bitflicker64 commented on code in PR #399:
URL:
https://github.com/apache/hugegraph-toolchain/pull/399#discussion_r4267203293
##########
pom.xml:
##########
@@ -83,93 +116,106 @@
<docker.repo>${project.name}</docker.repo>
<docker.tag>${project.version}</docker.tag>
<hbase.version>2.2.3</hbase.version>
+ <hugegraph.common.version>1.0.0</hugegraph.common.version>
</properties>
- <dependencies>
- <!--TODO: enhance it later to avoid conflicts now -->
-<!-- <dependency>-->
-<!-- <groupId>commons-io</groupId>-->
-<!-- <artifactId>commons-io</artifactId>-->
-<!-- <version>2.7</version>-->
-<!-- </dependency>-->
-<!-- <dependency>-->
-<!-- <groupId>org.apache.commons</groupId>-->
-<!-- <artifactId>commons-lang3</artifactId>-->
-<!-- <version>3.9</version>-->
-<!-- </dependency>-->
-<!-- <dependency>-->
-<!-- <groupId>com.google.guava</groupId>-->
-<!-- <artifactId>guava</artifactId>-->
-<!-- <version>29.0-jre</version>-->
-<!-- </dependency>-->
-<!-- <dependency>-->
-<!-- <groupId>org.apache.commons</groupId>-->
-<!-- <artifactId>commons-compress</artifactId>-->
-<!-- <version>1.21</version>-->
-<!-- </dependency>-->
- </dependencies>
+ <!-- Note: dependencies won't be imported in root & won't be inherited by
default,
+ just defined for submodules (more flexible) -->
+ <dependencyManagement>
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.hugegraph</groupId>
+ <artifactId>hugegraph-common</artifactId>
+ <version>${hugegraph.common.version}</version>
+ </dependency>
-<!-- <profiles>-->
-<!-- <profile>-->
-<!-- <id>release</id>-->
-<!-- <build>-->
-<!-- <plugins>-->
-<!-- <plugin>-->
-<!-- <groupId>org.apache.maven.plugins</groupId>-->
-<!-- <artifactId>maven-source-plugin</artifactId>-->
-<!-- <version>2.2.1</version>-->
-<!-- <executions>-->
-<!-- <execution>-->
-<!-- <id>attach-sources</id>-->
-<!-- <goals>-->
-<!-- <goal>jar-no-fork</goal>-->
-<!-- </goals>-->
-<!-- </execution>-->
-<!-- </executions>-->
-<!-- </plugin>-->
-<!-- <plugin>-->
-<!-- <groupId>org.apache.maven.plugins</groupId>-->
-<!-- <artifactId>maven-javadoc-plugin</artifactId>-->
-<!-- <version>2.9.1</version>-->
-<!-- <executions>-->
-<!-- <execution>-->
-<!-- <id>attach-javadocs</id>-->
-<!-- <goals>-->
-<!-- <goal>jar</goal>-->
-<!-- </goals>-->
-<!-- </execution>-->
-<!-- </executions>-->
-<!-- <configuration>-->
-<!-- <additionalJOptions>-->
-<!--
<additionalJOption>-Xdoclint:none</additionalJOption>-->
-<!-- </additionalJOptions>-->
-<!-- </configuration>-->
-<!-- </plugin>-->
-<!-- <plugin>-->
-<!-- <groupId>org.apache.maven.plugins</groupId>-->
-<!-- <artifactId>maven-gpg-plugin</artifactId>-->
-<!-- <version>1.5</version>-->
-<!-- <executions>-->
-<!-- <execution>-->
-<!-- <id>sign-artifacts</id>-->
-<!-- <phase>verify</phase>-->
-<!-- <goals>-->
-<!-- <goal>sign</goal>-->
-<!-- </goals>-->
-<!-- </execution>-->
-<!-- </executions>-->
-<!-- <configuration>-->
-<!-- <!– Prevent `gpg` from using pinentry
programs –>-->
-<!-- <gpgArguments>-->
