Re: [VOTE] - Apache Geode Kafka Connector 1.1.0 - Take 2

[Nabarun Nag]

As it is primarily created for Confluent Marketplace we need to follow the 
steps required for hosting in the marketplace, which included how things are to 
be named, folder structure etc.

Looking at the list of things to do and conflicts with Geode / Confluent 
requirements. We can remove it from the Apache domain and move it to internal 
open source repo like gpdb or rabbitMQ while keeping the Apache License. 
Alternatives can be the VMware or VMware-labs opensource orgs in Github.

We can definitely add the missing licenses and wait for 1.12.8 release of 
Apache Geode to update those dependencies.


Regards
Naba

________________________________
From: Owen Nichols <onich...@vmware.com>
Sent: Tuesday, January 4, 2022 4:45 PM
To: dev@geode.apache.org <dev@geode.apache.org>
Subject: Re: [VOTE] - Apache Geode Kafka Connector 1.1.0 - Take 2

Quibbles:
- artifact naming does not follow standard naming convention of 
THING-VERSION.tgz and THING-VERSION-src.tgz (also Geode decided to stop 
distributing .zip files years ago)
- not based on the latest Geode 1.12 patch.  I would like to see Geode 1.12.8 
picked up once it's available later this month.
- the log4j version 2.16.0 advertised in this release fixes only 2 of the 4 
recent log4j vulnerabilities.  I would prefer to see log4j 2.17.1.
- vote email is missing a link to release notes and a link to the KEYS file 
used to sign the release.
- artifact paths and email subject are missing "RC1" qualifier

Concerns:
- NOTICE and LICENSE are found inside a "doc" folder instead of at the top 
level of the artifact
- Some dependencies are missing from LICENSE.  While most deps are Apache2 and 
don't require a mention, LatencyUtils is BSD-2 and should be mentioned, and 
likely a few others from Geode's LICENSE need to be there as well because they 
are incorporated in source form into geode-core.

Please consider above suggestions for next time.

+0

On 1/4/22, 2:19 PM, "Dan Smith" <dasm...@vmware.com> wrote:

    Hello Geode Dev Community,

    This is a release candidate for Apache Geode Kafka Connector version 1.1.0.
    This contains a bump to log4j 2.16.

    Please do a review and give your feedback.

    Voting deadline:
    3PM PST Tuesday, Jan 11, 2022.

    Please note that we are voting upon the source tag: rel/v1.1.0

    Source and Binary Distributions: 
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdist.apache.org%2Frepos%2Fdist%2Fdev%2Fgeode%2Fkafka-connector-1.1.0%2F&amp;data=04%7C01%7Cnnag%40vmware.com%7C446cbaa9b22e405c8ab908d9cfe4af60%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C0%7C637769403373246616%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=rIRSVkdDIlv0c2yFZDSXZe9fDFrOX0usjDtyyEDa0%2Bg%3D&amp;reserved=0
    Github: 
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fapache%2Fgeode-kafka-connector%2Ftree%2Frel%2Fv1.1.0&amp;data=04%7C01%7Cnnag%40vmware.com%7C446cbaa9b22e405c8ab908d9cfe4af60%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C0%7C637769403373246616%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=3yvWDc7u%2FNi%2FkF5zXQKDYkkEOImzOMxWnDAgFzm8P%2B4%3D&amp;reserved=0

    Command to build the connector:
    mvn package

    Thanks!
    -Dan