Re: Proposal -- Apache Dubbo GSoC2022 Proxyless Mesh support

[Justin Mclean]

Hi,

The mailing list most likely dropped the attachment.

Kind Regards,
Justin

Re: [VOTE] Release Apache dubbo-go-pixiu v0.4.0-rc1

[Justin Mclean]

Hi,

-1 from me as source releases cannot contain compiled code like jar files [1]

Kind Regards,
Justin

1. 
./pkg/adapter/dubboregistry/remoting/zookeeper/zookeeper-4unittest/contrib/fatjar/zookeeper-3.4.9-fatjar.jar

Re: [VOTE]: Release Apache dubbo-js v4.0.1

[Justin Mclean]

Hi,

Sorry it’s -1 (binding) from me.

I think you might want to repackage the release as it unpacks to 
"Users/hufeng/Desktop/“

I checked:
- signature and hashes are fine
- LICENSE is missing some information or some files have the wrong headers
- NOTICE is a little ahead of itself (2022!)
- A number of files have "Copyright 1999-2018 Alibaba Group Holding Ltd.” in 
their header, either this is incorrect or something is missing from LICENSE. 
This files also seem to have double headers.
- No unexpected binary files

Kind Regards,
Justin

Re: [VOTE]: Release Apache dubbo-js v4.0.0

[Justin Mclean]

Hi,

> There’s no signature file under this directory.

But that curl be easily fixed and the voting continue.

Kind Regards,
Justin

Re: [VOTE] Release Apache Dubbo 2.7.11 RC1

[Justin Mclean]

Hi,

> I added the protobuf info in the NOTICE file several versions ago when adding 
> gRPC support. I remember it clearly says in some place that a declaration 
> must be included in a project's NOTICE file if there’s abt reference of the 
> source code. I will check the protobuf codes later for sure.

See [1] (assuming it was under ALv2) or [2] if it was MIT/BSD licensed. 
Depending if it came from protobuf or grpc GitHub repos. In either case nothing 
should get added to NOTICE.

> I think we can fix it in the next release.

Sure.

Thanks,
Justin

1. https://infra.apache.org/licensing-howto.html#alv2-dep 

2. https://infra.apache.org/licensing-howto.html#permissive-deps 

Re: [VOTE] Release Apache Dubbo 2.7.11 RC1

[Justin Mclean]

Hi,

+1 binding but there a couple of minor license and notice issues that need to 
be corrected.

I checked:
- signatures and hashes are fine
- LICENSE should also list InternalThreadLocal.java
- NOTICE doesn’t need to list information about protobuf as the project doesn’t 
have a NOTICE file
- A few files are missing ASF headers, please add them e.g. [1]
- No unexpected binary files
- Can compile from source.

Thanks,
Justin

1. ./dubbo-rpc/dubbo-rpc-thrift/src/test/thrift/Demo.thrift

Re: [VOTE] Release Apache Dubbo API Docs 2.7.8.3 RC2

[Justin Mclean]

HI,

> I'm very sorry, "Hash for the release tag" is wrong. I announce to withdraw
> this vote. Later, I will amend the "release tag" and launch RC3 vote

For a minor issue like that I would just correct it and continue voting as it 
has no impact on the release artefact.

Kind Regards,
Justin

Re: [VOTE] Release Apache Dubbo API Docs 2.7.8.3 RC1

[Justin Mclean]

Hi,

The release to be voted on needs to be put here [1] along with teh KEYS file 
and signature files.

Justin

1. https://dist.apache.org/repos/dist/dev/dubbo/

Re: [Suggest] Dubbo issues problem

[Justin Mclean]

HI,

> - We can introduce a bot to automatically close these issues and pull
> requests if the original author does not reply for a long time.

I suggest you don’t this this as it discourages people from contributing and 
you more more committers and grow the community so you have more people who can 
respond to PR in a more timely manner. I would try to come up with ways to 
review the back log of requests and be more responsive to the communities PRs. 

Thanks,
Justin

Re: [Brand issue] microservices summit link in website

[Justin Mclean]

Hi,

> I read this page before, still, I don’t see why this volatiles the Apache 
> rule. I think Apache Dubbo can attend this conference and is free to put it 
> in the homepage or in a blog hosted by the website. It’s an open summit with 
> some open topics.

This has been discussed a few times on various lists. In general links to 3rd 
parties cannot be on the front page of an Apache project and must have a 
no-follow attribute if they are elsewhere. If you want to do something like 
this check with trademarks / branding first.

This may also bee useful. [1]

Thanks,
Justin

1. https://www.apache.org/foundation/marks/linking

Re: [VOTE] Release Apache Dubbo-Hessian-Lite 3.2.9 RC1

[Justin Mclean]

Hi,

The vote has been miscounted here.

Justin

Re: [VOTE]: Accept dubbogo/getty donation

[Justin Mclean]

Hi,

That all look fine but don’t forget about the IP clearance form
.http://incubator.apache.org/ip-clearance/ip-clearance-template.html 


This need to be completed before any code from this SGA is released.

This may also help:
https://incubator.apache.org/guides/ip_clearance.html

Thanks,
Justin

Re: [VOTE] Release Apache Dubbo 2.7.8 RC1

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- signatures and hashes are good
- LICENSE and NOTICE correct
- No unexpected binary files in release
- All ASF files have correct headers
- Can compile from source

Thanks,
Justin

Re: [VOTE]: Release Apache dubbo-go v1.5.0 RC1

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- signature and hashes are fine
- LICENSE and NOTIE are good
- All ASF file have corrected headers
- No unexpected binaries
- can compute from source

I did have some test time out but that be my setup/config.

Thanks,
Justin

Re: [VOTE] Release Apache Dubbo-Hessian-Lite 3.2.9 RC1

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- signatures and hashes are fine
- LICENSE and NOTICE good
- ASF files have correct headers
- No unexpected binary files
- Can compile from source

Thanks,
Justin

Re: [VOTE]: Accept dubbogo/getty donation

[Justin Mclean]

Hi,

> all contributors as follows except [JerryZhou343](
> https://github.com/JerryZhou343) has signed the ICLA.

That seems fine. It would be best to list their names as the ICLA don’t list 
GitHub accounts.

> I can not contact with JerryZhou343 who just has one commit
> https://github.com/dubbogo/getty/commit/0c47783532dd2dc9995d8ebd850dcda09856e939

I don’t think that is a concern.

Thanks,
Justin

Re: [VOTE]: Accept dubbogo/getty donation

[Justin Mclean]

Hi,

Before it can be accepted it needs to pass IP clearance as described here [1]

Thanks,
Justin


1.http://incubator.apache.org/ip-clearance/ip-clearance-template.html

Re: [VOTE]: Accept dubbogo/getty donation

[Justin Mclean]

Hi,

Has twas the grant handled? I don’t see it listed here. [1] Do we have signed 
ICLA’s for all contribitors?

