Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Christopher]

+1

* Verified SVN staging area (dist/dev/accumulo/1.9.0-rc1) tarballs match
Nexus staging area (artifacts and GPG sigs) and SHA512s there are correct.
* Ran mvn verify -DskipTests with both Hadoop 2 and Hadoop 3
* Ran all ITs successfully with Hadoop 2
* GPG signatures match release tarball artifacts (and other Maven artifacts)
* Maven repo is consistent (all md5, sha1 sigs match their Maven artifacts)
* All jars have corresponding javadoc and source jars.
* Contents of binary tarball lib directory match Maven jars
* Source tarball matches git commit
* Jar manifest indicates build from correct git commit
* Jars are sealed
* Using 1.9.0 jars, successfully built Apache Fluo (with ITs)|
* Also attempted to build Hive... which works, but some Accumulo tests fail
because of the use of "." in iterator names, which is broken, and
explicitly checked for as of ACCUMULO-3389
* Also attempted to build geowave, but that failed because geowave appears
to extensively make use of non-public API from Accumulo, so I gave up.

I checked the LICENSE and NOTICE files also, and they look good, except for
the fact that they still say 2017, instead of 2018. I can't believe I
forgot to check this a second time, after this same thing happened for
1.7.4. In any case, I don't think it's worth holding up the release, given
that there do not seem to be any other serious issues with the artifacts.


On Wed, Apr 18, 2018 at 11:07 AM Keith Turner  wrote:

> +1
>
>  * Successfully built Fluo against RC
>  * Ran continuous ingest for 24hrs on 9 node cluster using RC.
> Verified successfully.  Table had 32.3 billion entries after test.
>
>
>
> On Thu, Apr 12, 2018 at 6:21 PM, Christopher  wrote:
> > Accumulo Developers,
> >
> > Please consider the following candidate for Apache Accumulo 1.9.0.
> >
> > Git Commit:
> > bca516000bdb54b1e5582f908e0a525634a120f7
> > Branch:
> > 1.9.0-rc1
> >
> > If this vote passes, a gpg-signed tag will be created using:
> > git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > bca516000bdb54b1e5582f908e0a525634a120f7
> >
> > Staging repo:
> >
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> > Source (official release artifact):
> >
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> > Binary:
> >
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> > (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> > given artifact.)
> >
> > All artifacts were built and staged with:
> > mvn release:prepare && mvn release:perform
> >
> > Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
> > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> >
> > Release notes (in progress) can be found at:
> > https://accumulo.apache.org/release/accumulo-1.9.0/
> >
> > Please vote one of:
> > [ ] +1 - I have verified and accept...
> > [ ] +0 - I have reservations, but not strong enough to vote against...
> > [ ] -1 - Because..., I do not accept...
> > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> >
> > This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > Voting continues until the release manager sends an email closing the
> vote.
> >
> > Thanks!
> >
> > P.S. Hint: download the whole staging repo with
> > wget -erobots=off -r -l inf -np -nH \
> >
> >
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
> > # note the trailing slash is needed
>

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Mike Miller]

+1
Ran randomwalk "All.xml" tests across 7 walkers and 1 leader EC2 cluster
for almost 48 hours.  No problems seen other than a false positive with the
test that is fixed in PR #429 

On Wed, Apr 18, 2018 at 11:07 AM, Keith Turner  wrote:

> +1
>
>  * Successfully built Fluo against RC
>  * Ran continuous ingest for 24hrs on 9 node cluster using RC.
> Verified successfully.  Table had 32.3 billion entries after test.
>
>
>
> On Thu, Apr 12, 2018 at 6:21 PM, Christopher  wrote:
> > Accumulo Developers,
> >
> > Please consider the following candidate for Apache Accumulo 1.9.0.
> >
> > Git Commit:
> > bca516000bdb54b1e5582f908e0a525634a120f7
> > Branch:
> > 1.9.0-rc1
> >
> > If this vote passes, a gpg-signed tag will be created using:
> > git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > bca516000bdb54b1e5582f908e0a525634a120f7
> >
> > Staging repo:
> > https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070
> > Source (official release artifact):
> > https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.
> 0/accumulo-1.9.0-src.tar.gz
> > Binary:
> > https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.
> 0/accumulo-1.9.0-bin.tar.gz
> > (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> > given artifact.)
> >
> > All artifacts were built and staged with:
> > mvn release:prepare && mvn release:perform
> >
> > Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
> > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> >
> > Release notes (in progress) can be found at:
> > https://accumulo.apache.org/release/accumulo-1.9.0/
> >
> > Please vote one of:
> > [ ] +1 - I have verified and accept...
> > [ ] +0 - I have reservations, but not strong enough to vote against...
> > [ ] -1 - Because..., I do not accept...
> > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> >
> > This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > Voting continues until the release manager sends an email closing the
> vote.
> >
> > Thanks!
> >
> > P.S. Hint: download the whole staging repo with
> > wget -erobots=off -r -l inf -np -nH \
> >
> > https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070/
> > # note the trailing slash is needed
>

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Keith Turner]

+1

 * Successfully built Fluo against RC
 * Ran continuous ingest for 24hrs on 9 node cluster using RC.
Verified successfully.  Table had 32.3 billion entries after test.



On Thu, Apr 12, 2018 at 6:21 PM, Christopher  wrote:
> Accumulo Developers,
>
> Please consider the following candidate for Apache Accumulo 1.9.0.
>
> Git Commit:
> bca516000bdb54b1e5582f908e0a525634a120f7
> Branch:
> 1.9.0-rc1
>
> If this vote passes, a gpg-signed tag will be created using:
> git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> bca516000bdb54b1e5582f908e0a525634a120f7
>
> Staging repo:
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> Source (official release artifact):
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> Binary:
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> given artifact.)
>
> All artifacts were built and staged with:
> mvn release:prepare && mvn release:perform
>
> Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
> (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
>
> Release notes (in progress) can be found at:
> https://accumulo.apache.org/release/accumulo-1.9.0/
>
> Please vote one of:
> [ ] +1 - I have verified and accept...
> [ ] +0 - I have reservations, but not strong enough to vote against...
> [ ] -1 - Because..., I do not accept...
> ... these artifacts as the 1.9.0 release of Apache Accumulo.
>
> This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> Voting continues until the release manager sends an email closing the vote.
>
> Thanks!
>
> P.S. Hint: download the whole staging repo with
> wget -erobots=off -r -l inf -np -nH \
>
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
> # note the trailing slash is needed

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Keith Turner]

I started continuous ingest running on a 9 node EC2 cluster this
morning.  I plan to let ingest run for ~24hrs and then run verify.
I will not know the results of this for ~2 days.

