Hi Ok, good to know that. Maybe we can enable rat on the next release. I think we can continue with the release vote too.
regards, Leonardo 2012/9/13 Mike Kienenberger <[email protected]>: > And here's what I did to come up with this list: > > mvn apache-rat:check -Drat.numUnapprovedLicenses=9999 > > ls -1 */target/rat.txt > > api/target/rat.txt > bundle/target/rat.txt > implee6/target/rat.txt > impl/target/rat.txt > parent/target/rat.txt > shaded-impl/target/rat.txt > shared-public/target/rat.txt > shared/target/rat.txt > > and then went through that list of files by hand. > > > On Thu, Sep 13, 2012 at 11:07 AM, Mike Kienenberger <[email protected]> > wrote: >> Due to my lack of maven experience, it's taken me awhile to figure out >> how to configure apache rat so that I could get past the two license >> exceptions in the api project. >> >> Here's the full list of unapproved files in the rest of the project: >> >> implee6/src/main/resources/META-INF/services/javax.servlet.ServletContainerInitializer >> >> impl/src/test/java/org/apache/myfaces/config/annotation/ClassByteCodeAnnotationFilterTest.java >> impl/src/test/resources/META-INF/services/org.apache.myfaces.config.annotation.LifecycleProvider >> impl/src/test/resources/org/apache/myfaces/view/facelets/tag/composite/testSimpleThisResourceReference.xhtml >> impl/src/test/resources/org/apache/myfaces/view/facelets/tag/composite/javax.faces/jsf.js >> impl/src/test/resources/org/apache/myfaces/view/facelets/tag/jsf/html/javax.faces/jsf.js >> impl/src/test/resources/org/apache/myfaces/view/facelets/updateheadres/resources/javax.faces/jsf.js >> impl/src/test/resources/org/apache/myfaces/lifecycle/view2.xhtml >> impl/src/test/resources/org/apache/myfaces/lifecycle/view1.jsp >> impl/src/test/resources/org/apache/myfaces/context/nestedScriptCDATA.xml >> impl/src/main/resources/META-INF/xdoc-component.vmimpl/src/main/resources/META-INF/licenses/glassfish-LICENSE.txt >> impl/src/main/resources/META-INF/licenses/facelets-LICENSE.txt >> impl/src/main/resources/META-INF/services/org.apache.myfaces.config.annotation.LifecycleProvider >> impl/src/main/resources/META-INF/xdoc-tag.vm >> impl/src/main/resources/META-INF/xdoc-web-config.vm >> impl/src/main/resources/org/apache/myfaces/resource/javaee_5.xsd >> impl/src/main/resources/org/apache/myfaces/resource/javaee_web_services_client_1_2.xsd >> impl/src/main/conf/META-INF/.standard-faces-config-base.xml.jsfdia >> >> shared-public/src/test/resources/org/apache/myfaces/shared/application/view2.xhtml >> shared-public/src/test/resources/org/apache/myfaces/shared/application/view1.jsp >> >> shared/src/test/resources/org/apache/myfaces/shared/application/view2.xhtml >> shared/src/test/resources/org/apache/myfaces/shared/application/view1.jsp >> >> >> Here is what needed to be added to the api/om.xml file in order to >> skip the two files. From what I can tell, we probably should write >> license rules for these files rather than exclude them, but that's not >> a show-stopper. >> >> <plugin> >> <groupId>org.apache.rat</groupId> >> <artifactId>apache-rat-plugin</artifactId> >> <configuration> >> <excludes> >> >> <exclude>src/main/resources/META-INF/licenses/dojo-LICENSE.TXT</exclude> >> >> <exclude>src/main/resources/META-INF/licenses/facelets-LICENSE.txt</exclude> >> </excludes> >> </configuration> >> </plugin> >> >> >> On Wed, Sep 12, 2012 at 2:08 AM, Leonardo Uribe <[email protected]> wrote: >>> Hi >>> >>> I have updated the artifacts, so we can continue the vote. Please put >>> the vote on the mail with subject: >>> >>> [VOTE] release of Apache MyFaces 2.1.9 >>> [VOTE] release of Apache MyFaces 2.0.15 >>> >>> regards, >>> >>> Leonardo Uribe >>> >>> 2012/9/11 Leonardo Uribe <[email protected]>: >>>> Hi >>>> >>>> It seems that one is the only artifact that does not have the update. >>>> All other source files installed in nexus