Thanks,
Justin

1. https://incubator.apache.org/ip-clearance/

Re: [VOTE]: Accept dubbogo/getty donation

[Justin Mclean]

Hi,

A software grant is required in this case please see [1].

Thanks,
Justin


1. https://www.apache.org/licenses/contributor-agreements.html#grants

Re: [VOTE]: Accept dubbogo/getty donation

[Justin Mclean]

HI,

For any contribution of significant size a SGA is required and IP clearance 
undertaken. If it this repo [1] then an individual does not own copyright of 
all of the code. Each contributor or their employer owns copyright in their own 
contributions unless they have stated otherwise. If their employer own the 
copyright we need permission from them.

Thanks,
Justin

1. https://github.com/dubbogo/getty/graphs/contributors

Re: [VOTE]: Accept dubbogo/getty donation

[Justin Mclean]

Hi,

And I see a few other contributors [1] How has the IP of their contribution 
been handled?

Thanks,
Justin


1. https://github.com/dubbogo/getty/graphs/contributors

Re: [VOTE]: Accept dubbogo/getty donation

[Justin Mclean]

HI,

I assume this will be donated as a software grant?

Thanks,
Justin

Re: 4.26会议纪要

[Justin Mclean]

Hi,

I would also suggest bring back a summary of what was discussed to this list.

Thanks,
justin

Re: [VOTE] Release Apache dubbo-go v1.4.0 RC2

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- signatures and hashes correct
- LICENSE and NOTICE good
- No unexpected binary files
- All source file have ASF headers
- Couldn’t compile from source but probably my setup

Thanks,
Justin

Re: [VOTE] Release Apache Dubbo-Hessian-Lite 3.2.7 RC3

[Justin Mclean]

Hi,

> However I think think this is a blocking issue for this release, just that it 
> should be fixed for future releases.

Sorry to be clear I meant to say “this is NOT a blocking issue”.

Thanks,
Justin

Re: [VOTE] Release Apache Dubbo-Hessian-Lite 3.2.7 RC3

[Justin Mclean]

Hi,

Thanks  for the history.

> Or it should be (this is it’s first release after donated to Apache as a 
> separate artifact):
>> Copyright 2020-2020 The Apache Software Foundation

Copyright is based on publication dates so I would just go with:
Copyright 2020 The Apache Software Foundation

However I think think this is a blocking issue for this release, just that it 
should be fixed for future releases.

Thanks,
Justin

Re: [VOTE] Release Apache dubbo-go-hessian2 v1.5.0 RC1

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- signatures and hashes are fine
- LICENSE is missing the appendix. Please fix this.
- NOTICE is fine
- No unexpected binary files
- All source file have ASF headers
- can compile from source

Thanks,
Justin

Re: [VOTE] Release Apache Dubbo-Hessian-Lite 3.2.7 RC3

[Justin Mclean]

Hi,

> Copyright 2018-2020 The Apache Software Foundation

Why 2018? When was the first release of  Apache Dubbo-Hessian-Lite?

Thanks,
Justin

Re: [VOTE] Release Apache Dubbo-Hessian-Lite 3.2.7 RC2

[Justin Mclean]

HI,

> I know that the NOTICE file is still missing. Actually, I added NOTICE file
> to the project before packaging,

The NOTICE file is required for all ASF releases. [1]

> but after I did that I found that the
> NOTICE file doesn't have anything to mention but the following lines:
> 
> Apache Dubbo
> Copyright 2018-2020 The Apache Software Foundation
> 
> This product includes software developed at
> The Apache Software Foundation (http://www.apache.org/)

In your case that’s correct, but other notice files can be much more complex. 
[2]

Thanks,
Justin

1. https://www.apache.org/legal/src-headers.html#notice
2. http://www.apache.org/dev/licensing-howto.html#mod-notice

Re: [VOTE] Release Apache Dubbo 2.7.6 RC3

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- Signatures and hashes are fine
- LICENSE and NOTICE correct
- No unexpected binary files
- All ASF file have correct headers
- Can compile from source

Thanks,
Justin

Re: [VOTE] Release Apache Dubbo-Hessian-Lite 3.2.7 RC2

[Justin Mclean]

Hi,

-1 (binding) The NOTICE file is still missing, everything else looks good.

Thanks,
Justin

Re: [VOTE] Release Apache Dubbo 2.7.6 RC2

[Justin Mclean]

Hi,

> Very good question, we are trying to contact the original author for the
> same question.

It may be they come some other company repo going by headers here [1] but I 
cannot find the exact file, perhaps it’s an internal repo? It odd these files 
have that header.

Thanks,
Justin

1. 
https://github.com/search?q=%22Copyright+%28C%29+2018+the+original+author+or+authors.%22+org%3Aalibaba=Code

Re: [VOTE] Release Apache Dubbo-Hessian-Lite 3.2.7 RC1

[Justin Mclean]

Hi,

> If it is legally fine (I think it is perfectly allowed)

That is not the case at the ASF, we also have ASF policy and the Apache Way 
which override and go beyond what is just legal. This situation in unfortunate 
but continue the best you can.

> What we could change in the future is
> we should gracefully retire hessian-lite library and encourage Dubbo users
> to depend on the official Hessian 4 release.

That seems a good option going forward. I would also say that working with 
other OS projects is a good way to attract committers.

> My conclusion is, this particular issue should not block the current
> release and the future potential releases.

No but the release has other things I would consider blockers and currently 
doesn’t comply with ASF release policy.

Thanks,
Justin

Re: [VOTE] Release Apache Dubbo-Hessian-Lite 3.2.7 RC1

[Justin Mclean]

Hi,

> Unless we know where that other file come from [1] I would still be -1.

Looks fine for that file. What about the other 3rd party files/files without 
headers?I think someone needs to go through the files and check that all files 
have the correct headers.

Thanks,
Justin

Re: [VOTE] Release Apache Dubbo-Hessian-Lite 3.2.7 RC1

[Justin Mclean]

Hi,

> From what I can see now, we need an NOTICE file, inside which we should 
> mention the codes copy of of the Caucho Hessian Project.

The NOTICE file doesn’t need to mention that unless headers have been removed 
from any files that come from Caucho Hessian, for  that to happen we would need 
a software grant.

> Do you think would that change be enough for the next round of release?

Unless we know where that other file come from [1] I would still be -1.

Thanks,
Justin

1. 
dubbo-hessian-lite-3.2.7-source-release/src/test/java/com/alibaba/com/caucho/hessian/io/writereplace/Hessian2WriteReplaceTest.java

Re: [RESULT] [VOTE]: Release Apache dubbo-go v1.4.0 RC1

[Justin Mclean]

Hi,

> We’ve received one -1 binding vote from Justin Mclean for there's some
> license issue.

