If gpg had verified the signatures I probably wouldn't have noticed them and we have no other staged repos at the moment, so it's hard to say if this is a new problem. None of the published versions contain such files, but for all we know nexus filters them when promoting the repository.
I think Nick said a 2.3.z release was near. We could always see what that staged maven repo looks like? On Sun, Dec 6, 2020 at 6:22 PM Andrew Purtell <andrew.purt...@gmail.com> wrote: > > Even a clean build of 'mvn clean install deploy -DskipTests > -Papache-release' produces a staging repository containing .asc.asc files. I > am not doing anything different than the build script, our earlier > make_rc.sh, and documented procedure. Are we sure this has not always been > the case and now we are just noticing? > > The new staging repository is > > https://repository.apache.org/content/repositories/orgapachehbase-1417 > > and consider, for example: > > https://repository.apache.org/content/repositories/orgapachehbase-1417/org/apache/hbase/hbase-annotations/2.4.0/ > > hbase-annotations-2.4.0-sources.jar Sun Dec 06 21:49:47 UTC 2020 6556 > hbase-annotations-2.4.0-sources.jar.asc Sun Dec 06 21:55:39 UTC 2020 833 > *hbase-annotations-2.4.0-sources.jar.asc.asc Sun Dec 06 21:50:50 UTC 2020 > 833* > hbase-annotations-2.4.0-sources.jar.md5 Sun Dec 06 21:49:48 UTC 2020 32 > hbase-annotations-2.4.0-sources.jar.sha1 Sun Dec 06 21:49:47 UTC 2020 40 > hbase-annotations-2.4.0-test-sources.jar Sun Dec 06 21:59:13 UTC 2020 25432 > hbase-annotations-2.4.0-test-sources.jar.asc Sun Dec 06 21:55:31 UTC 2020 > 833 > *hbase-annotations-2.4.0-test-sources.jar.asc.asc Sun Dec 06 21:42:39 UTC > 2020 833* > hbase-annotations-2.4.0-test-sources.jar.md5 Sun Dec 06 21:59:14 UTC 2020 32 > hbase-annotations-2.4.0-test-sources.jar.sha1 Sun Dec 06 21:59:14 UTC 2020 > 40 > hbase-annotations-2.4.0-tests.jar Sun Dec 06 21:42:21 UTC 2020 14123 > hbase-annotations-2.4.0-tests.jar.asc Sun Dec 06 21:42:29 UTC 2020 833 > *hbase-annotations-2.4.0-tests.jar.asc.asc Sun Dec 06 21:48:31 UTC 2020 833* > hbase-annotations-2.4.0-tests.jar.md5 Sun Dec 06 21:42:22 UTC 2020 32 > hbase-annotations-2.4.0-tests.jar.sha1 Sun Dec 06 21:42:21 UTC 2020 40 > hbase-annotations-2.4.0.jar Sun Dec 06 21:59:25 UTC 2020 6661 > hbase-annotations-2.4.0.jar.asc Sun Dec 06 21:59:09 UTC 2020 833 > *hbase-annotations-2.4.0.jar.asc.asc Sun Dec 06 21:47:24 UTC 2020 833* > hbase-annotations-2.4.0.jar.md5 Sun Dec 06 21:59:26 UTC 2020 32 > hbase-annotations-2.4.0.jar.sha1 Sun Dec 06 21:59:25 UTC 2020 40 > hbase-annotations-2.4.0.pom Sun Dec 06 21:59:26 UTC 2020 2065 > hbase-annotations-2.4.0.pom.asc Sun Dec 06 21:58:53 UTC 2020 833 > *hbase-annotations-2.4.0.pom.asc.asc Sun Dec 06 21:58:26 UTC 2020 833* > hbase-annotations-2.4.0.pom.md5 Sun Dec 06 21:59:27 UTC 2020 32 > hbase-annotations-2.4.0.pom.sha1 Sun Dec 06 21:59:27 UTC 2020 40 > > Nexus does not care about these files and ignores them. > > > On Sun, Dec 6, 2020 at 1:12 PM Andrew Purtell <andrew.purt...@gmail.com> > wrote: > > > I will drop that temporary repository and make a new one. I believe I know > > what happened. I re-ran the Maven deploy goal after it had failed the one > > time without a clean step first. Previous signature files in target/ were > > themselves included in the list of things to sign (apparently). ‘mvn clean > > install deploy -Papache-release’ should do it. > > > > Nexus successfully closed the repository, so the verification rules > > passed. Based on what you are saying Sean that shouldn’t have happened. If > > I can reproduce this I will follow up with infra. > > > > > > > On Dec 6, 2020, at 12:45 PM, Sean Busbey <bus...