repository are ok. Maybe it >>>> was because the assembly files were compiled before the final >>>> sources-release.zip file, so the old one was used. >>>> >>>> I'll rebuild everything everything again and send another vote mail. >>>> Thanks for notice it. >>>> >>>> regards, >>>> >>>> Leonardo >>>> >>>> 2012/9/11 Mike Kienenberger <[email protected]>: >>>>> So I finally thought to look at the dates of the files inside of the >>>>> the Sep 10th myfaces-core-module-2.1.9-source-release.zip file. >>>>> They are all from >>>>> Sep 4th, so the problem does appear to be that this piece wasn't >>>>> rebuilt in your last release. This is probably why the license files >>>>> are still missing. >>>>> >>>>> >>>>> On Tue, Sep 11, 2012 at 10:51 PM, Mike Kienenberger <[email protected]> >>>>> wrote: >>>>>> Leonardo, >>>>>> >>>>>> Rat is still complaining about the same 7 licensing issues. >>>>>> >>>>>> However, only certain instances of these files appear to be missing >>>>>> licenses. >>>>>> >>>>>> myfaces-core-2.1.9-src> find . -name _ExtLang.js -exec ls -1 {} \; >>>>>> >>>>>> .This one has the license header. It comes from >>>>>> myfaces-api-2.1.9-sources.jar inside of >>>>>> myfaces-core-assembly-2.1.9-src.tar.gz >>>>>> >>>>>> exists -- >>>>>> ./src/META-INF/internal-resources/org.apache.myfaces.core.impl.util/_ExtLang.js >>>>>> >>>>>> >>>>>> The following two are identical. The first one is the one rat flags >>>>>> as needing a header. I guess that's because it's the "source" >>>>>> version of all the rest of them. It comes from >>>>>> myfaces-core-module-2.1.9-source-release.zip inside of >>>>>> myfaces-core-assembly-2.1.9-src.tar.gz. Maybe this file also needs >>>>>> to be fixed in svn? I was not able to determine where this file comes >>>>>> from in SVN. You had said that module was essentially a snapshot of >>>>>> SVN. Maybe this snapshot did not get updated because we reused the >>>>>> version number? >>>>>> >>>>>> missing -- >>>>>> ./src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_ExtLang.js >>>>>> >>>>>> missing -- >>>>>> ./src/myfaces-core-module-2.1.9/api/target/classes/META-INF/internal-resources/org.apache.myfaces.core.impl.util/_ExtLang.js >>>>>> >>>>>> [........ The rest of this email can likely be ignored....] >>>>>> >>>>>> The following two are the compressed-down versions with no extra >>>>>> whitespace or comments, which is what you would expect: >>>>>> >>>>>> missing -- >>>>>> ./src/myfaces-core-module-2.1.9/api/target/classes/META-INF/internal-resources/javax.faces/META-INF/resources/myfaces/_impl/_util/_ExtLang.js >>>>>> >>>>>> missing -- >>>>>> ./src/myfaces-core-module-2.1.9/api/target/classes/META-INF/resources/myfaces/META-INF/resources/myfaces/_impl/_util/_ExtLang.js >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> I have double and triple-checked to insure that I have a new >>>>>> myfaces-core-assembly-2.1.9-src.tar.gz download, and all of the files >>>>>> inside it were built on Sep 10, 8-to-10pm EST, which is right before >>>>>> the email you sent out. >>>>>> >>>>>> -rw-r--r-- 1 mkienenb users 8119569 Sep 10 21:31 >>>>>> myfaces-core-assembly-2.1.9-src.tar.gz >>>>>> -rw-r--r-- 1 mkienenb users 8119322 Sep 10 21:30 >>>>>> myfaces-core-assembly-2.1.9-src.zip >>>>>> >>>>>> -rw-rw-r-- 1 mkienenb users 900906 Sep 10 20:24 >>>>>> myfaces-api-2.1.9-sources.jar >>>>>> drwxrwxr-x 12 mkienenb users 4096 Sep 11 21:50 >>>>>> myfaces-core-module-2.1.9 >>>>>> -rw-rw-r-- 1 mkienenb users 5863230 Sep 10 20:24 >>>>>> myfaces-core-module-2.1.9-source-release.zip >>>>>> -rw-rw-r-- 1 mkienenb users 1809659 Sep 10 20:24 >>>>>> myfaces-impl-2.1.9-sources.jar >>>>>> -rw-rw-r-- 1 mkienenb users 423440 Sep 10 20:24 >>>>>> myfaces-impl-shared-2.1.9-sources.jar >>>>>> \ >>>>>> >>>>>> >>>>>> >>>>>> Unapproved licenses: >>>>>> >>>>>> >>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_EvalHandlers.js >>>>>> >>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_RuntimeQuirks.js >>>>>> >>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/xhrCore/engine/BaseRequest.js >>>>>> >>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_DomExperimental.js >>>>>> >>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_ExtLang.js >>>>>> >>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/dojo-LICENSE.TXT >>>>>> >>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/facelets-LICENSE.txt >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> On Mon, Sep 10, 2012 at 10:06 PM, Leonardo Uribe <[email protected]> >>>>>> wrote: >>>>>>> Hi >>>>>>> >>>>>>> I have fixed the files with missing licenses, included a fix for >>>>>>> MYFACES-3605, so I'll send another vote over the new artifacts soon. >>>>>>> >>>>>>> regards, >>>>>>> >>>>>>> Leonardo Uribe >>>>>>> >>>>>>> 2012/9/7 Leonardo Uribe <[email protected]>: >>>>>>>> Hi >>>>>>>> >>>>>>>> 2012/9/7 Mike Kienenberger <[email protected]>: >>>>>>>>> [X] -1 for fatal flaws that should cause these bits not to be >>>>>>>>> released: >>>>>>>>> >>>>>>>>> Looks like we have 5 files missing licensing information. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> 7 Unknown Licenses >>>>>>>>> >>>>>>>>> ******************************* >>>>>>>>> >>>>>>>>> Unapproved licenses: >>>>>>>>> >>>>>>>>> The five files below appear to be missing any kind of licensing >>>>>>>>> information. The rest of the files in this directory have licensing >>>>>>>>> information. >>>>>>>>> >>>>>>>>> >>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_EvalHandlers.js >>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_RuntimeQuirks.js >>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/xhrCore/engine/BaseRequest.js >>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_DomExperimental.js >>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_ExtLang.js >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>> It seems to be related to some refactoring into our code base. >>>>>>>> >>>>>>>>> >>>>>>>>> myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/dojo-LICENSE.TXT >>>>>>>>> >>>>>>>>> "New" BSD or AFL 2.1. Bsd is approved, so maybe just add to exclude >>>>>>>>> list. >>>>>>>>> >>>>>>>> >>>>>>>> Yes >>>>>>>> >>>>>>>>> >>>>>>>>> myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/facelets-LICENSE.txt >>>>>>>>> >>>>>>>>> APL 2, but unusual format? -- add to exclude list? >>>>>>>>> >>>>>>>> >>>>>>>> Yes. >>>>>>>> >>>>>>>> regards, >>>>>>>> >>>>>>>> Leonardo Uribe >>>>>>>> >>>>>>>>> >>>>>>>>> Below is the link describing what we need to do to add files to an >>>>>>>>> exclude list. >>>>>>>>> >>>>>>>>> http://mail-archives.apache.org/mod_mbox/jackrabbit-dev/200907.mbox/%[email protected]%3E >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> On Thu, Sep 6, 2012 at 11:30 PM, Mike Kienenberger >>>>>>>>> <[email protected]> wrote: >>>>>>>>>> Thanks! Not sure how I missed that one. Withdrawing my vote. >>>>>>>>>> I'll >>>>>>>>>> let you know how it turns out. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Thu, Sep 6, 2012 at 11:20 PM, Leonardo Uribe <[email protected]> >>>>>>>>>> wrote: >>>>>>>>>>> Hi >>>>>>>>>>> >>>>>>>>>>> This artifact: >>>>>>>>>>> >>>>>>>>>>> https://repository.apache.org/content/repositories/orgapachemyfaces-034/org/apache/myfaces/core/myfaces-core-module/2.1.9/myfaces-core-module-2.1.9-source-release.zip >>>>>>>>>>> >>>>>>>>>>> is the one that allows to build it using maven. In practice, it is a >>>>>>>>>>> copy of the sources from the svn. This artifact is included also in: >>>>>>>>>>> >>>>>>>>>>> https://repository.apache.org/content/repositories/orgapachemyfaces-034/org/apache/myfaces/core/myfaces-core-assembly/2.1.9/myfaces-core-assembly-2.1.9-src.zip >>>>>>>>>>> >>>>>>>>>>> Build it is quite simple: unpack and mvn