To be clear a -1 is not a veto, for releases you need 3 +1s and more +1s than 
-1s. The release manages however can cancel the vote if they think a -1 has 
merit and a new release needed.

Thanks,
Justin

Re: [VOTE] Release Apache dubbo-go v1.4.0 RC1

[Justin Mclean]

Hi,

Having a release checklist usually helps [1] and does running Apache Rat [2] on 
the release artefact.

Thanks,
Justin

1. 
https://cwiki.apache.org/confluence/display/INCUBATOR/Incubator+Release+Checklist
2. https://creadur.apache.org/rat/

Re: [VOTE] Release Apache Dubbo-Hessian-Lite 3.2.7 RC1

[Justin Mclean]

Hi,

> hessian-lite is an tailored copy from Caucho's Hessian library. I don't
> believe a software grant is necessary since it is licensed under ASF 1.1. I
> believe we have the right to modify and contribute freely as long as we
> mention it in the LICENSE file

Legally that fine yes no issues in that respect. However the ASF generally 
doesn't make forks of other projects, it’s generally seen as not being 
respectful to the original projects community. It would be good to know more 
the history here and why this was done, where there talks with the Caucho and 
they gave permission to do this? Or are some of those developers involved here?

Thanks,
Justin

Re: [VOTE] Release Apache Dubbo 2.7.6 RC2

[Justin Mclean]

Hi,

> It does have the different license header than others, but I think it is
> fine. Pls. let me know if it is a show stopper for the current release.

See ASF header policy [1] ("note that there should be no copyright notice in 
the header") and policy on 3rd party files [2].

> These files are originally made by Dubbo team.

That may be the case but why does it have that copyright line? To me that 
implies this files come from somewhere else, if that is the case we need to 
know where they come form if if they were modified by the Dubbo team.

Thanks,
Justin

1. https://www.apache.org/legal/src-headers.html#headers
2. https://www.apache.org/legal/src-headers.html#3party

Re: [VOTE] Release Apache Dubbo 2.7.6 RC2

[Justin Mclean]

Hi,

-1 (binding) as code has incorrect headers

I checked:
- signatures and hashes fine
- LICENSE and NOTICE are file
- No unexpected binary files 
- Looks like these files [1][2][3] have incorrect header or may not be ASF 
files, and may need to be mentioned in LICENSE. Where did they come from?
- I didn’t try compiling

Thanks,
Justin

1. ./dubbo-common/src/main/java/org/apache/dubbo/common/utils/HttpUtils.java
2. 
./dubbo-metadata/dubbo-metadata-processor/src/test/java/org/apache/dubbo/metadata/rest/User.java
3. 
./dubbo-metadata/dubbo-metadata-api/src/test/java/org/apache/dubbo/metadata/rest/User.java

Re: [VOTE] Release Apache Dubbo-Hessian-Lite 3.2.7 RC1

[Justin Mclean]

Hi,

-1 (binding) as the release is missing a NOTICE file and files missing ASF 
headers

I checked:
- signature and hashes are fine
- LICENSE exists
- NOTICE is missing
- no unexpected binary files
- some files are ASF headers or unknown licensed 3rd party code e.g. [1] (I 
just check a couple of file not all and found this)
- can compile from source

Is there any reason for the large number of files copyright "Copyright (c) 
2001-2008 Caucho Technology, Inc”? Was s software grant looked into?

Thanks,
Justin

1. 
dubbo-hessian-lite-3.2.7-source-release/src/test/java/com/alibaba/com/caucho/hessian/io/writereplace/Hessian2WriteReplaceTest.java

Re: [VOTE] Release Apache dubbo-go v1.4.0 RC1

[Justin Mclean]

Hi,

Sorry but it’s -1 binding form me as there are files missing ASF headers or 3rd 
party code of unknown licensing in the release

I checked:
- signatures and hashes are fine
- LICENSE and NOTICE are fine
- no unexpected bins art files
- source files are missing ASF headers [1][2][3][4]
- can compile from source

Thanks,
Justin


1. dubbo-go-v1.4.0/common/extension/auth.go
2. dubbo-go-v1.4.0/config/interfaces/config_reader.go
3. dubbo-go-v1.4.0/filter/filter_impl/active_filter_test.go
4. dubbo-go-v1.4.0/protocol/rpc_status_test.go

Re: [VOTE]: Release Apache dubbo-go v1.3.0 RC2

[Justin Mclean]

Hi,

+1 binding but there a minor issue mentioned before that was not fixed.

I checked:
- signatures and hashes are OK
- The LICENSE imisisng mention of [1]
- NOTICE is correct
- all source files have ASF headers (except [1])
- no unexpected binary files
- Again didn’t compile from source. The instruction on how to do this could be 
clearer in the readme.   

Thanks,
Justin

1. ./protocol/grpc/protoc-gen-dubbo/examples/helloworld.proto

Re: [VOTE]: Release Apache dubbo-go v1.3.0 RC1

[Justin Mclean]

Hi,

+1 binding but there a couple of minor issue that need to be fixed before next 
release

I checked:
- signatures and hashes are OK
- The LICENSE is missing the appendix and one copyright owner
- the year in NOTICE is incorrect
- all source files have ASF headers
- no unexpected binary files
- didn’t compile from source. The instruction on how to do this cruel be 
clearer in the readme.

License is missing the license/copyright owner of this file [1]

It would be better to sign with an apache.org signature rather than a gmail one.

Thanks,
Justin

1. ./protocol/grpc/protoc-gen-dubbo/examples/helloworld.proto

Re: [VOTE]: Release Apache dubbo-js v3.0.0-rc6

[Justin Mclean]

Hi,

> We need an npm account， Does Apache have an official npm account?

I’m not actually sure, something was being worked on bu I don’t think it’s 
official yet. If you don’t find anything I’d follow the advice here [1]

Thanks,
Justin

1. https://cwiki.apache.org/confluence/display/INCUBATOR/DistributionGuidelines

Re: [VOTE]: Release Apache dubbo-js v3.0.0-rc6

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- signatures and hashes are fine
- LICENSE is fine
- NOTICE all good
- No unexpected binary files
- All files have ASF headers
- Can compile from source

There is however another possible more serious issue in that this package may 
have A GPL dependancy, after compiling I can see this GPL licensed file [1]. 
While  JSdom is MIT licensed is seems it contains this file which is GPL 
licensed, is this file actually used?

Thanks,
Justin

1. ./node_modules/jsdom/lib/jsdom/browser/default-stylesheet.js

Re: [VOTE]: Release Apache dubbo-js v3.0.0-rc5

[Justin Mclean]

Hi,

The NOTICE is still incorrect as it contains the text:
"Apache Dubbo Js Submodules:
  
Apache Dubbo Js includes a number of submodules with separate copyright notices
and license terms. Your use of these submodules is subject to the terms and
conditions of the following licenses.”