On Thu, Apr 12, 2018 at 6:21 PM, Christopher  wrote:
> Accumulo Developers,
>
> Please consider the following candidate for Apache Accumulo 1.9.0.
>
> Git Commit:
> bca516000bdb54b1e5582f908e0a525634a120f7
> Branch:
> 1.9.0-rc1
>
> If this vote passes, a gpg-signed tag will be created using:
> git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> bca516000bdb54b1e5582f908e0a525634a120f7
>
> Staging repo:
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> Source (official release artifact):
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> Binary:
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> given artifact.)
>
> All artifacts were built and staged with:
> mvn release:prepare && mvn release:perform
>
> Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
> (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
>
> Release notes (in progress) can be found at:
> https://accumulo.apache.org/release/accumulo-1.9.0/
>
> Please vote one of:
> [ ] +1 - I have verified and accept...
> [ ] +0 - I have reservations, but not strong enough to vote against...
> [ ] -1 - Because..., I do not accept...
> ... these artifacts as the 1.9.0 release of Apache Accumulo.
>
> This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> Voting continues until the release manager sends an email closing the vote.
>
> Thanks!
>
> P.S. Hint: download the whole staging repo with
> wget -erobots=off -r -l inf -np -nH \
>
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
> # note the trailing slash is needed

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Christopher]

On Sun, Apr 15, 2018 at 9:30 PM Sean Busbey  wrote:

>
>
> On 2018/04/16 01:26:54, Sean Busbey  wrote:
> >
> >
> > On 2018/04/15 21:39:04, Christopher  wrote:
> > > On Sun, Apr 15, 2018 at 10:11 AM Sean Busbey 
> wrote:
> > >
> > >
> > > > However, I can't verify that the source artifact or any other
> artifacts
> > > > that we'll eventually place in dist.a.o/release has correct
> checksums that
> > > > meet the current release distribution policy simply because we don't
> have
> > > > the relevant bits posted here in the RC.
> > > >
> > > >
> > > You can't verify the contents of what will eventually be there
> anyway...
> > > anybody could copy things incorrectly. But, they *should* be what was
> in
> > > the staging directory... so you can always do a byte-for-byte
> comparison to
> > > the staging repo (which gets promoted to Maven Central) and verify the
> > > checksum matches that.
> > >
> >
> > Those are very different levels of effort. In one case I can see if the
> thing folks voted on is the thing that's hosted (or at least the thing I
> end up with when I download the thing that's hosted).  the checksums are
> supposed to serve this purpose.
> >
>
>
Right now, there is nothing established in policy or official guidelines
that directly serves this provenance purpose. (See [3] for a relevant
discussion on legal-discuss@.) Something that I think gets close might be
in [1] where voters are able to provide additional signatures for a release
candidate.

Also, let's be careful not to confuse the "Release Policy"[1] (which
governs releasing, voting, and sigs, but does not mention checksums) with
the "Release Distribution Policy"[2] (which governs the distribution
channels provided by Infra, and has the additional requirement for
checksums, but is separate from voting). There is nothing in the "Release
Policy" which suggests that checksums are supposed to serve any purpose...
they aren't even mentioned in the policy which pertains to voting, and the
policy which pertains to the distribution channels neither mentions voting
nor any purpose for the checksums. So no, the checksums are *not* supposed
to serve this purpose.

Regardless, for this release candidate, I've already provided SHA512
checksums in the dist/dev area. Feel free to update your vote accordingly.
Thanks.

In future, rather than maintain parallel staging areas, as I've done for
this release, I think it would be best to tweak the generated email to
simply include the hashes that will be published to the SVN dist/release
area directly in the vote thread (suggested in [3]). Personally, I'd prefer
to include the GPG signatures rather than any checksums, because I think
they are more relevant and useful for vote provenance (and I don't see a
problem with not pre-computing the SHA512 checksum). However, clearly
there's interest in providing pre-computed checksums, so I'd settle for
providing the SHA512 instead... anything to help us avoid two staging areas.

[1]: https://www.apache.org/legal/release-policy.html
[2]: https://www.apache.org/dev/release-distribution.html
[3]:
https://lists.apache.org/thread.html/bb7281ed8da0ceaa5f0f18e3edc6c3f728c74d7ed8c4df12729b6f40@%3Clegal-discuss.apache.org%3E

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Sean Busbey]

On 2018/04/16 01:26:54, Sean Busbey  wrote: 
> 
> 
> On 2018/04/15 21:39:04, Christopher  wrote: 
> > On Sun, Apr 15, 2018 at 10:11 AM Sean Busbey  wrote:
> >  
> > 
> > > However, I can't verify that the source artifact or any other artifacts
> > > that we'll eventually place in dist.a.o/release has correct checksums that
> > > meet the current release distribution policy simply because we don't have
> > > the relevant bits posted here in the RC.
> > >
> > >
> > You can't verify the contents of what will eventually be there anyway...
> > anybody could copy things incorrectly. But, they *should* be what was in
> > the staging directory... so you can always do a byte-for-byte comparison to
> > the staging repo (which gets promoted to Maven Central) and verify the
> > checksum matches that.
> > 
> 
> Those are very different levels of effort. In one case I can see if the thing 
> folks voted on is the thing that's hosted (or at least the thing I end up 
> with when I download the thing that's hosted).  the checksums are supposed to 
> serve this purpose.
> 


Jeez. I am doing terrible for proofreading this weekend. This was supposed to 
say "in either case I can see..."

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Sean Busbey]

Does "strongly against" in this case mean "-1" or still "-0" ?

On 2018/04/15 17:24:33, Mike Drob  wrote: 
> I am strongly against generating and publishing checksum information after
> a vote because that ostensibly means it hasn't been verified and voted on.
> 
> On Sun, Apr 15, 2018 at 12:35 AM, Christopher  wrote:
> 
> > Mike,
> >
> > We use stronger checksums (SHA512) in the SVN[1] area and downloads page[2]
> > after a vote passes. In fact, we're one of the only "perfect projects" in
> > regards to compliance with this policy[3].
> >
> > The Maven staging area doesn't follow all the "SHOULD" statements, but
> > that's only because these checksums are automatically generated by
> > maven-deploy-plugin, and not under our direct control. However, it still
> > follows all the "MUST" statements, so it is still in compliance with the
> > cited policy. Unless we're willing to circumvent standard Maven tooling and
> > risk breaking things which depend on the conventions established by this
> > tooling (which, to be clear, I think would be a really terribly bad idea),
> > we simply cannot follow all the "SHOULD" statements for the Maven staging
> > area.
> >
> > [1]: https://www.apache.org/dist/accumulo/
> > [2]: https://accumulo.apache.org/downloads/
> > [3]: https://checker.apache.org/dist/unsummed.html
> >
> > On Sat, Apr 14, 2018 at 11:13 PM Mike Drob  wrote:
> >
> > > -0
> > >
> > > please do not publish md5 sums
> > > please add missing sha256 sums
> > >
> > > apache release policy:
> > > http://www.apache.org/dev/release-distribution#sigs-and-sums
> > >
> > > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch  wrote:
> > >
> > > > +1
> > > >
> > > > * Verified sha1 & md5 hashes matched
> > > > * Verified signatures
> > > > * Ran binary tarball locally using Uno
> > > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > > >
> > > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher 
> > > wrote:
> > > >
> > > > > Accumulo Developers,
> > > > >
> > > > > Please consider the following candidate for Apache Accumulo 1.9.0.
> > > > >
> > > > > Git Commit:
> > > > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > Branch:
> > > > > 1.9.0-rc1
> > > > >
> > > > > If this vote passes, a gpg-signed tag will be created using:
> > > > > git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > > >
> > > > > Staging repo:
> > > > >
> > > >
> > > https://repository.apache.org/content/repositories/
> > orgapacheaccumulo-1070
> > > > > Source (official release artifact):
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/
> > accumulo-1.9.0-src.tar.gz
> > > > > Binary:
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/
> > accumulo-1.9.0-bin.tar.gz
> > > > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash
> > for a
> > > > > given artifact.)
> > > > >
> > > > > All artifacts were built and staged with:
> > > > > mvn release:prepare && mvn release:perform
> > > > >
> > > > > Signing keys are available at
> > > https://www.apache.org/dist/accumulo/KEYS
> > > > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > > > >
> > > > > Release notes (in progress) can be found at:
> > > > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > > > >
> > > > > Please vote one of:
> > > > > [ ] +1 - I have verified and accept...
> > > > > [ ] +0 - I have reservations, but not strong enough to vote
> > against...
> > > > > [ ] -1 - Because..., I do not accept...
> > > > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > > > >
> > > > > This vote will remain open until at least Sun Apr 15 22:30:00 UTC
> > 2018
> > > > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > > > Voting continues until the release manager sends an email closing the
> > > > vote.
> > > > >
> > > > > Thanks!
> > > > >
> > > > > P.S. Hint: download the whole staging repo with
> > > > > wget -erobots=off -r -l inf -np -nH \
> > > > >
> > > > >
> > > >
> > > https://repository.apache.org/content/repositories/
> > orgapacheaccumulo-1070/
> > > > > # note the trailing slash is needed
> > > > >
> > > >
> > >
> >
> 

