I still have to vote -1 until we have fixed the licenses for all files that need licenses. Licensing is one of the few absolute requirements for an approved release.
I know that this vote is dying the death of a thousand cuts, but I am doing the best I can to identify as many problems at once. What has taken me several hours to identify this morning could have been done by someone knowledgeable with maven in a few minutes. On Thu, Sep 13, 2012 at 11:22 AM, Leonardo Uribe <[email protected]> wrote: > Hi > > Ok, good to know that. Maybe we can enable rat on the next release. I > think we can continue with the release vote too. > > regards, > > Leonardo > > 2012/9/13 Mike Kienenberger <[email protected]>: >> And here's what I did to come up with this list: >> >> mvn apache-rat:check -Drat.numUnapprovedLicenses=9999 >> >> ls -1 */target/rat.txt >> >> api/target/rat.txt >> bundle/target/rat.txt >> implee6/target/rat.txt >> impl/target/rat.txt >> parent/target/rat.txt >> shaded-impl/target/rat.txt >> shared-public/target/rat.txt >> shared/target/rat.txt >> >> and then went through that list of files by hand. >> >> >> On Thu, Sep 13, 2012 at 11:07 AM, Mike Kienenberger <[email protected]> >> wrote: >>> Due to my lack of maven experience, it's taken me awhile to figure out >>> how to configure apache rat so that I could get past the two license >>> exceptions in the api project. >>> >>> Here's the full list of unapproved files in the rest of the project: >>> >>> implee6/src/main/resources/META-INF/services/javax.servlet.ServletContainerInitializer >>> >>> impl/src/test/java/org/apache/myfaces/config/annotation/ClassByteCodeAnnotationFilterTest.java >>> impl/src/test/resources/META-INF/services/org.apache.myfaces.config.annotation.LifecycleProvider >>> impl/src/test/resources/org/apache/myfaces/view/facelets/tag/composite/testSimpleThisResourceReference.xhtml >>> impl/src/test/resources/org/apache/myfaces/view/facelets/tag/composite/javax.faces/jsf.js >>> impl/src/test/resources/org/apache/myfaces/view/facelets/tag/jsf/html/javax.faces/jsf.js >>> impl/src/test/resources/org/apache/myfaces/view/facelets/updateheadres/resources/javax.faces/jsf.js >>> impl/src/test/resources/org/apache/myfaces/lifecycle/view2.xhtml >>> impl/src/test/resources/org/apache/myfaces/lifecycle/view1.jsp >>> impl/src/test/resources/org/apache/myfaces/context/nestedScriptCDATA.xml >>> impl/src/main/resources/META-INF/xdoc-component.vmimpl/src/main/resources/META-INF/licenses/glassfish-LICENSE.txt >>> impl/src/main/resources/META-INF/licenses/facelets-LICENSE.txt >>> impl/src/main/resources/META-INF/services/org.apache.myfaces.config.annotation.LifecycleProvider >>> impl/src/main/resources/META-INF/xdoc-tag.vm >>> impl/src/main/resources/META-INF/xdoc-web-config.vm >>> impl/src/main/resources/org/apache/myfaces/resource/javaee_5.xsd >>> impl/src/main/resources/org/apache/myfaces/resource/javaee_web_services_client_1_2.xsd >>> impl/src/main/conf/META-INF/.standard-faces-config-base.xml.jsfdia >>> >>> shared-public/src/test/resources/org/apache/myfaces/shared/application/view2.xhtml >>> shared-public/src/test/resources/org/apache/myfaces/shared/application/view1.jsp >>> >>> shared/src/test/resources/org/apache/myfaces/shared/application/view2.xhtml >>> shared/src/test/resources/org/apache/myfaces/shared/application/view1.jsp >>> >>> >>> Here is what needed to be added to the api/om.xml file in order to >>> skip the two files. From what I can tell, we probably should write >>> license rules for these files rather than exclude them, but that's not >>> a show-stopper. >>> >>> <plugin> >>> <groupId>org.apache.rat</groupId> >>> <artifactId>apache-rat-plugin</artifactId> >>> <configuration> >>> <excludes> >>> >>> <exclude>src/main/resources/META-INF/licenses/dojo-LICENSE.TXT</exclude> >>> >>> <exclude>src/main/resources/META-INF/licenses/facelets-LICENSE.txt</exclude> >>> </excludes> >>> </configuration> >>> </plugin> >>> >>> >>> On Wed, Sep 12, 2012 at 2:08 AM, Leonardo Uribe <[email protected]> wrote: >>>> Hi >>>> >>>> I have updated the artifacts, so we can continue the vote. Please put >>>> the vote on the mail with subject: >>>> >>>> [VOTE] release of Apache MyFaces 2.1.9 >>>> [VOTE] release of Apache MyFaces 2.0.15 >>>> >>>> regards, >>>> >>>> Leonardo Uribe >>>> >>>> 2012/9/11 Leonardo Uribe <[email protected]>: >>>>> Hi >>>>> >>>>> It seems that one is the only artifact that does not have the update. >>>>> All other source files installed in nexus repository are ok. Maybe it >>>>> was because the assembly files were compiled before the final >>>>> sources-release.zip file, so the old one was used. >>>>> >>>>> I'll rebuild everything everything again and send another vote mail. >>>>> Thanks for notice it. >>>>> >>>>> regards, >>>>> >>>>> Leonardo >>>>> >>>>> 2012/9/11 Mike Kienenberger <[email protected]>: >>>>>> So I finally thought to look at the dates of the files inside of the >>>>>> the Sep 10th myfaces-core-module-2.1.9-source-release.zip file. >>>>>> They are all from >>>>>> Sep 4th, so the problem does appear to be that this piece wasn't >>>>>> rebuilt in your last release. This is probably why the license files >>>>>> are still missing. >>>>>> >>>>>> >>>>>> On Tue, Sep 11, 2012 at 10:51 PM, Mike Kienenberger <[email protected]> >>>>>> wrote: >>>>>>> Leonardo, >>>>>>> >>>>>>> Rat is still complaining about the same 7 licensing issues. >>>>>>> >>>>>>> However, only certain instances of these files appear to be missing >>>>>>> licenses. >>>>>>> >>>>>>> myfaces-core-2.1.9-src> find . -name _ExtLang.js -exec ls -1 {} \; >>>>>>> >>>>>>> .This one has the license header. It comes from >>>>>>> myfaces-api-2.1.9-sources.jar inside of >>>>>>> myfaces-core-assembly-2.1.9-src.tar.gz >>>>>>> >>>>>>> exists -- >>>>>>> ./src/META-INF/internal-resources/org.apache.myfaces.core.impl.util/_ExtLang.js >>>>>>> >>>>>>> >>>>>>> The following two are identical. The first one is the one rat flags >>>>>>> as needing a header. I guess that's because it's the "source" >>>>>>> version of all the rest of them. It comes from >>>>>>> myfaces-core-module-2.1.9-source-release.zip inside of >>>>>>> myfaces-core-assembly-2.1.9-src.tar.gz. Maybe this file also needs >>>>>>> to be fixed in svn? I was not able to determine where this file comes >>>>>>> from in SVN. You had said that module was essentially a snapshot of >>>>>>> SVN. Maybe this snapshot did not get updated because we reused the >>>>>>> version number? >>>>>>> >>>>>>> missing -- >>>>>>> ./src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_ExtLang.js >>>>>>> >>>>>>> missing -- >>>>>>> ./src/myfaces-core-module-2.1.9/api/target/classes/META-INF/internal-resources/org.apache.myfaces.core.impl.util/_ExtLang.js >>>>>>> >>>>>>> [........ The rest of this email can likely be ignored....] >>>>>>> >>>>>>> The following two are the compressed-down versions with no extra >>>>>>> whitespace or comments, which is what you would expect: >>>>>>> >>>>>>> missing -- >>>>>>> ./src/myfaces-core-module-2.1.9/api/target/classes/META-INF/internal-resources/javax.faces/META-INF/resources/myfaces/_impl/_util/_ExtLang.js >>>>>>> >>>>>>> missing -- >>>>>>> ./src/myfaces-core-module-2.1.9/api/target/classes/META-INF/resources/myfaces/META-INF/resources/myfaces/_impl/_util/_ExtLang.js >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> I have double and triple-checked to insure that I have a new >>>>>>> myfaces-core-assembly-2.1.9-src.tar.gz download, and all of the files >>>>>>> inside it were built on Sep 10, 8-to-10pm EST, which is right before >>>>>>> the email you sent out. >>>>>>> >>>>>>> -rw-r--r-- 1 mkienenb users 8119569 Sep 10 21:31 >>>>>>> myfaces-core-assembly-2.1.9-src.tar.gz >>>>>>> -rw-r--r-- 1 mkienenb users 8119322 Sep 10 21:30 >>>>>>> myfaces-core-assembly-2.1.9-src.zip >>>>>>> >>>>>>> -rw-rw-r-- 1 mkienenb users 900906 Sep 10 20:24 >>>>>>> myfaces-api-2.1.9-sources.jar >>>>>>> drwxrwxr-x 12 mkienenb users 4096 Sep 11 21:50 >>>>>>> myfaces-core-module-2.1.9 >>>>>>> -rw-rw-r-- 1 mkienenb users 5863230 Sep 10 20:24 >>>>>>> myfaces-core-module-2.1.9-source-release.zip >>>>>>> -rw-rw-r-- 1 mkienenb users 1809659 Sep 10 20:24 >>>>>>> myfaces-impl-2.1.9-sources.jar >>>>>>> -rw-rw-r-- 1 mkienenb users 423440 Sep 10 20:24 >>>>>>> myfaces-impl-shared-2.1.9-sources.jar >>>>>>> \ >>>>>>> >>>>>>> >>>>>>> >>>>>>> Unapproved licenses: >>>>>>> >>>>>>> >>>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_EvalHandlers.js >>>>>>> >>>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_RuntimeQuirks.js >>>>>>> >>>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/xhrCore/engine/BaseRequest.js >>>>>>> >>>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_DomExperimental.js >>>>>>> >>>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_ExtLang.js >>>>>>> >>>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/dojo-LICENSE.TXT >>>>>>> >>>>>>> /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/facelets-LICENSE.txt >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Mon, Sep 10, 2012 at 10:06 PM, Leonardo Uribe <[email protected]> >>>>>>> wrote: >>>>>>>> Hi >>>>>>>> >>>>>>>> I have fixed the files with missing licenses, included a fix for >>>>>>>> MYFACES-3605, so I'll send another vote over the new artifacts soon. >>>>>>>> >>>>>>>> regards, >>>>>>>> >>>>>>>> Leonardo Uribe >>>>>>>> >>>>>>>> 2012/9/7 Leonardo Uribe <[email protected]>: >>>>>>>>> Hi >>>>>>>>> >>>>>>>>> 2012/9/7 Mike Kienenberger <[email protected]>: >>>>>>>>>> [X] -1 for fatal flaws that should cause these bits not to be >>>>>>>>>> released: >>>>>>>>>> >>>>>>>>>> Looks like we have 5 files missing licensing information. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> 7 Unknown Licenses >>>>>>>>>> >>>>>>>>>> ******************************* >>>>>>>>>> >>>>>>>>>> Unapproved licenses: >>>>>>>>>> >>>>>>>>>> The five files below appear to be missing any kind of licensing >>>>>>>>>> information. The rest of the files in this directory have >>>>>>>>>> licensing >>>>>>>>>> information. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_EvalHandlers.js >>>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_RuntimeQuirks.js >>>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/xhrCore/engine/BaseRequest.js >>>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_DomExperimental.js >>>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_ExtLang.js >>>>>>>>>> >>>>>>>>>> >>>>>>>>> >>>>>>>>> It seems to be related to some refactoring into our code base. >>>>>>>>> >>>>>>>>>> >>>>>>>>>> myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/dojo-LICENSE.TXT >>>>>>>>>> >>>>>>>>>> "New" BSD or AFL 2.1. Bsd is approved, so maybe just add to exclude >>>>>>>>>> list. >>>>>>>>>> >>>>>>>>> >>>>>>>>> Yes >>>>>>>>> >>>>>>>>>> >>>>>>>>>> myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/facelets-LICENSE.txt >>>>>>>>>> >>>>>>>>>> APL 2, but unusual format? -- add to exclude list? >>>>>>>>>> >>>>>>>>> >>>>>>>>> Yes. >>>>>>>>> >>>>>>>>> regards, >>>>>>>>> >>>>>>>>> Leonardo Uribe >>>>>>>>> >>>>>>>>>> >>>>>>>>>> Below is the link describing what we need to do to add files to an >>>>>>>>>> exclude list. >>>>>>>>>> >>>>>>>>>> http://mail-archives.apache.org/mod_mbox/jackrabbit-dev/200907.mbox/%[email protected]%3E >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Thu, Sep 6, 2012 at 11:30 PM, Mike Kienenberger >>>>>>>>>> <[email protected]> wrote: >>>>>>>>>>> Thanks! Not sure how I missed that one. Withdrawing my vote. >>>>>>>>>>> I'll >>>>>>>>>>> let you know how it turns out. >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> On Thu, Sep 6, 2012 at 11:20 PM, Leonardo Uribe <[email protected]> >>>>>>>>>>> wrote: >>>>>>>>>>>> Hi >>>>>>>>>>>> >>>>>>>>>>>> This artifact: >>>>>>>>>>>> >>>>>>>>>>>> https://repository.apache.org/content/repositories/orgapachemyfaces-034/org/apache/myfaces/core/myfaces-core-module/2.1.9/myfaces-core-module-2.1.9-source-release.zip >>>>>>>>>>>> >>>>>>>>>>>> is the one that allows to build it using maven. In practice, it is >>>>>>>>>>>> a >>>>>>>>>>>> copy of the sources from the svn. This artifact is included also >>>>>>>>>>>> in: >>>>>>>>>>>> >>>>>>>>>>>> https://repository.apache.org/content/repositories/orgapachemyfaces-034/org/apache/myfaces/core/myfaces-core-assembly/2.1.9/myfaces-core-assembly-2.1.9-src.zip >>>>>>>>>>>> >>>>>>>>>>>> Build it is quite simple: unpack and mvn install. >>>>>>>>>>>> >>>>>>>>>>>> regards, >>>>>>>>>>>> >>>>>>>>>>>> Leonardo Uribe >>>>>>>>>>>> >>>>>>>>>>>> 2012/9/6 Mike Kienenberger <[email protected]>: >>>>>>>>>>>>> So I'm doing the work to vote for a release -- something I haven't >>>>>>>>>>>>> participated in in a very long time. >>>>>>>>>>>>> >>>>>>>>>>>>> Leonardo's key in KEYS - check >>>>>>>>>>>>> .jar.md5 matches - check >>>>>>>>>>>>> .jar.asc.md5 matches - check >>>>>>>>>>>>> .jar.sha1 matches -check >>>>>>>>>>>>> .jar.asc.sha1 matches -check >>>>>>>>>>>>> .asc files mat >>>>>>>>>>>>> >>>>>>>>>>>>> Includes source - check >>>>>>>>>>>>> Source builds -- Not seeing any kind of build system or build >>>>>>>>>>>>> instructions. >>>>>>>>>>>>> >>>>>>>>>>>>> Checking our web site only shows how to build from an