Is this correct or not?

Thanks,
Justin

Re: [VOTE]: Release Apache dubbo-js v3.0.0-rc4

[Justin Mclean]

Hi,

> what is apache wide code_of_conduct? Where can i find？please help me

It can be found here [1]

Thanks,
Justin

1. https://www.apache.org/foundation/policies/conduct

Re: [VOTE]: Release Apache dubbo-js v3.0.0-rc4

[Justin Mclean]

Hi,

-1 (binding) Why was the license and notice changed from the last RC?

I checked:
- LICENSE include dependancies rather than bundled software. Only things 
included in the release need to be mentioned in LICENSE.
- If those MIT likened bit of code were included then you would need to include 
the MIT license for each one. The MIT license include a copyright line making 
it different for each project.
- NOTICE has incorrect year (2019)
- NOTICE incorrectly contains license information
- No unexpected binary files
- All files have ASF headers
- Can compile from source


Other minor issues:
- your code of conduct should point to the Apache wide one.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo Spring Boot 2.7.5 [RC1]

[Justin Mclean]

Hi,

+1 but there’s an issue need to be fixed in the next release. All files are 
apache licensed so there no license issue per say.

I checked:
- signatures and hashes fine
- LICENSE is missing one file [1]
- NOTICE year need updating
- This file seems to incorrectly have an ASF header [1] when it from another 
project.
- No unexpected binary files
- can compile from source

Some of the documentation still refers to https://github.com/dubbo and 
https://github.com/mercyblitz this will need to change. This was brought up in 
a previous release when will this be fixed?

Thanks,
Justin


1. 
./dubbo-spring-boot-samples/dubbo-registry-zookeeper-samples/provider-sample/src/main/java/org/apache/dubbo/spring/boot/demo/provider/bootstrap/EmbeddedZooKeeper.java

Re: [VOTE] Release Apache Dubbo 2.7.5 RC2

[Justin Mclean]

Hi,

> The issues pointed by Justin and Yunkun during RC1 vote are not included.

Why is that? Issues once know should be fixed in the next RC. Issues once know 
and not corrected warrant a -1 vote IMO. Your not an incubating project anymore 
but a top level one and need to follow ASF p[policy.

Thanks,
Justin

Re: [VOTE]: Release Apache dubbo-js v3.0.0-rc2

[Justin Mclean]

Hi,

Again I would strongly recommend that you not release this because of the
30MB of git internal files contained in the release.

Thanks,
Justin

On Mon, 23 Dec 2019, 14:07 胡锋,  wrote:

> I took a moment to write a script to detect a license file for a nodejs
> project
>
> Jun Liu  于2019年12月23日周一 上午11:03写道：
>
> > +1 binding
> >
> > I checked:
> >  * signatures and hashes are good
> >  * LICENSE and NOTICE exit and content are good
> >  * all source files no binary files
> >
> > As Justin has pointed, some files do not have the right Apache License
> > Header. I am wondering if it’s possible for this project's building tool
> to
> > add some checking rules like what we do in apache/dubbo with Maven
> > plugins[1][2].
> >
> > 1.
> >
> https://github.com/apache/dubbo/blob/9e9517dc2fb2892a256b8e2a0eaaadb9164b8b61/pom.xml#L354
> > 2.
> >
> https://github.com/apache/dubbo/blob/9e9517dc2fb2892a256b8e2a0eaaadb9164b8b61/pom.xml#L483
> >
> > Jun
> >
> > > On Dec 19, 2019, at 1:15 PM, 胡锋  wrote:
> > >
> > > Hello Dubbo/Dubbojs Community,
> > >
> > > This is a call for vote to release Apache dubbo-js version v3.0.0-rc2.
> > >
> > > The release candidates:
> > > https://dist.apache.org/repos/dist/dev/dubbo/dubbo-js/3.0.0-rc2/
> > >
> > > Git tag for the release:
> > > https://github.com/apache/dubbo-js/blob/v3.0.0/CHANGE.md
> > >
> > > Hash for the release tag:
> > > 1f8b7f0ef660186fe6ce452c57e8b1960801f005
> > >
> > > The artifacts have been signed with Key :35F44C444B811C10, which can be
> > > found in the keys file:
> > >
> > > https://dist.apache.org/repos/dist/dev/dubbo/KEYS
> > >
> > > The vote will be open for at least 72 hours or until necessary number
> of
> > > votes are reached.
> > >
> > >
> > > Please vote accordingly:
> > >
> > > [ ] +1 approve
> > >
> > > [ ] +0 no opinion
> > >
> > > [ ] -1 disapprove with the reason
> > >
> > >
> > > Thanks,
> > >
> > > The Apache Dubbo-js Team
> >
> >
>

Re: [VOTE] Release Apache Dubbo 2.7.5 RC1

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- signatures and hashes fine
- LICENSE and NOICE file
- Files have ASF headers except a couple like [1]
- No unexpected binary files
- Can compile from source

Thanks,
Justin


[1] ./compiler/src/main/resources/DubboGrpcStub.mustache

Re: [VOTE]: Release Apache dubbo-js v3.0.0-rc2

[Justin Mclean]

Hi,

This should probably be called rc3 and the previous release was rc2. 

Everything is OK ASF wise, but I I think you may wan to make this release again 
as the release incorrectly contains a “.git” folder including this 30MB file [3]

I checked:
- signature and hashed good
- LICENSE and NOTICE fine
- no unexpected binary files (except that pack file)
- all file have ASF headers
- could compile from source

Major issue:
“- .git folder in release

Some other minor issues:
- pom.xml file has incorrect copyright [1]
- several files have "Copyright 1999-2011 Alibaba Group.” this was brought up 
in the RC and seems to have not been fixed.
- This file [2] seem to be under an MIT license but is no mentioned in LICENSE
- Several .DS_Store files exits
- .github exists
- The ASF has a code of conduct so I’m not sure why you have a different one, 
it probably best to point to the ASF one

Thanks,
Justin

1. ./java/pom.xml
2 ./examples/hello-egg/package.json
3. ./.git/objects/pack/pack-9d2908da45a32a07e26ca09d244ed03da36231b1.pack

Re: [VOTE]: Release Apache dubbo-js v3.0.0-rc2

[Justin Mclean]

HI,

Sorry but it’s -1 (binding) due to compile code in release [1][2] and file not 
have correct asf headers

I checked:
- Signatures and hashes fine
- LICENSE and NOTICE are fine
- Compiled code exist in the release [1][2]
- Some java files are missing ASF headers e.g [3] (there about a dozen files 
like this)
- Some files I assume have incorrect ASF headers with a copyright line 
"Copyright 1999-2011 Alibaba Group.”, This code was donated to the ASF right?