@apache.org> wrote: > > > > > > +1 for the artifacts on dist.a.o for 2.4.0 RC1 > > > > > > I'd rather we not use the staged nexus repo orgapachehbase-1416 > > > because it appears to have some errors. specifically there's a > > > duplicative '.asc.asc' file for each signed artifact that gpg can't > > > verify. > > > > > >> On Fri, Dec 4, 2020 at 11:29 AM Andrew Purtell <apurt...@apache.org> > > wrote: > > >> > > >> The temporary Maven repository is now available at > > >> > > >> > > https://repository.apache.org/content/repositories/orgapachehbase-1416/ > > >> . > > >> > > >>> On Thu, Dec 3, 2020 at 4:04 PM Andrew Purtell <apurt...@apache.org> > > wrote: > > >>> > > >>> Please vote on this Apache hbase release candidate, hbase-2.4.0RC1 > > >>> > > >>> The VOTE will remain open for at least 72 hours. > > >>> > > >>> [ ] +1 Release this package as Apache hbase 2.4.0 > > >>> [ ] -1 Do not release this package because ... > > >>> > > >>> The tag to be voted on is 2.4.0RC1: > > >>> > > >>> https://github.com/apache/hbase/tree/2.4.0RC1 > > >>> > > >>> The release files, including signatures, digests, as well as CHANGES.md > > >>> and RELEASENOTES.md included in this RC can be found at: > > >>> > > >>> https://dist.apache.org/repos/dist/dev/hbase/2.4.0RC1/ > > >>> > > >>> Customarily Maven artifacts would be available in a staging repository. > > >>> Unfortunately I was forced to terminate the Maven deploy step after > > >>> the upload ran for more than four hours and my build equipment > > >>> needed to be relocated, with loss of network connectivity. This RC has > > >>> been delayed long enough. A temporary Maven repository is not a > > >>> requirement for a vote. I will retry Maven deploy tomorrow. I can > > >>> promise the artifacts for this RC will be staged in Apache Nexus and > > >>> ready for release well ahead of the earliest possible time this vote > > >>> can complete. > > >>> > > >>> Artifacts were signed with the apurt...@apache.org key which can be > > found > > >>> in: > > >>> > > >>> https://dist.apache.org/repos/dist/release/hbase/KEYS > > >>> > > >>> The API compatibility report for this RC can be found at: > > >>> > > >>> > > >>> > > https://dist.apache.org/repos/dist/dev/hbase/2.4.0RC1/api_compare_2.4.0RC1_to_2.3.0.html > > >>> > > >>> The changes are mostly added methods, which conform to the > > compatibility > > >>> guidelines for a new minor release. There is one change to the public > > >>> Region interface that alters the return type of a method. This is > > >>> equivalent to a removal then addition and can be a binary compatibility > > >>> problem. However to your RM's eye the change looks intentional and is > > >>> part of an API improvement project, and a compatibility method is not > > >>> possible here because Java doesn't consider return type when deciding > > if > > >>> one method signature duplicates another. > > >>> > > >>> To learn more about Apache HBase, please see > > >>> > > >>> http://hbase.apache.org/ > > >>> > > >>> Thanks, > > >>> Your HBase Release Manager > > >>> > > >> > > >> > > >> -- > > >> Best regards, > > >> Andrew > > >> > > >> Words like orphans lost among the crosstalk, meaning torn from truth's > > >> decrepit hands > > >> - A23, Crosstalk > > > > > -- > Best regards, > Andrew > > Words like orphans lost among the crosstalk, meaning torn from truth's > decrepit hands > - A23, Crosstalk