install. >>>>>>>>>>> >>>>>>>>>>> regards, >>>>>>>>>>> >>>>>>>>>>> Leonardo Uribe >>>>>>>>>>> >>>>>>>>>>> 2012/9/6 Mike Kienenberger <[email protected]>: >>>>>>>>>>>> So I'm doing the work to vote for a release -- something I haven't >>>>>>>>>>>> participated in in a very long time. >>>>>>>>>>>> >>>>>>>>>>>> Leonardo's key in KEYS - check >>>>>>>>>>>> .jar.md5 matches - check >>>>>>>>>>>> .jar.asc.md5 matches - check >>>>>>>>>>>> .jar.sha1 matches -check >>>>>>>>>>>> .jar.asc.sha1 matches -check >>>>>>>>>>>> .asc files mat >>>>>>>>>>>> >>>>>>>>>>>> Includes source - check >>>>>>>>>>>> Source builds -- Not seeing any kind of build system or build >>>>>>>>>>>> instructions. >>>>>>>>>>>> >>>>>>>>>>>> Checking our web site only shows how to build from an svn checkout. >>>>>>>>>>>> >>>>>>>>>>>> Did we somehow lose the ability to build from our released source >>>>>>>>>>>> when >>>>>>>>>>>> we switched to maven? >>>>>>>>>>>> Because unless something has changed this is a big deal. >>>>>>>>>>>> >>>>>>>>>>>> http://www.apache.org/dev/release.html#what >>>>>>>>>>>> ==================== >>>>>>>>>>>> What Must Every ASF Release Contain? >>>>>>>>>>>> >>>>>>>>>>>> Every ASF release *must* contain a source package, which must be >>>>>>>>>>>> sufficient for a user to build and test the release provided they >>>>>>>>>>>> have >>>>>>>>>>>> access to the appropriate platform and tools. >>>>>>>>>>>> [...] >>>>>>>>>>>> What are the ASF requirements on approving a release? >>>>>>>>>>>> >>>>>>>>>>>> [...] Before voting +1 PMC members are required to download the >>>>>>>>>>>> signed >>>>>>>>>>>> source code package, compile it as provided, and test the resulting >>>>>>>>>>>> executable on their own platform, along with also verifying that >>>>>>>>>>>> the >>>>>>>>>>>> package contains the required contents. >>>>>>>>>>>> ==================== >>>>>>>>>>>> >>>>>>>>>>>> We hit this issue in Cayenne a couple years back and had to do some >>>>>>>>>>>> work to fix it. >>>>>>>>>>>> >>>>>>>>>>>> http://markmail.org/thread/njray5dbazwcdcts >>>>>>>>>>>> >>>>>>>>>>>> The natural inclination is to argue about it and try to say it's >>>>>>>>>>>> not >>>>>>>>>>>> required. One can read through lots of threads on that if you >>>>>>>>>>>> really >>>>>>>>>>>> want to satisfy that need. >>>>>>>>>>>> >>>>>>>>>>>> But it all comes down to the fact that our "open source" releases >>>>>>>>>>>> need >>>>>>>>>>>> to be something that someone can modify and build. And right now, >>>>>>>>>>>> that isn't doable. Source control systems come and go. The ASF >>>>>>>>>>>> might disappear next year. Or you might just be some poor guy >>>>>>>>>>>> who, >>>>>>>>>>>> five years from now, has to work on a project I wrote to fix some >>>>>>>>>>>> minor bug and find that the particular branch for Myfaces 2.1.9 >>>>>>>>>>>> accidentally got corrupted. The reasons for why it is done this >>>>>>>>>>>> way >>>>>>>>>>>> are numerous and worthwhile. But even if that doesn't sell you on >>>>>>>>>>>> it, in the end it comes down to being a requirement of a release, >>>>>>>>>>>> whether or not you agree with it. >>>>>>>>>>>> >>>>>>>>>>>> http://mail-archives.apache.org/mod_mbox/cayenne-dev/201008.mbox/%[email protected]%3E >>>>>>>>>>>> >>>>>>>>>>>> http://mail-archives.apache.org/mod_mbox/cayenne-dev/201008.mbox/%[email protected]%3E >>>>>>>>>>>> >>>>>>>>>>>> http://mail-archives.apache.org/mod_mbox/cayenne-dev/201008.mbox/%[email protected]%3E >>>>>>>>>>>> >>>>>>>>>>>> But don't just take my word on it, read through the 123 messages on >>>>>>>>>>>> the legal discuss thread :) >>>>>>>>>>>> >>>>>>>>>>>> http://markmail.org/thread/njray5dbazwcdcts >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> So at least for now, >>>>>>>>>>>> >>>>>>>>>>>> [X] -1 for fatal flaws that should cause these bits not to be >>>>>>>>>>>> released: >>>>>>>>>>>> >>>>>>>>>>>> - Release cannot be built and tested from source.