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Sean Busbey]

On 2018/04/15 21:39:04, Christopher  wrote: 
> On Sun, Apr 15, 2018 at 10:11 AM Sean Busbey  wrote:
> 
> > -1 on the RC vote
> >
> > I agree that in the staged maven repository we should stick to SHOULD
> > guidance until such time that the maven tooling has a supported option to
> > use correct checksums. (Have we verified that the relevant tooling at a
> > minimum has a request in to add it?)
> >
> >
> https://issues.apache.org/jira/browse/MNGSITE-328, and related issues track
> this.
> 

Reading more on this it seems like there's also a problem on the Nexus side 
with hosting SHA256 / SHA512 checksums, so we're probably in for a long wait on 
that bit.


> 
> > However, I can't verify that the source artifact or any other artifacts
> > that we'll eventually place in dist.a.o/release has correct checksums that
> > meet the current release distribution policy simply because we don't have
> > the relevant bits posted here in the RC.
> >
> >
> You can't verify the contents of what will eventually be there anyway...
> anybody could copy things incorrectly. But, they *should* be what was in
> the staging directory... so you can always do a byte-for-byte comparison to
> the staging repo (which gets promoted to Maven Central) and verify the
> checksum matches that.
> 

Those are very different levels of effort. In one case I can see if the thing 
folks voted on is the thing that's hosted (or at least the thing I end up with 
when I download the thing that's hosted).  the checksums are supposed to serve 
this purpose.

> 
> > Why don't we go back to providing both a staged maven repo and an RC
> > directory in the ASF dev part of dist.a.o[4]? Plenty of other projects use
> > that area to stage RCs that have correct checksums.
> >
> >
> "go back to" doesn't make sense here. To my knowledge, we've never done
> this. While using this SVN dev area is somewhat common now, before we
> started staging in Nexus consistently, the SVN dev area on dist was not
> standard, and people staged tarballs in people.apache.org and elsewhere.
> When a release vote passed, people would do a `mvn deploy` from the
> unpacked source tarball or from the SVN tag (meaning the jars in the binary
> tarball did not match what was in Maven Central, and possibly from a
> slightly different source with no way to verify). Staging in Nexus solved
> all of that. Furthermore, two staging areas causes additional concerns
> (which one is canonical? What if some people only test one, but not the
> other? What if SVN contents change because unlike a closed Nexus staging
> repository, SVN directory contents are not immutable?).
> 

I guess I misremembered us using the SVN dev area. In any case I'm not 
concerned with where we host the RC bits so long as I can vote on all the 
things that will eventually go in to dist.a.o's release area. Otherwise what 
good does checking that the checksums are correct do?

All the rest of these concerns are implementation details. If you post one 
thing and say "this is the part that will go into the release area of dist.a.o" 
then _that_ one is the canonical one by definition. So long as folks say which 
one(s) of the staging areas they verified and we have coverage over both, then 
it hardly matters if some folks might not be checking all of them. SVN 
mutability has plenty of solutions, if we're really hung up on it.


> I've thought about modifying our build.sh script to stage stuff in SVN to
> help reduce human error... but it doesn't entirely address all those
> concerns about two staging areas. Additionally, that's a new step being
> added to the release process... and discussions about changing our release
> process to do additional things like that fall outside the scope of this
> release vote. We're voting on the release artifacts here, not voting on
> revamping the release process. Let's not hold up a release because of wish
> list items for the release process.
> 

Again, to be clear, I don't care what the particulars of the release process 
are so long as they allow me to vote on the thing that ASF release policy says 
I'm supposed to vote on. Release votes are majority in any case. I'm pretty 
sure even if I vote -1 on every release for the rest of my life on this basis 
the rest of the PMC could ignore my concern if y'all wanted to.


> Since it seems to be a problem for folks this time around... I've manually
> staged the artifacts in:
> https://dist.apache.org/repos/dist/dev/accumulo/1.9.0-rc1
> 

If you started a new VOTE thread that included these artifacts as those that 
would go into dist.a.o's release area, then I would evaluate the candidates 
without the need to -1 because I couldn't check the things we're planning to 
publish.

As is, I think changing the contents of the RC mid-vote is ill advised mostly 
because it's confusing (e.g. how do we know folks who already voted are still 
on board if they don't respond?). We have several folks who already 

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Sean Busbey]

I don't have strong feelings about how we implement hosting the RC, but I do 
want the RC to contain the actual checksum that we're going to use when we 
publish on dist.a.o in the release.

Otherwise we're not verifying that said checksum is correct for the artifact 
we're voting on, which is part of the point of us having a release vote.

Publishing via the dev part of dist.a.o is one way to do that. If the community 
prefers some other way, that's fine by me as well.



