Jens-G opened a new pull request, #3898: URL: https://github.com/apache/thrift/pull/3898
> **Stacked on [#3895](https://github.com/apache/thrift/pull/3895) (THRIFT-6311) → [#3893](https://github.com/apache/thrift/pull/3893) → [#3894](https://github.com/apache/thrift/pull/3894).** It packages the installer #3895 produces. Review those first; this branch contains them. THRIFT-2208 has been open since 2013. ```shell choco install thrift ``` ## The package downloads, it does not carry The package fetches the Windows installer published with the release and runs it silently for all users. It does **not** embed the compiler. So: - what a user installs is the file that was voted on and signed; - no binary is redistributed through a third-party CDN; - the package stays a few KB. The URL is `archive.apache.org`, for the same reason as the WinGet manifest: `downloads.apache.org` only carries the *current* release, so a package naming it stops installing at the next one — and Chocolatey keeps old versions installable. The checksum is computed from the file at that exact URL, so the package cannot record a checksum the published file does not have. That makes it a post-release step: it cannot be built until the archive has the release. The workflow runs when the release is published and can be re-run from the Actions tab. ## Nothing is pushed yet — on purpose **The `thrift` id is taken.** It belongs to a third-party package, not an ASF one: | | | |---|---| | latest version | **0.12.0**, published February 2019 — thirteen releases behind | | maintainers | `chaliy`, `Lite` | | source | <https://github.com/Litee/chocolatey-packages> | (Its "last updated" field on chocolatey.org moves with Chocolatey's automated re-verification, not with any maintainer action — it looks recent and is not.) Per our discussion the plan is to **request a maintainer takeover** under Chocolatey's process for abandoned packages, so that `choco install thrift` keeps meaning what people expect. So this PR builds and tests the package but pushes nothing: the push step needs a `CHOCO_API_KEY` secret that does not exist, and when it is absent the workflow attaches the package to the run and says in its summary that it did not push. `doc/ReleaseManagement.md` documents the takeover steps. If the takeover is refused, `apache-thrift` and `thrift-compiler` are both free — I verified there is exactly one package matching "thrift" on the whole community feed. Switching is an id change in `thrift.nuspec.in` plus the package file name. ## Testing `chocolatey/test-chocolatey-package.ps1`, 19 checks: the URL, checksum and silent-install arguments reach the install script; no placeholder survives into a file that would be published verbatim; the nuspec parses and carries the right id, version and licence; `LICENSE` and `NOTICE` are staged and non-empty; a malformed version or checksum is refused. Given `-Package`, it also looks inside the packed `.nupkg` — including asserting it carries **no executable**, since a package that did would be shipping an unsigned copy of the compiler. It runs anywhere PowerShell does (`-StageOnly` skips the `choco pack` step), so I developed and ran it on Linux; CI runs it on Windows both before and after packing. It already earned its keep — it caught an over-broad assertion of mine that matched an explanatory comment rather than the URL value. ## Notes - `/ALLUSERS` and `/TASKS="modifypath"` are what make Chocolatey's machine-wide install put `thrift.exe` on the system `PATH`; both are asserted. - `zizmor` is clean on the new workflow. JIRA: [THRIFT-2208](https://issues.apache.org/jira/browse/THRIFT-2208) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
