Maven 3.3.1 from last weekend seems not having this issue :-)
Am 21.03.15 um 10:34 schrieb Udo Schnurpfeil: > Yes, take a look at MyFaces Core API: > > #http://repo.maven.apache.org/maven2/org/apache/myfaces/core/myfaces-api/2.2.7/ > > Cayenne also have it... > > http://repo.maven.apache.org/maven2/org/apache/cayenne/cayenne-client/4.0.M2/ > > You may google that: "site:repo.maven.apache.org asc.md5" > > > > I found this issue: http://jira.codehaus.org/browse/MNG-5504 > > So it's evident, that the repo server is full of *.asc.md5 files. > > > Regards, > > Udo > > > Am 21.03.15 um 00:09 schrieb Mike Kienenberger: >> On Fri, Mar 20, 2015 at 6:47 PM, Udo Schnurpfeil <[email protected]> wrote: >>> It seems to be very usual, to have these file. Other apache projects >>> also have these files. >>> >>>> Does anyone know why? >> >> Really? I haven't seen them for the other Myfaces releases nor have I >> seen them on Cayenne. >> Unfortunately, the only thing I know in Maven is "mvn install" and how >> to exclude files in rat, so I can't help :) >> >>> I think the *.asc is also a file that will not be distributed over the >>> mirrors... >> >> Right. *.asc and *.md5 and *.sha1 are only available directly from >> the ASF. Otherwise the mirror sites could tamper with the releases by >> creating their own asc/md5/sha1 files after modifying the release. >> >> I finished evaluating the main release yesterday and everything is >> fine by me. But I still need to download, build, and evaluate the >> examples release. I'll try to get to that either tonight or Saturday >> morning (tomorrow for me). >> >>> Am 19.03.15 um 18:13 schrieb Mike Kienenberger: >>>> This is also not a release-blocker but DEPENDENCIES needs to be added >>>> to the exclusion list or apache rat will fail. >>>> I'll open an issue on this. >>>> >>>> --- tobago-2.0.7/pom.xml 2015-03-18 01:20:28.000000000 -0400 >>>> +++ tobago-2.0.7-modified/pom.xml 2015-03-19 13:06:10.725792204 -0400 >>>> @@ -972,6 +972,9 @@ >>>> <version>0.9</version> >>>> <configuration> >>>> <excludes> >>>> + <!-- This file is created during a release and needs no >>>> licensing text --> >>>> + <exclude>DEPENDENCIES</exclude> >>>> + >>>> <!-- jQuery --> >>>> <exclude>**/jquery*.js</exclude> >>>> <exclude>**/jquery*.map</exclude> >>>> >>>> >>>> >>>> On Wed, Mar 18, 2015 at 9:49 PM, Mike Kienenberger <[email protected]> >>>> wrote: >>>>> Yes, I meant 2.0.7, not 2.0.6 (copy and paste error). >>>>> >>>>> Ok. I see the tobago-assembly-2.0.7-dist.tar.gz and >>>>> tobago-assembly-2.0.7-dist.zip files now. Thanks! >>>>> >>>>> I'll download those, do the appropriate checks, and compare them to >>>>> what the source built. >>>>> >>>>> It may take me until Saturday, but I'm hoping to have it for you tomorrow. >>>>> >>>>> I'm just going to check the release requirements (builds from source, >>>>> signatures match, checksums match, source build matches distribution, >>>>> apache rat passes) rather than trying to evaluate the technical merits >>>>> of this Tobago Release. I'll leave the code evaluation to you guys :) >>>>> >>>>> >>>>> On Wed, Mar 18, 2015 at 6:44 PM, Udo Schnurpfeil <[email protected]> >>>>> wrote: >>>>>> Hi Mike, >>>>>> >>>>>> thank you for your participation. I do my annotations inline >>>>>> >>>>>> >>>>>> Am 18.03.15 um 21:09 schrieb Mike Kienenberger: >>>>>>> Just as an update, I was able to build >>>>>>> myfaces-tobago-2.0.6-source-release.zip easily. >>>>>> >>>>>> Great! >>>>>> >>>>>> Did you mean 2.0.6 or 2.0.7? >>>>>> >>>>>>> >>>>>>> On Wed, Mar 18, 2015 at 12:45 PM, Mike Kienenberger >>>>>>> <[email protected]> wrote: >>>>>>>> So I thought I'd help out with the vote for the Tobago release, which >>>>>>>> I haven't done before. >>>>>>>> >>>>>>>> But I'm confused by the immensity of the release artifacts at >>>>>>>> https://repository.apache.org/content/repositories/orgapachemyfaces-1046/org/apache/myfaces/tobago/. >>>>>> >>>>>> The dist is in subfolder "tobago-assembly" >>>>>> >>>>>> By the way: >>>>>> For people who have a running application using Tobago and Maven, they >>>>>> can add the stating repo, and only have to change the version number to >>>>>> test their application. >>>>>> >>>>>>>> >>>>>>>> What exactly is being released? Which file corresponds to what is >>>>>>>> going to become myfaces-tobago-2.0.7-dist.tar.gz? I see nothing with >>>>>>>> this name in the most obvious directories, but I haven't checked all >>>>>>>> 27!!! folders in the staging repository:. >>>>>>>> >>>>>>>> Along with that, what file is the source file to build >>>>>>>> myfaces-tobago-2.0.7-dist.tar.gz? Is it >>>>>>>> https://repository.apache.org/content/repositories/orgapachemyfaces-1046/org/apache/myfaces/tobago/tobago/2.0.7/tobago-2.0.7-source-release.zip? >>>>>>>> >>>>>>>> all I have to do is unpack it and run "mvn install" on it, right? >>>>>>>> >>>>>>>> There also seems to be some unnecessary build artifacts. Not a >>>>>>>> show-shopper for release, but it should be cleaned up. >>>>>>>> >>>>>>>> tobago-2.0.7-source-release.zip.asc.asc >>>>>>>> tobago-2.0.7-source-release.zip.asc.asc.md5 >>>>>>>> tobago-2.0.7-source-release.zip.asc.asc.sha1 >>>>>>>> tobago-2.0.7-source-release.zip.asc.md5 >>>>>>>> tobago-2.0.7-source-release.zip.asc.sha1 >>>>>>>> >>>>>> >>>>>> Yes of course, I'll try to fix that in the next release. But not >>>>>> problem: the script to copy the release files to the release server will >>>>>> filter the files. >>>>>> >>>>>>>> >>>>>>>> Altogether, I would expect to find the following items based on the >>>>>>>> 2.0.6 release: >>>>>>>> >>>>>>>> myfaces-tobago-2.0.6-dist.tar.gz >>>>>>>> myfaces-tobago-2.0.6-dist.tar.gz.md5 >>>>>>>> myfaces-tobago-2.0.6-dist.tar.gz.asc >>>>>>>> >>>>>>>> myfaces-tobago-2.0.6-dist.zip >>>>>>>> myfaces-tobago-2.0.6-dist.zip.md5 >>>>>>>> myfaces-tobago-2.0.6-dist.zip.asc >>>>>>>> >>>>>>>> myfaces-tobago-2.0.6-source-release.zip >>>>>>>> myfaces-tobago-2.0.6-source-release.zip.md5 >>>>>>>> myfaces-tobago-2.0.6-source-release.zip.asc >>>>>>>> >>>>>>>> myfaces-tobago-2.0.6-example.tar.gz >>>>>>>> myfaces-tobago-2.0.6-example.tar.gz.md5 >>>>>>>> myfaces-tobago-2.0.6-example.tar.gz.asc >>>>>>>> >>>>>>>> myfaces-tobago-2.0.6-example.zip >>>>>>>> myfaces-tobago-2.0.6-example.zip.md5 >>>>>>>> myfaces-tobago-2.0.6-example.zip.asc >>>>>>>> >>>>>>>> And I would expect myfaces-tobago-2.0.6-example.zip to produce all of >>>>>>>> the example artifacts and myfaces-tobago-2.0.6-source-release.zip to >>>>>>>> produce all of the other artifacts. >>>>>> >>>>>> The example.zip only contains the most important examples. >>>>>>>> >>>>>>>> Thanks, >>>>>>>> -Mike >>>>>> >>>>>> Regards, >>>>>> >>>>>> Udo