On 2018/04/15 16:23:02, Mike Walch  wrote: 
> I am trying to understand what you are looking for with your -1.
> 
> It sounds like you want following files created in
> https://dist.apache.org/repos/dist/dev/accumulo/1.9.0 for each release
> candidate:
> 
> accumulo-1.9.0-bin.tar.gz
> accumulo-1.9.0-bin.tar.gz.asc
> accumulo-1.9.0-bin.tar.gz.sha512
> accumulo-1.9.0-src.tar.gz
> accumulo-1.9.0-src.tar.gz.asc
> accumulo-1.9.0-src.tar.gz.sha512
> 
> This will require the release manager to copy the tarballs and asc files
> from the maven repo to SVN dev directory and create the sha512 files for
> each candidate, correct?
> 
> If this is going to be a new requirement for releases, it should be
> documented with step by step instructions at https://accumulo.apache.org/
> contributor/making-release
> 
> On Sun, Apr 15, 2018 at 10:12 AM, Sean Busbey  wrote:
> 
> > sorry, that should have been "staged maven repository should stick to MUST
> > guidance"
> >
> >
> >
> > On 2018/04/15 14:11:43, Sean Busbey  wrote:
> > > -1 on the RC vote
> > >
> > > I agree that in the staged maven repository we should stick to SHOULD
> > guidance until such time that the maven tooling has a supported option to
> > use correct checksums. (Have we verified that the relevant tooling at a
> > minimum has a request in to add it?)
> > >
> > > However, I can't verify that the source artifact or any other artifacts
> > that we'll eventually place in dist.a.o/release has correct checksums that
> > meet the current release distribution policy simply because we don't have
> > the relevant bits posted here in the RC.
> > >
> > > Why don't we go back to providing both a staged maven repo and an RC
> > directory in the ASF dev part of dist.a.o[4]? Plenty of other projects use
> > that area to stage RCs that have correct checksums.
> > >
> > > [4]: https://dist.apache.org/repos/dist/dev/accumulo/
> > >
> > > On 2018/04/15 05:35:39, Christopher  wrote:
> > > > Mike,
> > > >
> > > > We use stronger checksums (SHA512) in the SVN[1] area and downloads
> > page[2]
> > > > after a vote passes. In fact, we're one of the only "perfect projects"
> > in
> > > > regards to compliance with this policy[3].
> > > >
> > > > The Maven staging area doesn't follow all the "SHOULD" statements, but
> > > > that's only because these checksums are automatically generated by
> > > > maven-deploy-plugin, and not under our direct control. However, it
> > still
> > > > follows all the "MUST" statements, so it is still in compliance with
> > the
> > > > cited policy. Unless we're willing to circumvent standard Maven
> > tooling and
> > > > risk breaking things which depend on the conventions established by
> > this
> > > > tooling (which, to be clear, I think would be a really terribly bad
> > idea),
> > > > we simply cannot follow all the "SHOULD" statements for the Maven
> > staging
> > > > area.
> > > >
> > > > [1]: https://www.apache.org/dist/accumulo/
> > > > [2]: https://accumulo.apache.org/downloads/
> > > > [3]: https://checker.apache.org/dist/unsummed.html
> > > >
> > > > On Sat, Apr 14, 2018 at 11:13 PM Mike Drob  wrote:
> > > >
> > > > > -0
> > > > >
> > > > > please do not publish md5 sums
> > > > > please add missing sha256 sums
> > > > >
> > > > > apache release policy:
> > > > > http://www.apache.org/dev/release-distribution#sigs-and-sums
> > > > >
> > > > > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch 
> > wrote:
> > > > >
> > > > > > +1
> > > > > >
> > > > > > * Verified sha1 & md5 hashes matched
> > > > > > * Verified signatures
> > > > > > * Ran binary tarball locally using Uno
> > > > > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > > > > >
> > > > > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher 
> > > > > wrote:
> > > > > >
> > > > > > > Accumulo Developers,
> > > > > > >
> > > > > > > Please consider the following candidate for Apache Accumulo
> > 1.9.0.
> > > > > > >
> > > > > > > Git Commit:
> > > > > > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > > > Branch:
> > > > > > > 1.9.0-rc1
> > > > > > >
> > > > > > > If this vote passes, a gpg-signed tag will be created using:
> > > > > > > git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > > > > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > > >
> > > > > > > Staging repo:
> > > > > > >
> > > > > >
> > > > > 

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Christopher]

On Sun, Apr 15, 2018 at 10:11 AM Sean Busbey  wrote:

> -1 on the RC vote
>
> I agree that in the staged maven repository we should stick to SHOULD
> guidance until such time that the maven tooling has a supported option to
> use correct checksums. (Have we verified that the relevant tooling at a
> minimum has a request in to add it?)
>
>
https://issues.apache.org/jira/browse/MNGSITE-328, and related issues track
this.


> However, I can't verify that the source artifact or any other artifacts
> that we'll eventually place in dist.a.o/release has correct checksums that
> meet the current release distribution policy simply because we don't have
> the relevant bits posted here in the RC.
>
>
You can't verify the contents of what will eventually be there anyway...
anybody could copy things incorrectly. But, they *should* be what was in
the staging directory... so you can always do a byte-for-byte comparison to
the staging repo (which gets promoted to Maven Central) and verify the
checksum matches that.


> Why don't we go back to providing both a staged maven repo and an RC
> directory in the ASF dev part of dist.a.o[4]? Plenty of other projects use
> that area to stage RCs that have correct checksums.
>
>
"go back to" doesn't make sense here. To my knowledge, we've never done
this. While using this SVN dev area is somewhat common now, before we
started staging in Nexus consistently, the SVN dev area on dist was not
standard, and people staged tarballs in people.apache.org and elsewhere.
When a release vote passed, people would do a `mvn deploy` from the
unpacked source tarball or from the SVN tag (meaning the jars in the binary
tarball did not match what was in Maven Central, and possibly from a
slightly different source with no way to verify). Staging in Nexus solved
all of that. Furthermore, two staging areas causes additional concerns
(which one is canonical? What if some people only test one, but not the
other? What if SVN contents change because unlike a closed Nexus staging
repository, SVN directory contents are not immutable?).

I've thought about modifying our build.sh script to stage stuff in SVN to
help reduce human error... but it doesn't entirely address all those
concerns about two staging areas. Additionally, that's a new step being
added to the release process... and discussions about changing our release
process to do additional things like that fall outside the scope of this
release vote. We're voting on the release artifacts here, not voting on
revamping the release process. Let's not hold up a release because of wish
list items for the release process.

Since it seems to be a problem for folks this time around... I've manually
staged the artifacts in:
https://dist.apache.org/repos/dist/dev/accumulo/1.9.0-rc1

Does that change anybody's vote?



> [4]: https://dist.apache.org/repos/dist/dev/accumulo/
>
> On 2018/04/15 05:35:39, Christopher  wrote:
> > Mike,
> >
> > We use stronger checksums (SHA512) in the SVN[1] area and downloads
> page[2]
> > after a vote passes. In fact, we're one of the only "perfect projects" in
> > regards to compliance with this policy[3].
> >
> > The Maven staging area doesn't follow all the "SHOULD" statements, but
> > that's only because these checksums are automatically generated by
> > maven-deploy-plugin, and not under our direct control. However, it still
> > follows all the "MUST" statements, so it is still in compliance with the
> > cited policy. Unless we're willing to circumvent standard Maven tooling
> and
> > risk breaking things which depend on the conventions established by this
> > tooling (which, to be clear, I think would be a really terribly bad
> idea),
> > we simply cannot follow all the "SHOULD" statements for the Maven staging
> > area.
> >
> > [1]: https://www.apache.org/dist/accumulo/
> > [2]: https://accumulo.apache.org/downloads/
> > [3]: https://checker.apache.org/dist/unsummed.html
> >
> > On Sat, Apr 14, 2018 at 11:13 PM Mike Drob  wrote:
> >
> > > -0
> > >
> > > please do not publish md5 sums
> > > please add missing sha256 sums
> > >
> > > apache release policy:
> > > http://www.apache.org/dev/release-distribution#sigs-and-sums
> > >
> > > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch 
> wrote:
> > >
> > > > +1
> > > >
> > > > * Verified sha1 & md5 hashes matched
> > > > * Verified signatures
> > > > * Ran binary tarball locally using Uno
> > > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > > >
> > > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher 
> > > wrote:
> > > >
> > > > > Accumulo Developers,
> > > > >
> > > > > Please consider the following candidate for Apache Accumulo 1.9.0.
> > > > >
> > > > > Git Commit:
> > > > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > Branch:
> > > > > 1.9.0-rc1
> > > > >
> > > > > If this vote passes, a gpg-signed tag will be created using:
> > > > > git tag -f -m 

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[J. Mark Owens]

+1

* verified hashes and signature
* build passed mvn clean verify -Psunny
* build passed all unit testing
* ran an accumulo instance using Uno
* verified basic functionality via the accumulo shell command

On Sun, Apr 15, 2018 at 1:24 PM, Mike Drob  wrote:

