > > > > > > > Site: > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/commons/rng/1.7-RC1/site/index.html > > > > > (Note some *relative* links are broken and the 1.7 directories > > are > > > not > > > > > yet created - these will be OK once the site is deployed.) > > > > > > > > > > JApiCmp Report (compared to 1.6): > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/commons/rng/1.7-RC1/site/commons-rng-client-api/japicmp.html > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/commons/rng/1.7-RC1/site/commons-rng-core/japicmp.html > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/commons/rng/1.7-RC1/site/commons-rng-simple/japicmp.html > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/commons/rng/1.7-RC1/site/commons-rng-sampling/japicmp.html > > > > > > > > > > RevApi Report (compared to 1.6): > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/commons/rng/1.7-RC1/site/commons-rng-client-api/revapi-report.html > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/commons/rng/1.7-RC1/site/commons-rng-core/revapi-report.html > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/commons/rng/1.7-RC1/site/commons-rng-simple/revapi-report.html > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/commons/rng/1.7-RC1/site/commons-rng-sampling/revapi-report.html > > > > > > > > > > RAT Report: > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/commons/rng/1.7-RC1/site/rat-report.html > > > > > > > > > > KEYS: > > > > > https://downloads.apache.org/commons/KEYS > > > > > > > > > > Please review the release candidate and vote. > > > > > This vote will close no sooner than 72 hours from now. > > > > > > > > > > [ ] +1 Release these artifacts > > > > > [ ] +0 OK, but... > > > > > [ ] -0 OK, but really should fix... > > > > > [ ] -1 I oppose this release because... > > > > > > > > > > Thank you, > > > > > > > > > > Alex Herbert, > > > > > Release Manager (using key > BC87A3FD0A54480F0BADBEBD21939FF0CA2A6567) > > > > > > > > > > The following is intended as a helper and refresher for reviewers. > > > > > > > > > > Validating a release candidate > > > > > ============================== > > > > > > > > > > These guidelines are NOT complete. > > > > > > > > > > Requirements: Git, Java, and Maven. > > > > > > > > > > You can validate a release from a release candidate (RC) tag as > > > follows. > > > > > > > > > > 1a) Download and decompress the source archive from: > > > > > > > > > > https://dist.apache.org/repos/dist/dev/commons/rng/1.7-RC1/source > > > > > > > > > > 1b) Check out the RC tag from git (optional) > > > > > > > > > > This is optional, as a reviewer must at least check source > > > distributions. > > > > > > > > > > git clone https://gitbox.apache.org/repos/asf/commons-rng.git > > --branch > > > > > commons-rng-1.7-RC1 commons-rng-1.7-RC1 > > > > > cd commons-rng-1.7-RC1 > > > > > > > > > > 2) Checking the build > > > > > > > > > > All components should include a default Maven goal, such that you > can > > > run > > > > > 'mvn' from the command line by itself. > > > > > > > > > > 2) Check Apache licenses > > > > > > > > > > This step is not required if the site includes a RAT report page, > > which > > > > > you then must check. > > > > > This check should be included in the default Maven build, but you > can > > > > > check it with: > > > > > > > > > > mvn apache-rat:check > > > > > > > > > > 3) Check binary compatibility > > > > > > > > > > This step is not required if the site includes a JApiCmp report > page, > > > > > which you then must check. > > > > > This check should be included in the default Maven build, but you > can > > > > > check it with: > > > > > > > > > > mvn verify -DskipTests -P japicmp japicmp:cmp > > > > > > > > > > 4) Build the package > > > > > > > > > > This check should be included in the default Maven build, but you > can > > > > > check it with: > > > > > > > > > > mvn -V clean package > > > > > > > > > > You can record the Maven and Java version produced by -V in your > VOTE > > > > > reply. > > > > > To gather OS information from a command line: > > > > > Windows: ver > > > > > Linux: uname -a > > > > > > > > > > 4b) Check reproducibility > > > > > > > > > > To check that a build is reproducible, run: > > > > > > > > > > mvn clean verify artifact:compare -DskipTests -Dreference.repo= > > > > > https://repository.apache.org/content/repositories/staging/ > > > > > '-Dbuildinfo.ignore=*/*.spdx.json' > > > > > > > > > > Note that this excludes SPDX files from the check. > > > > > > > > > > 5) Build the site for a multi-module project > > > > > > > > > > mvn site > > > > > mvn site:stage > > > > > Check the site reports in: > > > > > - Windows: target\site\index.html > > > > > - Linux: target/site/index.html > > > > > > > > > > Note that the project reports are created for each module. > > > > > Modules can be accessed using the 'Project Modules' link under > > > > > the 'Project Information' menu (see <path-to-site>/modules.html). > > > > > > > > > > -the end- > > > > > > > > > > > > > > > > --------------------------------------------------------------------- > > > To unsubscribe, e-mail: [email protected] > > > For additional commands, e-mail: [email protected] > > > > > > > > >
