- signatures and checksums match - source builds - apache rat passes +1
Below are the linux commands I used to verify the release of the myfaces-core-assembly-4.0.1-src files: ============================================= wget https://repository.apache.org/content/repositories/orgapachemyfaces-1231/org/apache/myfaces/core/myfaces-core-assembly/4.0.1/myfaces-core-assembly-4.0.1-src.tar.gz wget https://repository.apache.org/content/repositories/orgapachemyfaces-1231/org/apache/myfaces/core/myfaces-core-assembly/4.0.1/myfaces-core-assembly-4.0.1-src.tar.gz.asc wget https://repository.apache.org/content/repositories/orgapachemyfaces-1231/org/apache/myfaces/core/myfaces-core-assembly/4.0.1/myfaces-core-assembly-4.0.1-src.tar.gz.md5 wget https://repository.apache.org/content/repositories/orgapachemyfaces-1231/org/apache/myfaces/core/myfaces-core-assembly/4.0.1/myfaces-core-assembly-4.0.1-src.tar.gz.sha1 wget https://repository.apache.org/content/repositories/orgapachemyfaces-1231/org/apache/myfaces/core/myfaces-core-assembly/4.0.1/myfaces-core-assembly-4.0.1-src.zip wget https://repository.apache.org/content/repositories/orgapachemyfaces-1231/org/apache/myfaces/core/myfaces-core-assembly/4.0.1/myfaces-core-assembly-4.0.1-src.zip.asc wget https://repository.apache.org/content/repositories/orgapachemyfaces-1231/org/apache/myfaces/core/myfaces-core-assembly/4.0.1/myfaces-core-assembly-4.0.1-src.zip.md5 wget https://repository.apache.org/content/repositories/orgapachemyfaces-1231/org/apache/myfaces/core/myfaces-core-assembly/4.0.1/myfaces-core-assembly-4.0.1-src.zip.sha1 # check checksums find . -name '*.md5' -exec cat {} \; -printf ' %f\n' | sed 's|\.md5$||' | md5sum -c find . -name '*.sha1' -exec cat {} \; -printf ' %f\n' | sed 's|\.sha1$||' | sha1sum -c # check signatures wget https://downloads.apache.org/myfaces/KEYS gpg --import KEYS find . -name '*.asc' -exec gpg --verify {} \; # verify tar.gz and zip sources are identical mkdir src cd src tar xvf ../myfaces-core-assembly-4.0.1-src.tar.gz mv myfaces-core-2.0.22-src/ myfaces-core-2.0.22-src-tar-gz unzip ../myfaces-core-assembly-4.0.1-src.zip # should be no output diff -rq myfaces-core-4.0.1-src* # should be "are identical" output diff -srq myfaces-core-4.0.1-src* # build source cd myfaces-core-4.0.1-src/src/ find \( -name '*.jar' -o -name '*.zip' \) -exec unzip -n {} \; cd myfaces-core-module-4.0.1/ /usr/bin/mvn -v # Apache Maven 3.8.6 (SUSE 3.8.6-150200.4.9.8) # Java version: 11.0.19, vendor: Oracle Corporation, runtime: /usr/lib64/jvm/java-11-openjdk-11 /usr/bin/mvn clean install -DchromeDriverVersion=112.0.5615.49 mvn apache-rat:check # To check for all errors, if more than one project is affected # mvn apache-rat:check -Drat.numUnapprovedLicenses=9999 # To see details of rat failure, including location of rat report # mvn -e -X apache-rat:check On Wed, May 17, 2023 at 8:42 PM Thomas Andraschko < [email protected]> wrote: > +1 > > Melloware <[email protected]> schrieb am Mi., 17. Mai 2023, 22:11: > >> +1 >> >> >> On 5/17/2023 3:52 PM, Volodymyr Siedlecki wrote: >> > Hi, >> > >> > I was running the needed tasks to get the 4.0.1 release of Apache >> > MyFaces core out. >> > >> > Please note that this vote concerns all of the following parts: >> > 1. Maven artifact group "org.apache.myfaces.core" v4.0.1 [1] >> > >> > The artifacts were deployed on nexus repo [1] for binary and source >> > packages. >> > >> > The release notes could be found at [4]. >> > >> > The japicmp tool shows no binary incompatibilities with 4.0.1 when >> > compared to the previous 4.0.0 jar. Please take a look at the attached >> > results.html. >> > If requested, I can provide a comparison to the Jakarta Faces 4.0.1 API. >> > >> > This release has not yet been run against the TCK, but I am working to >> > create a build which will run against the TCK. I hope to have results >> > by May 19. >> > >> > Please take a look at the "4.0.1" artifacts and vote! (see [3]) >> > >> > Please note: This vote is "majority approval" with a minimum of three >> > +1 votes (see [2]). >> > >> > ------------------------------------------------ >> > [ ] +1 for community members who have reviewed the bits >> > [ ] +0 >> > [ ] -1 for fatal flaws that should cause these bits not to be >> > released, and why. >> > ------------------------------------------------ >> > >> > Thanks, >> > >> > Volodymyr >> > >> > [1] >> > >> https://repository.apache.org/content/repositories/orgapachemyfaces-1231/org/apache/myfaces/core/ >> > [2] http://www.apache.org/foundation/voting.html#ReleaseVotes >> > [3] >> > >> https://repository.apache.org/content/repositories/orgapachemyfaces-1231/org/apache/myfaces/core/myfaces-core-assembly/ >> > [4] >> > >> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=10600&version=12352978 >> > < >> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=10600&version=12352978> >> >> > >> >> -- >> Melloware >> melloware@ >> >>