> I am strongly against generating and publishing checksum information after
> a vote because that ostensibly means it hasn't been verified and voted on.
>
> On Sun, Apr 15, 2018 at 12:35 AM, Christopher  wrote:
>
> > Mike,
> >
> > We use stronger checksums (SHA512) in the SVN[1] area and downloads
> page[2]
> > after a vote passes. In fact, we're one of the only "perfect projects" in
> > regards to compliance with this policy[3].
> >
> > The Maven staging area doesn't follow all the "SHOULD" statements, but
> > that's only because these checksums are automatically generated by
> > maven-deploy-plugin, and not under our direct control. However, it still
> > follows all the "MUST" statements, so it is still in compliance with the
> > cited policy. Unless we're willing to circumvent standard Maven tooling
> and
> > risk breaking things which depend on the conventions established by this
> > tooling (which, to be clear, I think would be a really terribly bad
> idea),
> > we simply cannot follow all the "SHOULD" statements for the Maven staging
> > area.
> >
> > [1]: https://www.apache.org/dist/accumulo/
> > [2]: https://accumulo.apache.org/downloads/
> > [3]: https://checker.apache.org/dist/unsummed.html
> >
> > On Sat, Apr 14, 2018 at 11:13 PM Mike Drob  wrote:
> >
> > > -0
> > >
> > > please do not publish md5 sums
> > > please add missing sha256 sums
> > >
> > > apache release policy:
> > > http://www.apache.org/dev/release-distribution#sigs-and-sums
> > >
> > > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch 
> wrote:
> > >
> > > > +1
> > > >
> > > > * Verified sha1 & md5 hashes matched
> > > > * Verified signatures
> > > > * Ran binary tarball locally using Uno
> > > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > > >
> > > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher 
> > > wrote:
> > > >
> > > > > Accumulo Developers,
> > > > >
> > > > > Please consider the following candidate for Apache Accumulo 1.9.0.
> > > > >
> > > > > Git Commit:
> > > > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > Branch:
> > > > > 1.9.0-rc1
> > > > >
> > > > > If this vote passes, a gpg-signed tag will be created using:
> > > > > git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > > >
> > > > > Staging repo:
> > > > >
> > > >
> > > https://repository.apache.org/content/repositories/
> > orgapacheaccumulo-1070
> > > > > Source (official release artifact):
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/
> > accumulo-1.9.0-src.tar.gz
> > > > > Binary:
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/
> > accumulo-1.9.0-bin.tar.gz
> > > > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash
> > for a
> > > > > given artifact.)
> > > > >
> > > > > All artifacts were built and staged with:
> > > > > mvn release:prepare && mvn release:perform
> > > > >
> > > > > Signing keys are available at
> > > https://www.apache.org/dist/accumulo/KEYS
> > > > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > > > >
> > > > > Release notes (in progress) can be found at:
> > > > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > > > >
> > > > > Please vote one of:
> > > > > [ ] +1 - I have verified and accept...
> > > > > [ ] +0 - I have reservations, but not strong enough to vote
> > against...
> > > > > [ ] -1 - Because..., I do not accept...
> > > > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > > > >
> > > > > This vote will remain open until at least Sun Apr 15 22:30:00 UTC
> > 2018
> > > > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > > > Voting continues until the release manager sends an email closing
> the
> > > > vote.
> > > > >
> > > > > Thanks!
> > > > >
> > > > > P.S. Hint: download the whole staging repo with
> > > > > wget -erobots=off -r -l inf -np -nH \
> > > > >
> > > > >
> > > >
> > > https://repository.apache.org/content/repositories/
> > orgapacheaccumulo-1070/
> > > > > # note the trailing slash is needed
> > > > >
> > > >
> > >
> >
>

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Mike Drob]

I am strongly against generating and publishing checksum information after
a vote because that ostensibly means it hasn't been verified and voted on.

On Sun, Apr 15, 2018 at 12:35 AM, Christopher  wrote:

> Mike,
>
> We use stronger checksums (SHA512) in the SVN[1] area and downloads page[2]
> after a vote passes. In fact, we're one of the only "perfect projects" in
> regards to compliance with this policy[3].
>
> The Maven staging area doesn't follow all the "SHOULD" statements, but
> that's only because these checksums are automatically generated by
> maven-deploy-plugin, and not under our direct control. However, it still
> follows all the "MUST" statements, so it is still in compliance with the
> cited policy. Unless we're willing to circumvent standard Maven tooling and
> risk breaking things which depend on the conventions established by this
> tooling (which, to be clear, I think would be a really terribly bad idea),
> we simply cannot follow all the "SHOULD" statements for the Maven staging
> area.
>
> [1]: https://www.apache.org/dist/accumulo/
> [2]: https://accumulo.apache.org/downloads/
> [3]: https://checker.apache.org/dist/unsummed.html
>
> On Sat, Apr 14, 2018 at 11:13 PM Mike Drob  wrote:
>
> > -0
> >
> > please do not publish md5 sums
> > please add missing sha256 sums
> >
> > apache release policy:
> > http://www.apache.org/dev/release-distribution#sigs-and-sums
> >
> > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch  wrote:
> >
> > > +1
> > >
> > > * Verified sha1 & md5 hashes matched
> > > * Verified signatures
> > > * Ran binary tarball locally using Uno
> > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > >
> > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher 
> > wrote:
> > >
> > > > Accumulo Developers,
> > > >
> > > > Please consider the following candidate for Apache Accumulo 1.9.0.
> > > >
> > > > Git Commit:
> > > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > > Branch:
> > > > 1.9.0-rc1
> > > >
> > > > If this vote passes, a gpg-signed tag will be created using:
> > > > git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > >
> > > > Staging repo:
> > > >
> > >
> > https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070
> > > > Source (official release artifact):
> > > > https://repository.apache.org/content/repositories/orgapache
> > > >
> > >
> > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/
> accumulo-1.9.0-src.tar.gz
> > > > Binary:
> > > > https://repository.apache.org/content/repositories/orgapache
> > > >
> > >
> > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/
> accumulo-1.9.0-bin.tar.gz
> > > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash
> for a
> > > > given artifact.)
> > > >
> > > > All artifacts were built and staged with:
> > > > mvn release:prepare && mvn release:perform
> > > >
> > > > Signing keys are available at
> > https://www.apache.org/dist/accumulo/KEYS
> > > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > > >
> > > > Release notes (in progress) can be found at:
> > > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > > >
> > > > Please vote one of:
> > > > [ ] +1 - I have verified and accept...
> > > > [ ] +0 - I have reservations, but not strong enough to vote
> against...
> > > > [ ] -1 - Because..., I do not accept...
> > > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > > >
> > > > This vote will remain open until at least Sun Apr 15 22:30:00 UTC
> 2018
> > > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > > Voting continues until the release manager sends an email closing the
> > > vote.
> > > >
> > > > Thanks!
> > > >
> > > > P.S. Hint: download the whole staging repo with
> > > > wget -erobots=off -r -l inf -np -nH \
> > > >
> > > >
> > >
> > https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070/
> > > > # note the trailing slash is needed
> > > >
> > >
> >
>

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Mike Walch]

I am trying to understand what you are looking for with your -1.