I also notice that the package name for some of the Java files is "com/alibaba” 
should this be something different? I also noticed this pom file [4] states the 
code is Copyright Alibaba Group

Thanks,
Justin

1. ./packages/interpret-cli/ext/jexpose-1.2.jar
2. ./packages/interpret-cli/ext/jexpose-1.3.jar
3. 
./java/dubbo-demo/dubbo-demo-api/src/main/java/com/alibaba/dubbo/demo/BasicTypeProvider.java
4. ./java/pom.xml

Removal of old incubator releases

[Justin Mclean]

Hi,

It looks like you have some old incubator releases here:
https://dist.apache.org/repos/dist/release/incubator/

We’re cleaning up the release area and it would be great if you can remove 
these old releases.

If for some reason you need to link to an old release you can do so with a link 
to the archive area under here: [1][2]
https://archive.apache.org/dist/incubator/

Thanks,
Justin

1. https://www.apache.org/dev/mirrors#location
2, https://www.apache.org/dev/release-distribution.html#download-links

Re: [VOTE]: Release Apache dubbo-js v3.0.0

[Justin Mclean]

Hi,

-1 (binding) as the release need to be cryptographically signed, it's missing 
LICENSE and NOTICE files and missing some ASF headers.

I checked:
- hash is fine
- missing signature
- missing LICENSE and NOTICE files
- files are missing ASF headers e.g. [1][2][3][4] and others
- no unexpected binary files which is good
- unable to compile from source

Having some instruction in the README on how to compile the source release 
woful be useful. I tried several think but was unable to do so.

Thanks,
Justin

1. ./dubbo/src/__tests__/byte-test.ts
2 ./dubbo/src/__tests__/dubbo-url-test.ts
3. ./dubbo/src/__tests__/dubbox-test.ts
4. dubbo/src/__tests__/socket-worker-test.ts

Re: [VOTE]: Release Apache dubbo-go v1.2.0 RC1

[Justin Mclean]

Hi,

I noticed that before_ut.sh is missing an execute bit. I also noticed that the 
install script grabs a jar from here [1]. How is that jar produced?

Thanks,
Justin

1. 
https://github.com/dubbogo/resources/tree/master/zookeeper-4unitest/contrib/fatjar

Re: [VOTE]: Release Apache Dubbo Spring Boot 2.7.4.1 [RC1]

[Justin Mclean]

Hi,

I notice the documentation refers to external non-Apache websites is there a 
reason for this?

5. [Dubbo Annotation-Driven 
(Chinese)](https://github.com/mercyblitz/blogs/blob/master/java/dubbo/Dubbo-Annotation-Driven.md)
6. [Dubbo Externalized Configuration 
(Chinese)](https://github.com/mercyblitz/blogs/blob/master/java/dubbo/Dubbo-Externalized-Configuration.md)

Thanks,
Justin

Re: [VOTE] Accept RitterHou/python-dubbo donation

[Justin Mclean]

Hi,

Who owns the copyright on this code? I assume it is Qianmi? If so we would need 
a SGA from them.

Thanks,
Justin

Re: network transmission extension of xScoket

[Justin Mclean]

Hi,

I noticed it’d under a GPL license, so some care will need to be taken if it is 
merged. i.e. no GPL code in a release, and it needs to be an optional 
dependancy.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo 2.7.4 [RC2]

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- signatures and hashes fine
- LICENSE and NOTICE OK
- no unexpected binary files
- source files have ASF headers
- can compile from source

RE the software grant normally when a copyright is removed and the headers 
replaced you need to put something in NOTICE saying this was done. If original 
headers are left in there then this should be mentioned in LICENSE. I suggest 
you fix this in the next release

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo 2.7.4 [RC1]

[Justin Mclean]

Hi,

> Since we have submitted the SGA, could you please help to start a new vote?

I‘m not sure the SGA has been accepted / acknowledged yet, it would be too 
early to make another RC until it has been done so.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo 2.7.4 [RC1]

[Justin Mclean]

Hi,

> If the owner agree to sign SGA, do we have to transfer that project to 
> apache, I mean, move the project from 'alibaba/spring-context-support’ to 
> 'apache/spring-context-support’?

I don’t think there's a hard requirment to transfer it. The SGA just grants 
permission to use what’s in the software grant, in short a non-exclusive, 
worldwide, royalty-free copyright and patent license to do what we want with 
it. [1]

Thanks,
Justin

1. https://www.apache.org/licenses/software-grant-template.pdf

Re: [VOTE]: Release Apache Dubbo 2.7.4 [RC1]

[Justin Mclean]

Hi,

> The new PRs were committed and merged, and the correlative code also was
> re-implemented including

If you do a diff or manual comparison on the files you’ll see that there are 
still some lines that are the same, yes they have been modified but that 
doesn’t  mean you own the IP on the entire contents of the file or had 
permission to change the license.

> Above 6 files that you mentioned has been different from
> alibaba/spring-context-support, I am looking forward to your further
> instructions?

I not sure why you are asking me for instructions. If the a new release was 
made, it would depend on how the PMC voted not just me. Anyone voting would 
need to be 100% convinced that the code contained not a single line that was 
owned by Alibaba.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo 2.7.4 [RC1]

[Justin Mclean]

Hi,

Doing a comparison between those two directory I see 6 files that have code in 
common. Not it’s not only code in common but comments as well, trivial small 
amount of code may not be covered by copyright, but the comments will be.

> Assume the owner is Alibaba, then what we should ask them to sign an SGA[1], 
> right?
> 
> 1. 
> http://dubbo.apache.org/en-us/docs/developers/contributor-guide/software-donation-guide_dev.html

Assuming they are the owner that would be correct.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo 2.7.4 [RC1]

[Justin Mclean]

Hi,

>> 1. Rewrite the code completely.
> 
> The code has been rewritten

I can see one file has been rewritten but not all of the files. Am I correct in 
that assessment?

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo 2.7.4 [RC1]

[Justin Mclean]

Hi,

> 1. Rewrite the code completely.
> 2. Ask the owner for a software grant

What’s easier to do? I assume 2 would be easier than 1 given they have donated 
code before?

Thanks,.
Justin

Re: [VOTE]: Release Apache Dubbo 2.7.4 [RC1]

[Justin Mclean]

Hi,

> How about we add some declaration about this util java files in *LICENSE* 
> file.

While the code is now under an Apache license, IMO it's still unknown who the 
IP owner is and if they agreed to that license change. So I think  we would 
need to do more than just add something to the LICENSE file. What do other PMC 
members think?

