-1 non-binding, jackrabbit-webapp-2.21.25.war has executable flags for dependencies in WEB-INF/lib
in check-release.sh line 230, changing exec mvn --batch-mode clean verify $MVN_ARGS to exec mvn --batch-mode clean verify artifact:compare -Dreference.repo=https://repository.apache.org/content/repositories/staging/ $MVN_ARGS permits to check jars that will be published to Maven Central And sadly, jackrabbit-webapp-2.21.25.war is not ok: same issue as previous releases, due to executable flag Can the check-release.sh be updated, please? and the environment doing the release fixed? this would bring you the first release that is proven fully reproducible: https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/jackrabbit/jackrabbit/README.md Regards, Hervé On 2024/02/22 13:58:37 Julian Reschke wrote: > A candidate for the Jackrabbit 2.21.25 release is available at: > > https://dist.apache.org/repos/dist/dev/jackrabbit/2.21.25/ > > The release candidate is a zip archive of the sources in: > > https://svn.apache.org/repos/asf/jackrabbit/tags/jackrabbit-2.21.25/ > > The SHA1 checksum of the archive is > 8be7d1668efe0dd8ce0a0fccc7ab2e1c8afd1ebd. > > A staged Maven repository is available for review at: > > https://repository.apache.org/ > > The command for running automated checks against this release candidate is: > > # run in SVN checkout of > https://dist.apache.org/repos/dist/dev/jackrabbit/ > $ sh check-release.sh jackrabbit 2.21.25 > 8be7d1668efe0dd8ce0a0fccc7ab2e1c8afd1ebd > > Please vote on releasing this package as Apache Jackrabbit 2.21.25. > The vote is open for the next 72 hours and passes if a majority of at > least three +1 Jackrabbit PMC votes are cast. > > [ ] +1 Release this package as Apache Jackrabbit 2.21.25 > [ ] -1 Do not release this package because... > > Best regards, Julian >