It sounds like you want following files created in
https://dist.apache.org/repos/dist/dev/accumulo/1.9.0 for each release
candidate:

accumulo-1.9.0-bin.tar.gz
accumulo-1.9.0-bin.tar.gz.asc
accumulo-1.9.0-bin.tar.gz.sha512
accumulo-1.9.0-src.tar.gz
accumulo-1.9.0-src.tar.gz.asc
accumulo-1.9.0-src.tar.gz.sha512

This will require the release manager to copy the tarballs and asc files
from the maven repo to SVN dev directory and create the sha512 files for
each candidate, correct?

If this is going to be a new requirement for releases, it should be
documented with step by step instructions at https://accumulo.apache.org/
contributor/making-release

On Sun, Apr 15, 2018 at 10:12 AM, Sean Busbey  wrote:

> sorry, that should have been "staged maven repository should stick to MUST
> guidance"
>
>
>
> On 2018/04/15 14:11:43, Sean Busbey  wrote:
> > -1 on the RC vote
> >
> > I agree that in the staged maven repository we should stick to SHOULD
> guidance until such time that the maven tooling has a supported option to
> use correct checksums. (Have we verified that the relevant tooling at a
> minimum has a request in to add it?)
> >
> > However, I can't verify that the source artifact or any other artifacts
> that we'll eventually place in dist.a.o/release has correct checksums that
> meet the current release distribution policy simply because we don't have
> the relevant bits posted here in the RC.
> >
> > Why don't we go back to providing both a staged maven repo and an RC
> directory in the ASF dev part of dist.a.o[4]? Plenty of other projects use
> that area to stage RCs that have correct checksums.
> >
> > [4]: https://dist.apache.org/repos/dist/dev/accumulo/
> >
> > On 2018/04/15 05:35:39, Christopher  wrote:
> > > Mike,
> > >
> > > We use stronger checksums (SHA512) in the SVN[1] area and downloads
> page[2]
> > > after a vote passes. In fact, we're one of the only "perfect projects"
> in
> > > regards to compliance with this policy[3].
> > >
> > > The Maven staging area doesn't follow all the "SHOULD" statements, but
> > > that's only because these checksums are automatically generated by
> > > maven-deploy-plugin, and not under our direct control. However, it
> still
> > > follows all the "MUST" statements, so it is still in compliance with
> the
> > > cited policy. Unless we're willing to circumvent standard Maven
> tooling and
> > > risk breaking things which depend on the conventions established by
> this
> > > tooling (which, to be clear, I think would be a really terribly bad
> idea),
> > > we simply cannot follow all the "SHOULD" statements for the Maven
> staging
> > > area.
> > >
> > > [1]: https://www.apache.org/dist/accumulo/
> > > [2]: https://accumulo.apache.org/downloads/
> > > [3]: https://checker.apache.org/dist/unsummed.html
> > >
> > > On Sat, Apr 14, 2018 at 11:13 PM Mike Drob  wrote:
> > >
> > > > -0
> > > >
> > > > please do not publish md5 sums
> > > > please add missing sha256 sums
> > > >
> > > > apache release policy:
> > > > http://www.apache.org/dev/release-distribution#sigs-and-sums
> > > >
> > > > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch 
> wrote:
> > > >
> > > > > +1
> > > > >
> > > > > * Verified sha1 & md5 hashes matched
> > > > > * Verified signatures
> > > > > * Ran binary tarball locally using Uno
> > > > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > > > >
> > > > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher 
> > > > wrote:
> > > > >
> > > > > > Accumulo Developers,
> > > > > >
> > > > > > Please consider the following candidate for Apache Accumulo
> 1.9.0.
> > > > > >
> > > > > > Git Commit:
> > > > > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > > Branch:
> > > > > > 1.9.0-rc1
> > > > > >
> > > > > > If this vote passes, a gpg-signed tag will be created using:
> > > > > > git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > > > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > >
> > > > > > Staging repo:
> > > > > >
> > > > >
> > > > https://repository.apache.org/content/repositories/orgapache
> accumulo-1070
> > > > > > Source (official release artifact):
> > > > > > https://repository.apache.org/content/repositories/orgapache
> > > > > >
> > > > >
> > > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.
> 9.0-src.tar.gz
> > > > > > Binary:
> > > > > > https://repository.apache.org/content/repositories/orgapache
> > > > > >
> > > > >
> > > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.
> 9.0-bin.tar.gz
> > > > > > (Append ".sha1", ".md5", or ".asc" to download the
> signature/hash for a
> > > > > > given artifact.)
> > > > > >
> > > > > > All artifacts were built and staged with:
> > > > > > mvn release:prepare && mvn release:perform
> > > > > >
> > > > > > Signing keys are available at
> > > > 

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Sean Busbey]

sorry, that should have been "staged maven repository should stick to MUST 
guidance"



On 2018/04/15 14:11:43, Sean Busbey  wrote: 
> -1 on the RC vote
> 
> I agree that in the staged maven repository we should stick to SHOULD 
> guidance until such time that the maven tooling has a supported option to use 
> correct checksums. (Have we verified that the relevant tooling at a minimum 
> has a request in to add it?)
> 
> However, I can't verify that the source artifact or any other artifacts that 
> we'll eventually place in dist.a.o/release has correct checksums that meet 
> the current release distribution policy simply because we don't have the 
> relevant bits posted here in the RC.
> 
> Why don't we go back to providing both a staged maven repo and an RC 
> directory in the ASF dev part of dist.a.o[4]? Plenty of other projects use 
> that area to stage RCs that have correct checksums.
> 
> [4]: https://dist.apache.org/repos/dist/dev/accumulo/
> 
> On 2018/04/15 05:35:39, Christopher  wrote: 
> > Mike,
> > 
> > We use stronger checksums (SHA512) in the SVN[1] area and downloads page[2]
> > after a vote passes. In fact, we're one of the only "perfect projects" in
> > regards to compliance with this policy[3].
> > 
> > The Maven staging area doesn't follow all the "SHOULD" statements, but
> > that's only because these checksums are automatically generated by
> > maven-deploy-plugin, and not under our direct control. However, it still
> > follows all the "MUST" statements, so it is still in compliance with the
> > cited policy. Unless we're willing to circumvent standard Maven tooling and
> > risk breaking things which depend on the conventions established by this
> > tooling (which, to be clear, I think would be a really terribly bad idea),
> > we simply cannot follow all the "SHOULD" statements for the Maven staging
> > area.
> > 
> > [1]: https://www.apache.org/dist/accumulo/
> > [2]: https://accumulo.apache.org/downloads/
> > [3]: https://checker.apache.org/dist/unsummed.html
> > 
> > On Sat, Apr 14, 2018 at 11:13 PM Mike Drob  wrote:
> > 
> > > -0
> > >
> > > please do not publish md5 sums
> > > please add missing sha256 sums
> > >
> > > apache release policy:
> > > http://www.apache.org/dev/release-distribution#sigs-and-sums
> > >
> > > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch  wrote:
> > >
> > > > +1
> > > >
> > > > * Verified sha1 & md5 hashes matched
> > > > * Verified signatures
> > > > * Ran binary tarball locally using Uno
> > > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > > >
> > > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher 
> > > wrote:
> > > >
> > > > > Accumulo Developers,
> > > > >
> > > > > Please consider the following candidate for Apache Accumulo 1.9.0.
> > > > >
> > > > > Git Commit:
> > > > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > Branch:
> > > > > 1.9.0-rc1
> > > > >
> > > > > If this vote passes, a gpg-signed tag will be created using:
> > > > > git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > > >
> > > > > Staging repo:
> > > > >
> > > >
> > > https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> > > > > Source (official release artifact):
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> > > > > Binary:
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> > > > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash for 
> > > > > a
> > > > > given artifact.)
> > > > >
> > > > > All artifacts were built and staged with:
> > > > > mvn release:prepare && mvn release:perform
> > > > >
> > > > > Signing keys are available at
> > > https://www.apache.org/dist/accumulo/KEYS
> > > > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > > > >
> > > > > Release notes (in progress) can be found at:
> > > > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > > > >
> > > > > Please vote one of:
> > > > > [ ] +1 - I have verified and accept...
> > > > > [ ] +0 - I have reservations, but not strong enough to vote against...
> > > > > [ ] -1 - Because..., I do not accept...
> > > > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > > > >
> > > > > This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> > > > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > > > Voting continues until the release manager sends an email closing the
> > > > vote.
> > > > >
> > > > > Thanks!
> > > > >
> > > > > P.S. Hint: download the whole staging repo with
> > > > > wget -erobots=off -r -l inf -np -nH \
> > > > >
> > > > >
> > > >
> > > 