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo 2.7.4 [RC1]

[Justin Mclean]

HI,

> I checked the commit[1], several methods were removed from the file. I think 
> it’s ok to proceed now if the other codes were originally written by 
> yourself. I can help to cancel this vote and start a new one with the latest 
> codes.
> 
> Before we doing that, let’s see what other people more familiar and sensitive 
> with IP Clearance will say, especially opinions from Justin.

I only see one file changed by that PR, there are several files that were 
copied from that repo (please correct me if that not the case), so I think we 
still have an issue here.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo 2.7.4 [RC1]

[Justin Mclean]

Hi,

> All code and files of https://github.com/alibaba/spring-context-support are 
> writen by me, they are not originally from other projects, but
> are come from My private repo.

You may of written the code but who owns the IP? I would guess, but may be 
wrong, that Alibaba does not you. Most employee contracts state that the 
company you work for owns the code and given their name is on that repo (even 
if you are the only contributor) it would seem likely that they own the IP. Can 
you confirm if this is the case? 

If they do then we’ll get permission from them to be able to use it. Normally 
external code needs a software grant before it can be accepted into an Apache 
project.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo 2.7.4 [RC1]

[Justin Mclean]

Hi,
> > It’s strange these files have an ASF header when they are in a non ASF repo 
> > which is licensed under a non ASF license. What the story behind these 
> > files?
> 
> The license of https://github.com/alibaba/spring-context-support 
>  had been changed to be 
> "Apache License 2.0" - 
> https://github.com/alibaba/spring-context-support/blob/master/LICENSE 
> 

That doesn’t answer my question. Why did the files have an Apache header in a 
repo that was not Apache licensed? Where did these files originally come from? 
It seems they were copied from somewhere to this repo and then copied to Dubbo.
> > PR#3 says "Add some code from other places”, what other places did this 
> > code come from? If this is the case, where other people involved in writing 
> > that code? What license was it under?
> 
> The code came from my private repo, just pulled request to upstream(Alibaba 
> repo).

Sorry but neither sorry does that. At Apache all code needs clear IP 
provenance, given we don’t have that here I’m still -1 on this release. Now 
that -1 isn’t a veto and other PMC members may still vote +1 if they think the 
IP provenance is clear.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo 2.7.4 [RC1]

[Justin Mclean]

HI,

To repeat my questions:

It’s strange these files have an ASF header when they are in a non ASF repo 
which is licensed under a non ASF license. What the story behind these files?

PR#3 says "Add some code from other places”, what other places did this code 
come from? If this is the case, where other people involved in writing that 
code? What license was it under?

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo 2.7.4 [RC1]

[Justin Mclean]

HI,

> I believe there's no show stopper. Let's continue to vote the release.

They are not but I’m still waiting an answer to my other questions, which may 
be? Anyone?

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo 2.7.4 [RC1]

[Justin Mclean]

Hi,

> I'm the author of https://github.com/alibaba/spring-context-support, could
> I change the LICENSE of this project to be "Apache License 2.0" to resolve
> this issue?

If you are the only contributor (which seems to be the case) that would be one 
way of dealing with it. The Dubbo LICENSE file would need to change if that was 
done. 

However that I still like to know how code euthanasia ASF header come to be in 
that repo and there may be some other issues, for instance PR#3 says "Add some 
code from other places”, what other places did this code  come from? If this is 
the case, where other people involved in writing that code? What license was it 
under?

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo 2.7.4 [RC1]

[Justin Mclean]

Hi,

-1 binding (due to Category X software being included). 

I checked:
- signatures and hashes fine
- LICENSE is OK (see below)
- NOTICE is fine
- There are a couple of files that are missing ASF headers e.g. [1]
- There are no unexpected binary files
- can compile from source

This file [4] includes code cloned from here [5] which is under a GPL license. 
[6] This license is not compatible with the ALv2 and is Category X. [7] The 
same issue exists with this file [8]. It looks like other files in that util 
directory have also been copied from [9]. it’s strange these files have an ASF 
header when they are in a non ASF repo which is licensed under a non ASF 
license. Given a good explanation for this and those file are correctly 
licensed I’ll change my vote. What the story behind these files?

It would be better if the MIT license text was included in the LICENSE or it 
included a local pointer to the text. Information at a URL can change over time.

Looking through the code I found a few other minor things that may need to be 
updated:
- References to internal JIRA  
http://code.alibabatech.com/jira/browse/DUBBO-XXX that I cannot access.
- Reference to this URL [2]
- Reference to this URL [3] in tests. This gives a 404 so I’m not sure if those 
test pass. there are also there reference to http://dubbo.io.

Thanks,
Justin

1. ./apache-dubbo-2.7.4-src/licenseCheck.sh
2. http://b2b-doc.alibaba-inc.com/display/RC/dubbo_devguide.htm
3. http://dubbo.io/logo.png
4. 
./apache-dubbo-2.7.4-src/dubbo-config/dubbo-config-spring/src/main/java/org/apache/dubbo/config/spring/util/AnnotationUtils.java
5. 
https://github.com/alibaba/spring-context-support/blob/1.0.2/src/main/java/com/alibaba/spring/util/AnnotationUtils.java
6. https://github.com/alibaba/spring-context-support/blob/1.0.2/LICENSE
7. https://apache.org/legal/resolved.html#category-x
8. 
./apache-dubbo-2.7.4-src/dubbo-config/dubbo-config-spring/src/main/java/org/apache/dubbo/config/spring/util/ClassUtils.java
9. 
https://github.com/alibaba/spring-context-support/tree/1.0.2/src/main/java/com/alibaba/spring/util

Re: [apache/dubbo] Release dubbo-2.7.4 - apache-dubbo-2.7.4

[Justin Mclean]

Hi,

> I got this email. I see 2.7.4 is still under the release vote process.
> The release note should be in draft state until it is approved by the
> community vote.

I’ve marked it as “pre-release”.

Under no circumstances should software be provided to the general public that 
have not gone though the voting process. [1]

Thanks,
Justin

1. http://www.apache.org/legal/release-policy.html#publication

Re: [VOTE]: Release Apache dubbo-go v1.1.0 RC2

[Justin Mclean]

Hi,

> Since Justin suggests you to put all artifacts in RC2 directory, you may
> not consider this email as an official vote, but I did spend a little time
> on sanity check against your second release.

While potentially confusing, I would leave this vote open and treat it as 
“official”. Take my suggestions as improvements for next time.

> For the source code, it looks fine except for one file:
> protocol/mock/mock_invoker.go doesn't have apache license header though
> it's generated by tools. You may consider to add one.

Generated files don’t need headers, but you could add one if you want. Either 
way it’s not a release blocker.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo-go v1.1.0

[Justin Mclean]

HI,

> I really do not have so much experience how to release an apache package.
> It just is my fault. May I suggest that let we close this vote this time?

