Edward,

Thanks for the release. Generally things looks pretty good. Aside from the
concerns with the vote e-mail Josh already shared, I can't seem to find the
commit referenced by commit id 7413387041 anywhere other than the
edwardcapriolo fork on GitHub. That's the only other showstopper I have
found.

Here's what I checked:

I found the correct KEYS file at:
https://dist.apache.org/repos/dist/release/incubator/gossip/KEYS

- Name on release artifacts includes incubating.
- Verified GPG signatures, MD5's and SHA hashes look good.
- No unintentional binary artifacts in the source release zip.
- NOTICE, LICENSE, DISCLAIMER files all look good.
- All source files have the Apache license header.
- Can build from the source release.

Some nits:

You may consider GPG signing with an apache.org e-mail address instead of a
personal address.

The manifest at the start of the KEYS file doesn't list you key although
the it present at the end of the file.

I think it is probably worth calling a second vote with a corrected e-mail
once Josh has weighed in and the commit is present on Apache's git repo.

Drew

On Mon, Jan 2, 2017 at 12:21 AM Josh Elser <els...@apache.org> wrote:

I'm just getting back from a little vacation. If you can hold off on
calling the vote strictly after 72hrs, I'll do my best to look at this
tmrw before it makes its way to the IPMC for a vote.

A couple of remarks on the VOTE email's content:
   * The git commit ID is good to see (not just the tag), but linking to
your personal github acct is a little out-of-the-normal to me.
   * The URL to the KEYS file and the git-wip-us URL are both wrong.
   * For the checksums, I'm guessing you copied the wrong filename. I
assume you meant those are the checksums for
gossip-0.1.1-incubating-source-release.zip as a gpg signature doesn't
require a checksum to ensure it was not tampered with.

Edward Capriolo wrote:
> I am pleased to be calling this vote for the source release of Apache
Gossip
>
> Ancillary artifacts such as poms, jars, wars, ect. can be found here:
> https://repository.apache.org/content/repositories/orgapachegossip-1001
>
> The Git commit ID is:
>
https://github.com/edwardcapriolo/incubator-gossip/commit/74133870410fec45bd6cac39351fcbbe0950de18
>
> Which will be tagged as gossip-0.1.1-incubating
>
>
https://git-wip-us.apache.org/repos/asf?p=incubator-rya.git;a=commit;h=66d8b7f060bddeeb7c50cb0918f98ce3b265c564
>
>
> Checksums of
>
https://repository.apache.org/content/repositories/orgapachegossip-1001/org/apache/gossip/gossip/0.1.1-incubating/gossip-0.1.1-incubating-source-release.zip.asc
> :
> SHA1: 53ca6498d0f704fe7931ec23ca81a638a1fd666c
> MD5: c27067c47bdeb6133660beda908f679c
>
> Release artifacts are signed with the following key:
> http://people.apache.org/~ecapriolo/
> http://people.apache.org/~ecapriolo/ecapriolo_asf.asc
>
> KEYS file available here:
> https://dist.apache.org/repos/dist/release/incubator/rya/KEYS
>
> The vote will be open for 72 hours. Please download the release candidate
> and evaluate the necessary items including checking hashes, signatures,
> build from source, and test.
>
>
> Release this package?
> [ ] +1 yes
> [ ] +0 no opinion
> [ ] -1 Do not release this package because because...
>

Reply via email to