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Sean Busbey]

-1 on the RC vote

I agree that in the staged maven repository we should stick to SHOULD guidance 
until such time that the maven tooling has a supported option to use correct 
checksums. (Have we verified that the relevant tooling at a minimum has a 
request in to add it?)

However, I can't verify that the source artifact or any other artifacts that 
we'll eventually place in dist.a.o/release has correct checksums that meet the 
current release distribution policy simply because we don't have the relevant 
bits posted here in the RC.

Why don't we go back to providing both a staged maven repo and an RC directory 
in the ASF dev part of dist.a.o[4]? Plenty of other projects use that area to 
stage RCs that have correct checksums.

[4]: https://dist.apache.org/repos/dist/dev/accumulo/

On 2018/04/15 05:35:39, Christopher  wrote: 
> Mike,
> 
> We use stronger checksums (SHA512) in the SVN[1] area and downloads page[2]
> after a vote passes. In fact, we're one of the only "perfect projects" in
> regards to compliance with this policy[3].
> 
> The Maven staging area doesn't follow all the "SHOULD" statements, but
> that's only because these checksums are automatically generated by
> maven-deploy-plugin, and not under our direct control. However, it still
> follows all the "MUST" statements, so it is still in compliance with the
> cited policy. Unless we're willing to circumvent standard Maven tooling and
> risk breaking things which depend on the conventions established by this
> tooling (which, to be clear, I think would be a really terribly bad idea),
> we simply cannot follow all the "SHOULD" statements for the Maven staging
> area.
> 
> [1]: https://www.apache.org/dist/accumulo/
> [2]: https://accumulo.apache.org/downloads/
> [3]: https://checker.apache.org/dist/unsummed.html
> 
> On Sat, Apr 14, 2018 at 11:13 PM Mike Drob  wrote:
> 
> > -0
> >
> > please do not publish md5 sums
> > please add missing sha256 sums
> >
> > apache release policy:
> > http://www.apache.org/dev/release-distribution#sigs-and-sums
> >
> > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch  wrote:
> >
> > > +1
> > >
> > > * Verified sha1 & md5 hashes matched
> > > * Verified signatures
> > > * Ran binary tarball locally using Uno
> > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > >
> > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher 
> > wrote:
> > >
> > > > Accumulo Developers,
> > > >
> > > > Please consider the following candidate for Apache Accumulo 1.9.0.
> > > >
> > > > Git Commit:
> > > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > > Branch:
> > > > 1.9.0-rc1
> > > >
> > > > If this vote passes, a gpg-signed tag will be created using:
> > > > git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > >
> > > > Staging repo:
> > > >
> > >
> > https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> > > > Source (official release artifact):
> > > > https://repository.apache.org/content/repositories/orgapache
> > > >
> > >
> > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> > > > Binary:
> > > > https://repository.apache.org/content/repositories/orgapache
> > > >
> > >
> > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> > > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> > > > given artifact.)
> > > >
> > > > All artifacts were built and staged with:
> > > > mvn release:prepare && mvn release:perform
> > > >
> > > > Signing keys are available at
> > https://www.apache.org/dist/accumulo/KEYS
> > > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > > >
> > > > Release notes (in progress) can be found at:
> > > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > > >
> > > > Please vote one of:
> > > > [ ] +1 - I have verified and accept...
> > > > [ ] +0 - I have reservations, but not strong enough to vote against...
> > > > [ ] -1 - Because..., I do not accept...
> > > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > > >
> > > > This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> > > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > > Voting continues until the release manager sends an email closing the
> > > vote.
> > > >
> > > > Thanks!
> > > >
> > > > P.S. Hint: download the whole staging repo with
> > > > wget -erobots=off -r -l inf -np -nH \
> > > >
> > > >
> > >
> > https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
> > > > # note the trailing slash is needed
> > > >
> > >
> >
> 

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Christopher]

Mike,

We use stronger checksums (SHA512) in the SVN[1] area and downloads page[2]
after a vote passes. In fact, we're one of the only "perfect projects" in
regards to compliance with this policy[3].

The Maven staging area doesn't follow all the "SHOULD" statements, but
that's only because these checksums are automatically generated by
maven-deploy-plugin, and not under our direct control. However, it still
follows all the "MUST" statements, so it is still in compliance with the
cited policy. Unless we're willing to circumvent standard Maven tooling and
risk breaking things which depend on the conventions established by this
tooling (which, to be clear, I think would be a really terribly bad idea),
we simply cannot follow all the "SHOULD" statements for the Maven staging
area.

[1]: https://www.apache.org/dist/accumulo/
[2]: https://accumulo.apache.org/downloads/
[3]: https://checker.apache.org/dist/unsummed.html

On Sat, Apr 14, 2018 at 11:13 PM Mike Drob  wrote:

> -0
>
> please do not publish md5 sums
> please add missing sha256 sums
>
> apache release policy:
> http://www.apache.org/dev/release-distribution#sigs-and-sums
>
> On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch  wrote:
>
> > +1
> >
> > * Verified sha1 & md5 hashes matched
> > * Verified signatures
> > * Ran binary tarball locally using Uno
> > * Ran 'mvn verify' successfully for wikisearch using RC jars
> >
> > On Thu, Apr 12, 2018 at 6:21 PM, Christopher 
> wrote:
> >
> > > Accumulo Developers,
> > >
> > > Please consider the following candidate for Apache Accumulo 1.9.0.
> > >
> > > Git Commit:
> > > bca516000bdb54b1e5582f908e0a525634a120f7
> > > Branch:
> > > 1.9.0-rc1
> > >
> > > If this vote passes, a gpg-signed tag will be created using:
> > > git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > bca516000bdb54b1e5582f908e0a525634a120f7
> > >
> > > Staging repo:
> > >
> >
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> > > Source (official release artifact):
> > > https://repository.apache.org/content/repositories/orgapache
> > >
> >
> accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> > > Binary:
> > > https://repository.apache.org/content/repositories/orgapache
> > >
> >
> accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> > > given artifact.)
> > >
> > > All artifacts were built and staged with:
> > > mvn release:prepare && mvn release:perform
> > >
> > > Signing keys are available at
> https://www.apache.org/dist/accumulo/KEYS
> > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > >
> > > Release notes (in progress) can be found at:
> > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > >
> > > Please vote one of:
> > > [ ] +1 - I have verified and accept...
> > > [ ] +0 - I have reservations, but not strong enough to vote against...
> > > [ ] -1 - Because..., I do not accept...
> > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > >
> > > This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > Voting continues until the release manager sends an email closing the
> > vote.
> > >
> > > Thanks!
> > >
> > > P.S. Hint: download the whole staging repo with
> > > wget -erobots=off -r -l inf -np -nH \
> > >
> > >
> >
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
> > > # note the trailing slash is needed
> > >
> >
>