Votes should stay open for a minimum of 72 hours, votes pass when you get 3 +1 
votes from PMC members (and there’s more +1 votes than -1 votes).

You don’t have to fix every tiny issue and start again, the release just needs 
to follow policy and be better than the last one. A lot of minor issues are fix 
in the next release sort of things.

You should close an existing vote before starting a new one.

The PMC can help here, just ask them on the mailing list, if you are unsure 
about anything. Perhaps for your first release it would be better for someone 
who has been a release manager before to run it?

Thanks,
Justin

Re: [VOTE]: Release Apache dubbo-go v1.1.0 RC2

[Justin Mclean]

Hi,

> This is a call for vote to release Apache Dubbo-go version v1.1.0 RC2.
> The release candidates:
> https://dist.apache.org/repos/dist/dev/dubbo/dubbo-go/1.1.0/

Please don’t overwrite the exacting artefact being voted on as we then have no 
way of knowing which they voted on. They could also be cached and people get 
the wrong ones. It’s best to make a RC1, RC2 etc etc directory and put the 
release in that.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo-go v1.1.0

[Justin Mclean]

Hi,

> Alex, you need to initial the release vote again, see: dubbo-go 1.1.0 RC2

Why is that? This vote hasn’t finished yet and so far only have +1 votes. I’ve 
not checked how many are from the PMC but it may be that this votes has passed.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo-go v1.1.0

[Justin Mclean]

Hi,

> You need to fix the license header issue Justin points out.

Well my question also needs to be answered is it just a missing header (a minor 
issues) or is it 3rd party software (a more serious issue).

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo-go v1.1.0

[Justin Mclean]

Hi,

I’m still seeing a lot of +1’s without saying what was checked, if you vote 
please list what you checked as it helps other people know where to look. If 
also expected that people will compile and test it and report back if there are 
any issues outside of what’s the ASF requires for a release.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo-go v1.1.0

[Justin Mclean]

Hi,

Great improvement over the previous release but there are still issues from the 
last vote that have not been resolved. e.g. [6][7][8]

Can someone tell me if these files [1][2][3][4][5] are just missing ASF headers 
or have a different license?

If they are just missing headers and [6][7][8] explained then it +1 form me, 
otherwise it’s probably a -1.

Can people please carefully check the contents, and write down what you 
checked, rather than just saying +1.

I checked:
- signatures and hashes good
- LICENSE is missing the appendix (not a major issue)
- LICENSE may be is missing some information[1][2][3][4][5]
- NOTICE is fine
- No binaries in source release
- Some files are missing ASF headers or other license headers [1][2][3][4][5] - 
please fix

Thanks,
Justin

1. dubbo-go-1.1.0/cluster/loadbalance/round_robin_test.go
2. dubbo-go-1.1.0/common/extension/router_factory.go
3. dubbo-go-1.1.0/config_center/configuration_parser.go
4. dubbo-go-1.1.0/config_center/configuration_parser_test.go
5. dubbo-go-1.1.0/registry/zookeeper/listener_test.go
6. dubbo-go-1.1.0/cluster/loadbalance/least_active.go
7. dubbo-go-1.1.0/protocol/RpcStatus.go
8. dubbo-go-1.1.0/filter/impl/active_filter.go

Re: dubbogo v1.1.0

[Justin Mclean]

Hi,

What's going on here? I don’t see any more votes or the vote being cancelled. 

If there is conversation happening about this elsewhere please bring it back to 
the list.

Thanks,
Justin

Re: [DISCUSS] Integrated ICE

[Justin Mclean]

Hi,

Who is the IP owner of the code? We would need a signed ICLA (if one hasn’t 
been signed already) and most likely a software grant [1] for this to be 
donated.

Thanks,
Justin

1. https://www.apache.org/licenses/contributor-agreements.html

Re: dubbogo v1.1.0

[Justin Mclean]

Hi,

-1 (binding) due to binaries in source release and unknown license issues

It’s a good idea to put [VOTE]” is the subject title so people know it’s a vote 
and to give the artifacts a release candidate name. e.g. RC1, RC2 etc so it 
doesn’t become confusing release candidate which you are voting on.

I checked:
- signatures and hashes correct
- LICENSE and NOTICE exist
- I think 3rd party license information is missing from LICENSE
- A large number of source files are missing ASF headers e.g. [1][2]
- There are unexpected binaries in the source release [3][4][5][6]. ASF release 
sneed to consist of source code and contain no compiled code.

LICENSE seem to be missing included 3rd party licensed code. For instance there 
are a number of files with "Copyright 1999-2011 Alibaba Group.” e.g [7][8]. 
That second file seem to come from here [9] and is MIT licensed so this file 
also has the incorrect header. This is code form here [10] of unknown license. 
These files [11][12][13] seem to have a different author, how are they 
licensed? As do these two files [14][15] which seem to come from here [16] and 
I’m not sure of their license.

There’s a minor issue with LICENSE in that it should not include "Copyright (c) 
2016 ~ 2018 Alex Stocks."

Thanks,
Justin

1. dubbo-go-1.1.0/cluster/loadbalance/least_active_test.go
2. dubbo-go-1.1.0/examples/dubbo/go-client/assembly/common/build.sh
3. 
dubbo-go-1.1.0/config_center/zookeeper/zookeeper-4unitest/contrib/fatjar/zookeeper-3.4.9-fatjar.jar
4. 
dubbo-go-1.1.0/registry/zookeeper/zookeeper-4unitest/contrib/fatjar/zookeeper-3.4.9-fatjar.jar
5. 
dubbo-go-1.1.0/remoting/zookeeper/zookeeper-4unitest/contrib/fatjar/zookeeper-3.4.9-fatjar.jar
6. dubbo-go-1.1.0/examples/dubbo/go-server/app/app
7. ./examples/jsonrpc/java-client/src/main/resources/META-INF/spring/service.xml
8. 
./examples/jsonrpc/java-client/src/main/java/com/ikurento/user/UserProvider.java
9. https://github.com/JoeCao/dubbo_jsonrpc_example/
10. http://big-elephants.com/2016-12/fasthttp-client/
11../cluster/loadbalance/least_active.go
12 ./protocol/RpcStatus.go
13../filter/impl/active_filter.go
14. ./examples/jsonrpc/java-client/src/main/java/com/ikurento/user/Consumer.java
15../examples/dubbo/java-client/src/main/java/com/ikurento/user/Consumer.java
16. https://github.com/baozh?tab=repositories

Re: dubbogo v1.1.0

[Justin Mclean]

Hi,

Sorry, the email was oddly formatted and the GitHub link more prominent. Sorry 
for the noise.

