+1
* Sig/Xsums OK, but you have no other signatures on your key to verify
that the key used to sign these artifacts is actually your key, Aaron.
Maybe you can find someone (in person or via phone) or who can your key
for you? [1]
* Verified that geoindexing is "off"
* Cursory glance over dependencies getting bundled in shaded JARs and
they look OK
* Listed commit exists in the repo
* L&N look correct for source release
* DISCLAIMER present
* Could build from source (`mvn package`)
Overview on your website:
* "Apache Rya (incubating) is a scalable RDF triple store built on top
of a columnar index store (Accumulo)." Apache Accumulo®, please.
* Required links are present to ASF
* Incubator branding looks good (to my memory)
* "Apache Rya (incubating)" is prominent too.
Other things:
* Noticed lots of warnings in your Maven project. Would be good to
address this to reduce the likelihood of build issues by users. [2]
* Nit: would be good to include when the 72hrs is "up" (with tz) instead
of relying on the timestamp that the message landed in
someone's inbox.
* Got an error running a `mvn install` (since your dependency graph
seems to be busted -- couldn't run a `mvn dependency:tree` without as I
should be able to). [3] Rerunning it was fine the second time..
* Maintaining your shaded jars over time is probably a losing battle (if
the licensing issues this time around weren't sign enough). I'd suggest
you start putting some thought in how your source-release creates
binaries that can be useful for people who want to run Rya but are not
using the exact versions of all of the dependencies you're bundling for
them.
* I didn't inspect the JARs you're also distributing for licensing
correctness. Will let this slide since for now :)
- Josh
[1] https://www.apache.org/dev/release-signing.html#web-of-trust
[2] https://paste.apache.org/CQf3
[3] https://paste.apache.org/ssGd
Aaron D. Mihalik wrote:
I am pleased to be calling this vote for the source release of Apache Rya
(Incubating), version 3.2.10.
The source zip, including signatures, digests, etc. can be found at:
https://dist.apache.org/repos/dist/dev/incubator/rya/rya-incubating-3.2.10-rc3/
Ancillary artifacts such as poms, jars, wars, ect. can be found here:
https://repository.apache.org/content/repositories/orgapacherya-1004/org/apache/rya/rya-project/3.2.10-incubating/
The Git tag is rya-incubating-3.2.10-rc3
The Git commit ID is 66d8b7f060bddeeb7c50cb0918f98ce3b265c564
https://git-wip-us.apache.org/repos/asf?p=incubator-rya.git;a=commit;h=66d8b7f060bddeeb7c50cb0918f98ce3b265c564
Checksums of rya-project-3.2.10-source-release.zip:
SHA1: 4468f55b9f381e9103ca1e2e9c25b30e1cad4ed0
MD5: a28d9a146857576903ff4fc3f7dae908
Release artifacts are signed with the following key:
https://people.apache.org/keys/committer/mihalik.asc
KEYS file available here:
https://dist.apache.org/repos/dist/release/incubator/rya/KEYS
Issues that were closed/resolved for this release are here:
https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12334209&styleName=Html&projectId=12319020
Issues resolved between RC1 and RC2 are here:
https://issues.apache.org/jira/browse/RYA-184
Issues resolved between RC2 and RC3 are here:
https://issues.apache.org/jira/browse/RYA-209
The vote will be open for 72 hours.
Please download the release candidate and evaluate the necessary items
including checking hashes, signatures, build from source, and test. The
please vote:
[ ] +1 Release this package as rya-project-3.2.10
[ ] +0 no opinion
[ ] -1 Do not release this package because because...