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Mike Drob]

-0

please do not publish md5 sums
please add missing sha256 sums

apache release policy:
http://www.apache.org/dev/release-distribution#sigs-and-sums

On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch  wrote:

> +1
>
> * Verified sha1 & md5 hashes matched
> * Verified signatures
> * Ran binary tarball locally using Uno
> * Ran 'mvn verify' successfully for wikisearch using RC jars
>
> On Thu, Apr 12, 2018 at 6:21 PM, Christopher  wrote:
>
> > Accumulo Developers,
> >
> > Please consider the following candidate for Apache Accumulo 1.9.0.
> >
> > Git Commit:
> > bca516000bdb54b1e5582f908e0a525634a120f7
> > Branch:
> > 1.9.0-rc1
> >
> > If this vote passes, a gpg-signed tag will be created using:
> > git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > bca516000bdb54b1e5582f908e0a525634a120f7
> >
> > Staging repo:
> >
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> > Source (official release artifact):
> > https://repository.apache.org/content/repositories/orgapache
> >
> accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> > Binary:
> > https://repository.apache.org/content/repositories/orgapache
> >
> accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> > (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> > given artifact.)
> >
> > All artifacts were built and staged with:
> > mvn release:prepare && mvn release:perform
> >
> > Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
> > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> >
> > Release notes (in progress) can be found at:
> > https://accumulo.apache.org/release/accumulo-1.9.0/
> >
> > Please vote one of:
> > [ ] +1 - I have verified and accept...
> > [ ] +0 - I have reservations, but not strong enough to vote against...
> > [ ] -1 - Because..., I do not accept...
> > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> >
> > This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > Voting continues until the release manager sends an email closing the
> vote.
> >
> > Thanks!
> >
> > P.S. Hint: download the whole staging repo with
> > wget -erobots=off -r -l inf -np -nH \
> >
> >
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
> > # note the trailing slash is needed
> >
>

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Mike Walch]

+1

* Verified sha1 & md5 hashes matched
* Verified signatures
* Ran binary tarball locally using Uno
* Ran 'mvn verify' successfully for wikisearch using RC jars

On Thu, Apr 12, 2018 at 6:21 PM, Christopher  wrote:

> Accumulo Developers,
>
> Please consider the following candidate for Apache Accumulo 1.9.0.
>
> Git Commit:
> bca516000bdb54b1e5582f908e0a525634a120f7
> Branch:
> 1.9.0-rc1
>
> If this vote passes, a gpg-signed tag will be created using:
> git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> bca516000bdb54b1e5582f908e0a525634a120f7
>
> Staging repo:
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> Source (official release artifact):
> https://repository.apache.org/content/repositories/orgapache
> accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> Binary:
> https://repository.apache.org/content/repositories/orgapache
> accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> given artifact.)
>
> All artifacts were built and staged with:
> mvn release:prepare && mvn release:perform
>
> Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
> (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
>
> Release notes (in progress) can be found at:
> https://accumulo.apache.org/release/accumulo-1.9.0/
>
> Please vote one of:
> [ ] +1 - I have verified and accept...
> [ ] +0 - I have reservations, but not strong enough to vote against...
> [ ] -1 - Because..., I do not accept...
> ... these artifacts as the 1.9.0 release of Apache Accumulo.
>
> This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> Voting continues until the release manager sends an email closing the vote.
>
> Thanks!
>
> P.S. Hint: download the whole staging repo with
> wget -erobots=off -r -l inf -np -nH \
>
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
> # note the trailing slash is needed
>

RE: [VOTE] Apache Accumulo 1.9.0-rc1

[Ed Coleman]

+1 I verified the md5, sha1 and asc signatures of the artifacts and the git 
commit sha1, the build passed mvn clean verify -Psunny, and I accept this as a 
release of Accumulo 1.9.0, pending the successful outcome of cluster testing.

Ed Coleman

-Original Message-
From: Christopher [mailto:ctubb...@apache.org] 
Sent: Thursday, April 12, 2018 6:22 PM
To: accumulo-dev 
Subject: [VOTE] Apache Accumulo 1.9.0-rc1

Accumulo Developers,

Please consider the following candidate for Apache Accumulo 1.9.0.

Git Commit:
bca516000bdb54b1e5582f908e0a525634a120f7
Branch:
1.9.0-rc1

If this vote passes, a gpg-signed tag will be created using:
git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
bca516000bdb54b1e5582f908e0a525634a120f7

Staging repo:
https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
Source (official release artifact):
https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
Binary:
https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
(Append ".sha1", ".md5", or ".asc" to download the signature/hash for a given 
artifact.)

All artifacts were built and staged with:
mvn release:prepare && mvn release:perform

Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
(Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)

Release notes (in progress) can be found at:
https://accumulo.apache.org/release/accumulo-1.9.0/

Please vote one of:
[ ] +1 - I have verified and accept...
[ ] +0 - I have reservations, but not strong enough to vote against...
[ ] -1 - Because..., I do not accept...
... these artifacts as the 1.9.0 release of Apache Accumulo.

This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018 (Sun Apr 
15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
Voting continues until the release manager sends an email closing the vote.

Thanks!

P.S. Hint: download the whole staging repo with
wget -erobots=off -r -l inf -np -nH \

https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
# note the trailing slash is needed

Re: [VOTE] Apache Accumulo 1.9.0-rc1

[Mike Miller]

Verified sha1, md5 and asc signatures for src and binary tars.
Successfully built using 'mvn clean verify -Psunny' from the extracted
source.

I plan on setting up a cluster for randomwalk on Monday.

On Thu, Apr 12, 2018 at 6:21 PM, Christopher  wrote:

> Accumulo Developers,
>
> Please consider the following candidate for Apache Accumulo 1.9.0.
>
> Git Commit:
> bca516000bdb54b1e5582f908e0a525634a120f7
> Branch:
> 1.9.0-rc1
>
> If this vote passes, a gpg-signed tag will be created using:
> git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> bca516000bdb54b1e5582f908e0a525634a120f7
>
> Staging repo:
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> Source (official release artifact):
> https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.
> 0/accumulo-1.9.0-src.tar.gz
> Binary:
> https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.
> 0/accumulo-1.9.0-bin.tar.gz
> (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> given artifact.)
>
> All artifacts were built and staged with:
> mvn release:prepare && mvn release:perform
>
> Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
> (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
>
> Release notes (in progress) can be found at:
> https://accumulo.apache.org/release/accumulo-1.9.0/
>
> Please vote one of:
> [ ] +1 - I have verified and accept...
> [ ] +0 - I have reservations, but not strong enough to vote against...
> [ ] -1 - Because..., I do not accept...
> ... these artifacts as the 1.9.0 release of Apache Accumulo.
>
> This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> Voting continues until the release manager sends an email closing the vote.
>
> Thanks!
>
> P.S. Hint: download the whole staging repo with
> wget -erobots=off -r -l inf -np -nH \
>
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
> # note the trailing slash is needed
>