-<!-- <arg>--pinentry-mode</arg>-->
-<!-- <arg>loopback</arg>-->
-<!-- </gpgArguments>-->
-<!-- </configuration>-->
-<!-- </plugin>-->
-<!-- </plugins>-->
-<!-- </build>-->
-<!-- </profile>-->
-<!-- </profiles>-->
+ <!--TODO: enhance it later to avoid conflicts now -->
+ <!-- <dependency>-->
+ <!-- <groupId>commons-io</groupId>-->
+ <!-- <artifactId>commons-io</artifactId>-->
+ <!-- <version>2.7</version>-->
+ <!-- </dependency>-->
+ <!-- <dependency>-->
+ <!-- <groupId>org.apache.commons</groupId>-->
+ <!-- <artifactId>commons-lang3</artifactId>-->
+ <!-- <version>3.9</version>-->
+ <!-- </dependency>-->
+ <!-- <dependency>-->
+ <!-- <groupId>com.google.guava</groupId>-->
+ <!-- <artifactId>guava</artifactId>-->
+ <!-- <version>29.0-jre</version>-->
+ <!-- </dependency>-->
+ <!-- <dependency>-->
+ <!-- <groupId>org.apache.commons</groupId>-->
+ <!-- <artifactId>commons-compress</artifactId>-->
+ <!-- <version>1.21</version>-->
+ <!-- </dependency>-->
+ </dependencies>
+ </dependencyManagement>
+
+ <dependencies> <!-- dependencies will be inherited by default here
--></dependencies>
+
+ <profiles>
+ <profile>
+ <id>apache-release</id>
+ <build>
+ <!-- plugins under management won't be executed in root &
won't be inherited
+ by default, just defined for submodules (more flexible)
+ refer:
https://maven.apache.org/pom.html#Plugin_Management -->
+ <!--<pluginManagement></pluginManagement>-->
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-source-plugin</artifactId>
+ <executions>
+ <execution>
+ <id>attach-sources</id>
+ <goals>
+ <goal>jar-no-fork</goal>
+ </goals>
+ </execution>
+ </executions>
+ </plugin>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-javadoc-plugin</artifactId>
+ <executions>
+ <execution>
+ <id>attach-javadocs</id>
+ <goals>
+ <goal>jar</goal>
+ </goals>
+ </execution>
+ </executions>
+ <configuration>
+ <doclint>none</doclint>
+ <failOnError>false</failOnError>
+ </configuration>
+ </plugin>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-gpg-plugin</artifactId>
+ <executions>
+ <execution>
+ <id>sign-artifacts</id>
Review Comment:
Important: This adds a second gpg `sign` execution on top of the
`sign-release-artifacts` execution that `org.apache:apache:23` already defines
in its own `apache-release` profile, so every module is signed twice and the
second pass signs the `.asc` files.
Reproduced with a throwaway key: `mvn deploy -Papache-release -pl
hugegraph-client -DskipTests
-DaltDeploymentRepository=tmp::default::file:///tmp/repo` runs
`maven-gpg-plugin:1.6:sign (sign-release-artifacts)` and then
`(sign-artifacts)`, logs `jar.asc:1.0.0 already attached, replace previous
instance`, and deploys `hugegraph-client-1.0.0.jar.asc.asc`, `pom.asc.asc` and
`sources.jar.asc.asc` next to the normal signatures. `help:effective-pom` shows
both executions.
Drop this gpg plugin block (the parent profile already signs), or reuse the
parent execution id `sign-release-artifacts` if only the pinentry config is
needed.