Thanks,
Justin

Re: dubbogo v1.1.0

[Justin Mclean]

Hi,

> Hello Dubbo/Dubbogo Community, This is a call for vote to release Apache 
> Dubbo-go version 1.1.0. The release candidates: 
> https://dist.apache.org/repos/dist/dev/dubbo/dubbo-go/1.1.0/ 
>  Git tag for 
> the release:
> 
> https://github.com/apache/dubbo-go/tree/1.1.0 
> 

A release candidate must be placed here [1]

Thanks,
Justin

1. https://dist.apache.org/repos/dist/dev/dubbo/

Release locations

[Justin Mclean]

HI,

I was creating the incubator report and noticed this check in:
r34927 | mercyblitz | 2019-07-19 13:04:04 +1000 (Fri, 19 Jul 2019) | 1 line
Changed paths:
   A /release/incubator/dubbo/2.6.7
   A /release/incubator/dubbo/2.6.7/apache-dubbo-2.6.7-bin-release.zip
   A /release/incubator/dubbo/2.6.7/apache-dubbo-2.6.7-bin-release.zip.asc
   A /release/incubator/dubbo/2.6.7/apache-dubbo-2.6.7-bin-release.zip.sha512
   A /release/incubator/dubbo/2.6.7/apache-dubbo-2.6.7-source-release.zip

As dubbo is no longer an incubating project releases should not be placed there 
but should go here [1]

Thanks,
Justin

1. https://dist.apache.org/repos/dist/release/dubbo/

Re: [VOTE]: Release Apache Dubbo Spring Boot 2.7.3 [RC1]

[Justin Mclean]

Hi,

+1 (binding)

I checked:
- signatures and hashes are good
- LICENSE is fine
- NOTICE still mentions incubating there no need to do that
- All source files have ASF headers
- No unexpected binary files
-Can compile from source

The DISCLAIMER is no longer required as this is not an incubating project 
anymore.

Thanks,
Justin

Re: dubbogo v1.1.0

[Justin Mclean]

Hi,

You actually need a release artefact to vote one, we cannot not vote a git tag. 

The releases need to placed in the offical release area and be signed and have 
hashes.

People who been involved in previous Dubbo releases can help you here, ask them 
for advice.

Thanks,
Justin

Re: Binary distribution files for 2.6.7 release

[Justin Mclean]

Hi, 

Ad that way is can be easily confirmed that they were build from the source 
code.

Thanks,
Justin

Re: Binary distribution files for 2.6.7 release

[Justin Mclean]

HI,

> The binary files were added to the release branch of svn after the voting
> stage.

While ASF projects only release source, in future it’s probably best to vote on 
them at the same time.

The LICENSE and NOTICE files for instance may need be different.

Thanks,
Justin

Re: dubbogo/hessian2 is ready for transfering now

[Justin Mclean]

HI,

> All authors agree to change the headers, could I change it now?

As I said IMO it's better done after the donation that way the original 
copyright is recorded in an ASF repo.

Currently there is no NOTICE file in which the move that information to (which 
is an ASF requirement).

Thanks,
Justin

Re: dubbogo/hessian2 is ready for transfering now

[Justin Mclean]

Hi,

> Is it better to change the header to standard Apache license header
> before donation?

Headers should never be changed without the express permission of the author. I 
would change them (and relocate the copyrights to NOTICE) after the donation 
has happened.

Thanks,
Justin

Re: dubbogo/hessian2 is ready for transfering now

[Justin Mclean]

Hi,

Which leaves these unaccounted for:

// Copyright 2016-2019 ckex...@vip.qq.com
// Copyright 2016-2019 rzy1...@163.com
// Copyright 2016-2019 summerbu...@gmail.com

Well they might match but it’s hard to tell, for instance Liam Chen might be 
summerbu...@gmail.com or that could be someone else. Probably best to not use 
email addresses in copyright lines.

Thanks,
Justin

Re: dubbogo/hessian2 is ready for transfering now

[Justin Mclean]

Hi,

I also note it hard to match the copyright names to contributors on the project:
https://github.com/dubbogo/hessian2/graphs/contributors

Is this documented somewhere?

Thanks,
Justin

Re: dubbogo/hessian2 is ready for transfering now

[Justin Mclean]

Hi,

> * Check and make sure that for all items included with the
> distribution that is not under the Apache license, we have the right
> to combine with Apache-licensed code and redistribute.
> * Check and make sure that all items depended upon by the project is
> covered by one or more of the following approved licenses: Apache,
> BSD, Artistic, MIT/X, MIT/W3C, MPL 1.1, or something with essentially
> the same terms.

Most files have an ALv2 with a header on them. There doesn’t seem to be any 3rd 
party files under a different license.

There a number of copyright statements:

// Copyright 2016-2019 Alex Stocks 
// Copyright 2016-2019 Alex Stocks, Wongoo
// Copyright 2016-2019 Alex Stocks, Wongoo, Yincheng Fang
// Copyright 2016-2019 Alex Stocks, Xinge Gao 
// Copyright 2016-2019 Alex Stocks, Yincheng Fang
// Copyright 2016-2019 Yincheng Fang
// Copyright 2016-2019 aliiohs
// Copyright 2016-2019 ckex...@vip.qq.com
// Copyright 2016-2019 comdd
// Copyright 2016-2019 rzy1...@163.com
// Copyright 2016-2019 summerbu...@gmail.com
// Copyright 2016-2019 tianying Pan
// Copyright 2019 Wongoo
// Copyright 2019 Wongoo, Yincheng Fang
// Copyright 2019 Xinge Gao

Do we have ICLA from all of these people?

I notice a number of changes  to files changed the copyright owner and some 
headers were only added very recently [1][2][3][4]. In particular as in some 
cases the header was not added by the copyright owner. This seems a little 
unusual to me.

Three file are missing headers and could possible come from somewhere?
  ./test_hessian/src/main/java/test/tuple/Tuple.java
  ./test_hessian/src/main/java/test/tuple/TupleProvider.java
  ./test_hessian/src/main/java/test/tuple/TupleProviderImpl.java

Are we confident that all code was created at the project and nothing was 
copied from elsewhere, like stack overflow or another project?

Thanks,
Justin

1. 
https://github.com/dubbogo/hessian2/commit/7b15c9ad47982a3dab4b4680eae604cce85ccc81
2. 
https://github.com/dubbogo/hessian2/commit/7653505e00b10a2e04bfdd29bce62f3dbba556ad
3. 
https://github.com/dubbogo/hessian2/commit/8e29a88ad302577b189976706ec008c4fee54cee
4. 
https://github.com/dubbogo/hessian2/commit/d4fd44047dfd6c148a8065e754278e9c5dce869e

Re: dubbogo/hessian2 is ready for transfering now

[Justin Mclean]

Hi,

> With ICLA signed and SGA not necessary to sign

Why do you think a SGA is not needed?

Thanks,
Justin