The sources for the parent pom are at: https://github.com/apache/maven-apache-parent/ and their JIRA is at: https://issues.apache.org/jira/projects/MPOM/issues
It seems to me like changing to --personal-digest-preferences would be a good contribution. I'm not sure what dev workflow they use but probably a safe bet, based on example, would be to raise a JIRA issue pointing at a github PR (like https://issues.apache.org/jira/browse/MPOM-209). On Mon, Aug 19, 2019 at 2:03 PM leerho <[email protected]> wrote: > Gian, > > Sorry for the delay in responding, I've been heads-down on another issue :) > > WRT the Druid POM: The issue I found is indirect. The Druid POM does not > override the Apache parent pom maven-gpg-plugin, and the Apache parent pom > specifies in the maven-gpg-plugin the gpg argument: > "--digest-algo=SHA512". > > According to the GPG man page: > > --digest-algo name > In general, you do not want to use this option as it > allows you to violate the OpenPGP standard. > --personal-digest-preferences is the safe way to > accomplish the same thing. > > --personal-digest-preferences string > Set the list of personal digest preferences to string. > Use gpg --version to get a list of available algorithms, > and use none to set no preference at all. This allows the > user to safely override the algorithm chosen by the > recipient key preferences, as GPG will only select > an algorithm that is usable by all recipients. > The most highly ranked digest algorithm in this list > is also used when signing without encryption > (e.g. --clear-sign or --sign). > > This is not the only issue I have with the Apache Parent POM, the other > issue is its use of the remote-resources-plugin, which causes warnings in > my IDE unless I override the plugin and disable it. > > Lee. > > On Wed, Aug 14, 2019 at 8:07 AM Gian Merlino <[email protected]> wrote: > > > > To make sure I understood these plugins, I did a lot of research into > all > > > of them and discovering that the default configurations in the Apache > > > Parent Pom were either not correct or certainly not optimal. For RC1 I > > had > > > copied some of the plugin configurations from either Beam or Druid, > then > > > discovered they were not really correct either. > > > > Out of curiosity, what problems did you discover in the Druid POM? > > (Anything we should fix over there?) > > > > On Tue, Aug 13, 2019 at 5:48 PM leerho <[email protected]> wrote: > > > > > Furkan, > > > > > > Thank you, I just submitted the Vote letter for RC2. > > > > > > RC1 had several problems with the structure of the POM. > > > > > > In RC1 I had added git.properties in the zip file > > > using git-commit-id-plugin, which created a dependency on the presence > of > > > .git in the root directory. > > > > > > The structure problem was that the git-commit-id-plugin was also in the > > > main build tree of the pom. This meant that just running mvn test on > the > > > zip archive would fail because the zip file has not .git! So I had to > > > create a special profile that included modified jar-plugin, the > > > git-commit-id-plugin and the gpg-plugin. > > > > > > To make sure I understood these plugins, I did a lot of research into > all > > > of them and discovering that the default configurations in the Apache > > > Parent Pom were either not correct or certainly not optimal. For RC1 I > > had > > > copied some of the plugin configurations from either Beam or Druid, > then > > > discovered they were not really correct either. > > > > > > Since I had to resubmit anyway, I took the opportunity to move all the > > > plugin configurations into pluginManagement to allow future > > inheritance. I > > > also had to update / improve my script files I am using to deploy to > > Dist. > > > > > > Long story, in short, I am still learning the intricacies of Maven / > POM > > > and getting better at writing scripts !! > > > (Release engineering is not my cup of tea ! ) > > > > > > Thanks for following up!! > > > > > > Lee. > > > > > > On Tue, Aug 13, 2019 at 4:12 PM Furkan KAMACI <[email protected]> > > > wrote: > > > > > > > Hi, > > > > > > > > Seems that you have just created the artifact! > > > > > > > > Kind Regards, > > > > Furkan KAMACI > > > > > > > > 14 Ağu 2019 Çar, saat 02:03 tarihinde Furkan KAMACI < > > > > [email protected]> şunu yazdı: > > > > > > > >> Hi Lee, > > > >> > > > >> Do you need help to start RC2 or not? > > > >> > > > >> Kind Regards, > > > >> Furkan KAMACI > > > >> > > > >> 9 Ağu 2019 Cum, saat 04:01 tarihinde leerho <[email protected]> şunu > > > >> yazdı: > > > >> > > > >>> I'll have to withdraw this RC1. There is a problem in the way the > > pom > > > >>> is constructed. > > > >>> Lee. > > > >>> > > > >>> On Thu, Aug 8, 2019 at 10:39 AM Jon Malkin <[email protected]> > > > wrote: > > > >>> > > > >>>> -1 from me > > > >>>> > > > >>>> Downloaded the zip file, tried to run `mvn clean test` and got an > > > error: > > > >>>> > > > >>>> [ERROR] Failed to execute goal > > > >>>> pl.project13.maven:git-commit-id-plugin:3.0.0:revision (default) > on > > > >>>> project datasketches-memory: .git directory is not found! Please > > > >>>> specify a valid [dotGitDirectory] in your pom.xml -> [Help 1] > > > >>>> > > > >>>> > > > >>>> Not necessarily a blocker, but I also noticed two (probably) > > > extraneous > > > >>>> files: > > > >>>> .gitignore > > > >>>> .travis.yml > > > >>>> > > > >>>> jon > > > >>>> > > > >>>> > > > >>>> On Wed, Aug 7, 2019 at 3:56 PM leerho <[email protected]> wrote: > > > >>>> > > > >>>> > +1 From me. I checked: > > > >>>> > - All source files have the proper Apache license and have > > > been > > > >>>> > checked with the Maven Rat Plugin. > > > >>>> > - The required version of Java and the version of Maven > are > > > >>>> verified > > > >>>> > using the enforcer plugin. > > > >>>> > - The code passes all tests (both unit tests and with > strict > > > >>>> > compiler) with a coverage of > 98%. > > > >>>> > - Checkstyle: passes with no warnings. This uses the > > > >>>> configuration > > > >>>> > MemoryCheckstyle.xml located in the /tools/ directory. > > > >>>> > - SpotBugs: passes with no bugs found: This uses the > > > >>>> configuration > > > >>>> > FindBugsExcludeFilter.xml located in the /tools/directory. > > > >>>> > - "mvn clean javadoc:javadoc" produces no javadoc errors. > > The > > > >>>> > javadocs will be found under */target/site/* > > > >>>> > - "mvn versions:display-plugin-updates" runs successfully > > > with > > > >>>> no > > > >>>> > out-of-date plugins. > > > >>>> > - The assembly file signatures and checksums have been > > > verified. > > > >>>> > - The jar files generated for Nexus have the correct .asc, > > > md5, > > > >>>> and > > > >>>> > sha1 signatures and checksums. > > > >>>> > - The key git properties are captured and added to a > > > >>>> git.properties > > > >>>> > file in the zip assembly. > > > >>>> > This enables traceability from an archive artifact to > the > > > >>>> exact > > > >>>> > GitHub tag used to create the artifact. > > > >>>> > > > > >>>> > > > > >>>> > On Wed, Aug 7, 2019 at 12:19 AM leerho <[email protected]> > wrote: > > > >>>> > > > > >>>> > > Hello Apache DataSketches PPMC and Community, > > > >>>> > > > > > >>>> > > 1. This is a call for vote to release Apache > DataSketches-memory > > > >>>> version: > > > >>>> > > 1.1.0-incubating-RC1 > > > >>>> > > > > > >>>> > > NOTE 1: This is one component of the DataSketches library that > > > >>>> provides > > > >>>> > > high-performance access > > > >>>> > > to off-heap memory for Java applications. These are low-level > > > >>>> functions > > > >>>> > > that are used by other > > > >>>> > > DataSketches components. It does not provide any command-line > > > >>>> interface > > > >>>> > or > > > >>>> > > GUI. > > > >>>> > > > > > >>>> > > NOTE 2: This release contains some critical performance > > > >>>> improvements for > > > >>>> > > Apache Druid. > > > >>>> > > > > > >>>> > > NOTE 3: This particular component has been split out from the > > rest > > > >>>> of the > > > >>>> > > DataSketches > > > >>>> > > code because there have been a number of requests from > platform > > > >>>> projects > > > >>>> > > that are interested in > > > >>>> > > these high-performance functions independently of the > remainder > > of > > > >>>> the > > > >>>> > > DataSketches library. > > > >>>> > > > > > >>>> > > 2. The release candidate: > > > >>>> > > > > > >>>> > > > > > >>>> > > > > >>>> > > > > > > https://dist.apache.org/repos/dist/dev/incubator/datasketches/memory/1.1.0-incubating-RC1/apache-datasketches-memory-1.1.0-incubating-src.zip > > > >>>> > > > > > >>>> > > 3. Source repository: > > > >>>> > > https://github.com/apache/incubator-datasketches-memory > > > >>>> > > > > > >>>> > > Git Tag for this release: > > > >>>> > > > > > >>>> > > > > > >>>> > > > > >>>> > > > > > > https://github.com/apache/incubator-datasketches-memory/tree/1.1.0-incubating-RC1 > > > >>>> > > on branch 1.1.X-incubating > > > >>>> > > > > > >>>> > > Git HashId for this release starts with: 32de195 > > > >>>> > > > > > >>>> > > The artifacts have been signed with --keyid-format SHORT : > > > 8CD4A902 > > > >>>> > > > > > >>>> > > 4. Repository: dist.apache.org repository: > > > >>>> > > > > > >>>> > > The public signing key can be found in the KEYS file: > > > >>>> > > > > > https://dist.apache.org/repos/dist/dev/incubator/datasketches/KEYS > > > >>>> > > > > > >>>> > > 5. Repository: Maven Central (repository.apache.org): > > > >>>> > > > > > >>>> > > The Jar artifacts can be found at > > > >>>> > > > > > >>>> > > > > > >>>> > > > > >>>> > > > > > > https://repository.apache.org/content/groups/staging/org/apache/datasketches/datasketches-memory/1.1.0-incubating/ > > > >>>> > > > > > >>>> > > 6. Build & Test Guide: > > > >>>> > > > > > >>>> > > The DataSketches-memory component is pure Java and is > structured > > > as > > > >>>> a > > > >>>> > > Maven project. You must compile using JDK 8. > > > >>>> > > There is one run-time dependency for logging and, of course, a > > > >>>> number of > > > >>>> > > test and Maven plugin dependencies, > > > >>>> > > all of which can be resolved by Maven. > > > >>>> > > > > > >>>> > > There are two types of tests: normal unit tests and tests run > by > > > the > > > >>>> > > strict profile. To run normal unit tests: > > > >>>> > > > > > >>>> > > $ mvn clean test > > > >>>> > > > > > >>>> > > To run the strict profile tests: > > > >>>> > > > > > >>>> > > $ mvn clean test -P strict > > > >>>> > > > > > >>>> > > To install jars in your local .m2 repository: > > > >>>> > > > > > >>>> > > $ mvn clean install > > > >>>> > > > > > >>>> > > 7. Documentation: The documentation for the DataSketches > Memory > > > >>>> component > > > >>>> > > is part of the website. > > > >>>> > > > > > >>>> > > Overview documentation: > > > >>>> > > - > https://datasketches.github.io/docs/Memory/MemoryPackage.html > > > >>>> > > - > > > https://datasketches.github.io/docs/Memory/MemoryPerformance.html > > > >>>> > > > > > >>>> > > Javadocs: > > > >>>> > > > > > >>>> > > https://datasketches.github.io/api/memory/snapshot/apidocs/index.html > > > >>>> > > > > > >>>> > > 8. The vote will be performed in two stages: > > > >>>> > > - This letter will be published on dev@ and remain open > for > > at > > > >>>> least > > > >>>> > > 72 hours and at least 3 (+1) PPMC votes are reached. > > > >>>> > > All PPMC members including Mentors can vote. However, a > > > >>>> negative > > > >>>> > vode > > > >>>> > > from a Mentor will cancel this voting process. > > > >>>> > > - After it passes the first stage, the summary of that vote > > and > > > >>>> the > > > >>>> > key > > > >>>> > > information from this letter will be > > > >>>> > > published on incubator@general and remain open for at > > least > > > 72 > > > >>>> > hours > > > >>>> > > and at least 3 (+1) IPMC votes are reached. > > > >>>> > > > > > >>>> > > Please vote accordingly: > > > >>>> > > > > > >>>> > > [ ] +1 approve > > > >>>> > > [ ] +0 no opinion > > > >>>> > > [ ] -1 disapprove with the reason > > > >>>> > > > > > >>>> > > Thanks, > > > >>>> > > Lee Rhodes > > > >>>> > > [email protected] > > > >>>> > > > > > >>>> > > > > >>>> > > > >>> > > > > > >