##########
hugegraph-tools/pom.xml:
##########
@@ -240,32 +228,31 @@
</execution>
</executions>
</plugin>
- <plugin>
- <artifactId>maven-clean-plugin</artifactId>
- <version>3.0.0</version>
- <configuration>
- <filesets>
- <fileset>
- <directory>${project.basedir}</directory>
- <includes>
- <include>*.tar.gz</include>
- <include>${final.name}/**</include>
- </includes>
- <followSymlinks>false</followSymlinks>
- </fileset>
- <fileset>
- <directory>${final.name}</directory>
- </fileset>
- </filesets>
- </configuration>
- </plugin>
+<!-- <plugin>-->
+<!-- <artifactId>maven-clean-plugin</artifactId>-->
+<!-- <configuration>-->
+<!-- <filesets>-->
+<!-- <fileset>-->
+<!-- <directory>${project.basedir}</directory>-->
+<!-- <includes>-->
+<!-- <include>*.tar.gz</include>-->
+<!-- <include>${final.name}/**</include>-->
+<!-- </includes>-->
+<!-- <followSymlinks>false</followSymlinks>-->
+<!-- </fileset>-->
+<!-- <fileset>-->
+<!-- <directory>${final.name}</directory>-->
+<!-- </fileset>-->
+<!-- </filesets>-->
+<!-- </configuration>-->
+<!-- </plugin>-->
</plugins>
</build>
<profiles>
<!-- mvn clean install -Prelease -->
<profile>
- <id>release</id>
+ <id>apache-release</id>
Review Comment:
Minor: Renaming this profile to `apache-release` merges it with the parent
`apache-release` profile, so tools now builds its sources jar and javadoc jar
twice.
`mvn help:effective-pom -Papache-release -pl hugegraph-tools` lists
`maven-source-plugin` executions `attach-sources` (jar-no-fork) and
`create-source-jar` (jar, test-jar), and `maven-javadoc-plugin` executions
`attach-javadocs` and `create-javadoc-jar`. The second one of each re-attaches
the same classifier. The `<!-- mvn clean install -Prelease -->` comment above
is also stale now.
Remove the `create-source-jar` and `create-javadoc-jar` executions (keep
only the test-jar parts if they are needed) and update the comment.
##########
.gitattributes:
##########
@@ -1 +1,15 @@
* text=auto !eol
+
+# ignored file when package to source.tgz
+.gitattributes export-ignore
+.gitignore export-ignore
+.asf.yaml export-ignore
+checkstyle.xml export-ignore
Review Comment:
Important: Excluding `checkstyle.xml` from `git archive` makes the source
release produced by `apache-release.sh` unbuildable, because the root pom binds
`maven-checkstyle-plugin:check` to `validate` with
`<configLocation>checkstyle.xml</configLocation>`.
I extracted `git archive HEAD` (which applies these rules) and ran `mvn -o
validate -pl hugegraph-client` in it: `BUILD FAILURE ... Unable to find
configuration file at location: checkstyle.xml`. The same command in the git
checkout passes. So `mvn package` fails on the first step for anyone building
the voted source tarball.
Keep `checkstyle.xml` in the source package (remove this line), or drop the
checkstyle execution from the default build first.