svn >>>>>>>>>>>>> checkout. >>>>>>>>>>>>> >>>>>>>>>>>>> Did we somehow lose the ability to build from our released source >>>>>>>>>>>>> when >>>>>>>>>>>>> we switched to maven? >>>>>>>>>>>>> Because unless something has changed this is a big deal. >>>>>>>>>>>>> >>>>>>>>>>>>> http://www.apache.org/dev/release.html#what >>>>>>>>>>>>> ==================== >>>>>>>>>>>>> What Must Every ASF Release Contain? >>>>>>>>>>>>> >>>>>>>>>>>>> Every ASF release *must* contain a source package, which must be >>>>>>>>>>>>> sufficient for a user to build and test the release provided they >>>>>>>>>>>>> have >>>>>>>>>>>>> access to the appropriate platform and tools. >>>>>>>>>>>>> [...] >>>>>>>>>>>>> What are the ASF requirements on approving a release? >>>>>>>>>>>>> >>>>>>>>>>>>> [...] Before voting +1 PMC members are required to download the >>>>>>>>>>>>> signed >>>>>>>>>>>>> source code package, compile it as provided, and test the >>>>>>>>>>>>> resulting >>>>>>>>>>>>> executable on their own platform, along with also verifying that >>>>>>>>>>>>> the >>>>>>>>>>>>> package contains the required contents. >>>>>>>>>>>>> ==================== >>>>>>>>>>>>> >>>>>>>>>>>>> We hit this issue in Cayenne a couple years back and had to do >>>>>>>>>>>>> some >>>>>>>>>>>>> work to fix it. >>>>>>>>>>>>> >>>>>>>>>>>>> http://markmail.org/thread/njray5dbazwcdcts >>>>>>>>>>>>> >>>>>>>>>>>>> The natural inclination is to argue about it and try to say it's >>>>>>>>>>>>> not >>>>>>>>>>>>> required. One can read through lots of threads on that if you >>>>>>>>>>>>> really >>>>>>>>>>>>> want to satisfy that need. >>>>>>>>>>>>> >>>>>>>>>>>>> But it all comes down to the fact that our "open source" releases >>>>>>>>>>>>> need >>>>>>>>>>>>> to be something that someone can modify and build. And right >>>>>>>>>>>>> now, >>>>>>>>>>>>> that isn't doable. Source control systems come and go. The ASF >>>>>>>>>>>>> might disappear next year. Or you might just be some poor guy >>>>>>>>>>>>> who, >>>>>>>>>>>>> five years from now, has to work on a project I wrote to fix some >>>>>>>>>>>>> minor bug and find that the particular branch for Myfaces 2.1.9 >>>>>>>>>>>>> accidentally got corrupted. The reasons for why it is done this >>>>>>>>>>>>> way >>>>>>>>>>>>> are numerous and worthwhile. But even if that doesn't sell you >>>>>>>>>>>>> on >>>>>>>>>>>>> it, in the end it comes down to being a requirement of a release, >>>>>>>>>>>>> whether or not you agree with it. >>>>>>>>>>>>> >>>>>>>>>>>>> http://mail-archives.apache.org/mod_mbox/cayenne-dev/201008.mbox/%[email protected]%3E >>>>>>>>>>>>> >>>>>>>>>>>>> http://mail-archives.apache.org/mod_mbox/cayenne-dev/201008.mbox/%[email protected]%3E >>>>>>>>>>>>> >>>>>>>>>>>>> http://mail-archives.apache.org/mod_mbox/cayenne-dev/201008.mbox/%[email protected]%3E >>>>>>>>>>>>> >>>>>>>>>>>>> But don't just take my word on it, read through the 123 messages >>>>>>>>>>>>> on >>>>>>>>>>>>> the legal discuss thread :) >>>>>>>>>>>>> >>>>>>>>>>>>> http://markmail.org/thread/njray5dbazwcdcts >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> So at least for now, >>>>>>>>>>>>> >>>>>>>>>>>>> [X] -1 for fatal flaws that should cause these bits not to be >>>>>>>>>>>>> released: >>>>>>>>>>>>> >>>>>>>>>>>>> - Release cannot be built and tested from source.
