Fwd: Signing releases using automated release infra

2023-07-18 Thread Ayush Saxena
JFYI.
Maybe worth exploring

-Ayush

Begin forwarded message:

> From: Volkan Yazıcı 
> Date: 19 July 2023 at 1:24:49 AM IST
> To: d...@community.apache.org
> Subject: Signing releases using automated release infra
> Reply-To: d...@community.apache.org
> 
> Abstract: Signing release artifacts using an automated release
> infrastructure has been officially approved by LEGAL. This enables
> projects to sign artifacts using, say, GitHub Actions.
> 
> I have been trying to overhaul the Log4j release process and make it
> as frictionless as possible since last year. As a part of that effort,
> I wanted to sign artifacts in CI during deployment and in a
> `members@a.o` thread[0] I explained how one can do that securely with
> the help of Infra. That was in December 2022. It has been a long,
> rough journey, but we succeeded. In this PR[1], Legal has updated the
> release policy to reflect that this process is officially allowed.
> Further, Infra put together guides[2][3] to assist projects. Logging
> Services PMC has already successfully performed 4 Log4j Tools releases
> using this approach, see its release process[4] for a demonstration.
> 
> [0] (members only!)
> https://lists.apache.org/thread/1o12mkjrhyl45f9pof94pskg55vhs61n
> [1] https://github.com/apache/www-site/pull/235
> [2] https://infra.apache.org/release-publishing.html#signing
> [3] https://infra.apache.org/release-signing.html#automated-release-signing
> [4] https://github.com/apache/logging-log4j-tools/blob/master/RELEASING.adoc
> 
> # F.A.Q.
> 
> ## Why shall a project be interested in this?
> 
> It greatly simplifies the release process. See Log4j Tools release
> process[4], probably the simplest among all Java-based ASF projects.
> 
> ## How can a project get started?
> 
> 1. Make sure your project builds are reproducible (otherwise there is
> no way PMC can verify the integrity of CI-produced and -signed
> artifacts)
> 2. Clone and adapt INFRA-23996 (GPG keys in GitHub secrets)
> 3. Clone and adapt INFRA-23974 (Nexus creds. in GitHub secrets for
> snapshot deployments)
> 4. Clone and adapt INFRA-24051 (Nexus creds. in GitHub secrets for
> staging deployments)
> 
> You might also want to check this[5] GitHub Action workflow for inspiration.
> 
> [5] 
> https://github.com/apache/logging-log4j-tools/blob/master/.github/workflows/build.yml
> 
> ## Does the "automated release infrastructure" (CI) perform the full release?
> 
> No. CI *only* uploads signed artifacts to Nexus. The release manager
> (RM) still needs to copy the CI-generated files to SVN, PMC needs to
> vote, and, upon consensus, RM needs to "close" the release in Nexus
> and so on.
> 
> -
> To unsubscribe, e-mail: dev-unsubscr...@community.apache.org
> For additional commands, e-mail: dev-h...@community.apache.org
> 


Re: [DISCUSS] HIVE 4.0.0 GA Release Proposal

2023-07-18 Thread Stamatis Zampetakis
HIVE-27504 still lacks reviews from committers.

Note that I will not be able to work on the release from 22/07 to
30/07. If HIVE-27504 does not land in the next day or two the beta-1
release might get delayed unless someone else picks up the RM role and
cuts the RC.

Best,
Stamatis

On Thu, Jul 13, 2023 at 6:33 PM Attila Turoczy
 wrote:
>
> Thanks for the update! Can't wait for the beta :)
>
> -Attila
>
> On Thu, Jul 13, 2023 at 5:19 PM Stamatis Zampetakis 
> wrote:
>
> > Hey everyone,
> >
> > As you may have noticed there have been various tickets around LICENSE
> > and NOTICE files popping up recently. I just logged HIVE-27504 [1]
> > which hopefully addresses all remaining issues that were found while I
> > was working with the RC. After this gets resolved we should be good to
> > go for putting up the RC for vote.
> >
> > The structure and content of the LICENSE and NOTICE file are very
> > important for Apache releases so I would encourage other members of
> > the community (especially PMC) to review the latest changes and
> > current status and raise new JIRA tickets if they discover some
> > problems. I would like to avoid having last minute -1 votes due to
> > that.
> >
> > Best,
> > Stamatis
> >
> > [1] https://issues.apache.org/jira/browse/HIVE-27504
> >
> > On Tue, Jun 20, 2023 at 11:09 PM Stamatis Zampetakis 
> > wrote:
> > >
> > > Hey team,
> > >
> > > Small heads up regarding the progress of the 4.0.0-beta-1 release.
> > >
> > > Most of the release steps went out smoothly and I was able to get an
> > > RC0 ready [1].
> > >
> > > However, I am afraid that our binary distribution does not comply
> > > fully with the ASF Policy [2]. We bundle a lot of dependencies (jars)
> > > within and I am not sure if we are fully covered in terms of licenses
> > > and notice files. Thanks Ayush for reminding me to check the
> > > binary-package-licenses directory [5].
> > >
> > > I am checking various resources such as [3, 4] to see what additional
> > > steps we can take to be on the safe side and also looking for ways to
> > > automate this so that we don't have to manually inspect the jars on
> > > every release. I was playing a bit with license-maven-plugin [6] but I
> > > am not yet completely happy with its output.
> > >
> > > The next few days will be a bit busy so most likely I will get back on
> > > this during the weekend. If people have feedback or other ideas to
> > > share please let me know.
> > >
> > > Best,
> > > Stamatis
> > >
> > > [1] https://people.apache.org/~zabetak/apache-hive-4.0.0-beta-1-rc0/
> > > [2]
> > https://www.apache.org/legal/src-headers.html#asf-source-header-and-copyright-notice-policy
> > > [3] https://infra.apache.org/licensing-howto.html
> > > [4] https://www.apache.org/legal/resolved.html
> > > [5] https://github.com/apache/hive/tree/master/binary-package-licenses
> > > [6] https://www.mojohaus.org/license-maven-plugin/
> > >
> > >
> > > On Fri, Jun 2, 2023 at 10:03 PM Stamatis Zampetakis 
> > wrote:
> > > >
> > > > I can start preparing the RC towards the end of next week. If somebody
> > > > has more time and wants to start earlier I am fine to switch.
> > > >
> > > > Best,
> > > > Stamatis
> > > >
> > > > On Fri, Jun 2, 2023 at 5:36 PM Denys Kuzmenko 
> > wrote:
> > > > >
> > > > > great, this is the current list of release managers:
> > > > >
> > > > > 4.0.0 Stamatis Zampetakis
> > > > > 4.1.0 Denys Kuzmenko
> > > > > 4.2.0 Sai Hemanth Gantasala
> > > > >
> > > > > Should we keep the same RM order and just shift the releases or find
> > a volunteer for the 4.0.0-beta release, WDYT?
> > > > >
> > > > >
> >