##########
hugegraph-dist/scripts/apache-release.sh:
##########
@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+GROUP="hugegraph"
+# current repository name
+REPO="${GROUP}-toolchain"
+# release version (input by committer)
+RELEASE_VERSION=$1
+USERNAME=$2
+PASSWORD=$3
+# git release branch (check it carefully)
+GIT_BRANCH="release-${RELEASE_VERSION}"
+
+RELEASE_VERSION=${RELEASE_VERSION:?"Please input the release version behind
script"}
+
+WORK_DIR=$(cd "$(dirname "$0")" || exit; pwd)
+cd "${WORK_DIR}" || exit
+echo "In the work dir: $(pwd)"
+
+# clean old dir then build a new one
+rm -rfv dist && mkdir -p dist/apache-${REPO}
+
+# step1: package the source code
+cd ../../ || exit
+git archive --format=tar.gz \
+
--output="${GROUP}-dist/scripts/dist/apache-${REPO}/apache-${REPO}-incubating-${RELEASE_VERSION}-src.tar.gz"
\
+ --prefix="apache-${REPO}-incubating-${RELEASE_VERSION}-src/" "${GIT_BRANCH}"
|| exit
+
+cd - || exit
+
+# step2: copy the binary file (Optional)
+# Note: it's optional for project to generate binary package (skip this step
if not need)
+cp -v ../../target/apache-${REPO}-incubating-"${RELEASE_VERSION}".tar.gz \
+ dist/apache-${REPO} || exit
+
+# step3: sign + hash
+##### 3.1 sign in source & binary package
+gpg --version 1>/dev/null || exit
+cd ./dist/apache-${REPO} || exit
+for i in *.tar.gz; do
+ echo "$i" && gpg --armor --output "$i".asc --detach-sig "$i"
+done
+
+##### 3.2 Generate SHA512 file
+shasum --version 1>/dev/null || exit
+for i in *.tar.gz; do
+ echo "$i" && shasum -a 512 "$i" >"$i".sha512
+done
+
+#### 3.3 check signature & sha512
+for i in *.tar.gz; do
+ echo "$i"
+ gpg --verify "$i".asc "$i" || exit
+done
+
+for i in *.tar.gz; do
+ echo "$i"
+ shasum -a 512 --check "$i".sha512 || exit
+done
+
+# step4: upload to Apache-SVN
+SVN_DIR="${GROUP}-svn-dev"
+cd ../
+rm -rfv ${SVN_DIR}
+
+##### 4.1 pull from remote & copy files
+svn co "https://dist.apache.org/repos/dist/dev/incubator/${GROUP}"; ${SVN_DIR}
+mkdir -p ${SVN_DIR}/"${RELEASE_VERSION}"
+cp -v apache-${REPO}/*tar.gz* "${SVN_DIR}/${RELEASE_VERSION}"
+cd ${SVN_DIR} || exit
+
+##### 4.2 check status first
+svn status
+svn add --parents "${RELEASE_VERSION}"/apache-${REPO}-*
+# check status again
+svn status
+
+##### 4.3 commit & push files
+if [ "$USERNAME" = "" ]; then
+ svn commit -m "submit files for ${REPO} ${RELEASE_VERSION}"
+else
+ svn commit -m "submit files for ${REPO} ${RELEASE_VERSION}" --username
"${USERNAME}" --password "${PASSWORD}"
Review Comment:
Minor: The ASF password is passed as a positional script argument and then
as `--password` on the `svn` command line.
Running `./apache-release.sh 1.0.0 user secret` leaves `secret` in shell
history and visible to other local users in `ps` while both processes run.
Drop the PASSWORD argument and let `svn commit` prompt or use the cached svn
credentials.
##########
pom.xml:
##########
@@ -38,18 +38,51 @@
<licenses>
<license>
<name>The Apache Software License, Version 2.0</name>
- <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
+ <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
<distribution>repo</distribution>
</license>
</licenses>
- <!-- TODO: we need update the url and all package together -->
+ <developers>
+ <developer>
+ <id>Apache Hugegraph(incubating)</id>
+ <email>[email protected]</email>
+ <url>https://hugegraph.apache.org/</url>
+ </developer>
+ </developers>
+
+ <mailingLists>
+ <mailingList>
+ <name>Developer List</name>
+ <subscribe>[email protected]</subscribe>
+ <unsubscribe>[email protected]</unsubscribe>
+ <post>[email protected]</post>
Review Comment:
Minor: The project metadata mixes address forms. The dev list `post` is
`[email protected]` while every other list uses
`@hugegraph.apache.org`, and the developer `<email>` at line 49 is the
subscribe address, not a contact address.
These values are published in the deployed pom and shown on Maven Central.
Use `[email protected]` for `post` and as the developer email.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
