Re: [VOTE] Release of Apache Tephra-0.14.0-incubating [rc1]
+1 (binding) Things look good for the most part, a few things I noticed which can be fixed next release: * NOTICE needs an updated copyright year * `mvn apache-rat:check` fails on the below files apache-tephra-0.14.0-incubating/tephra-distribution/licenses/Aopa.PL apache-tephra-0.14.0-incubating/tephra-distribution/licenses/Asm.BSD apache-tephra-0.14.0-incubating/tephra-distribution/licenses/JLine.BSD apache-tephra-0.14.0-incubating/tephra-distribution/licenses/Logback.EPL apache-tephra-0.14.0-incubating/tephra-distribution/NOTICE_BINARY On 5/21/18 6:51 PM, James Taylor wrote: Hi all, This is a call for a vote on releasing Apache Tephra 0.14.0-incubating, release candidate 1. This is the seventh release of Tephra. The Tephra dev community has voted on and approved a proposal to release Tephra 0.14.0-incubating, release candidate 1. PPMC Vote Call: https://s.apache.org/jWVD PPMC Vote Result: https://s.apache.org/zwog The source tarball, including signatures, digests, etc. can be found at: https://dist.apache.org/repos/dist/dev/incubator/tephra/0.14.0-incubating-rc1/src The tag to be voted upon is v0.14.0-incubating: https://git-wip-us.apache.org/repos/asf?p=incubator-tephra.git;a=shortlog;h=refs/tags/v0.14.0-incubating The release hash is e93942adae0ece286157a8f6a2e5c63b53669e03: https://git-wip-us.apache.org/repos/asf?p=incubator-tephra.git;a=commit;h=e93942adae0ece286157a8f6a2e5c63b53669e03 The Nexus Staging URL: https://repository.apache.org/content/repositories/orgapachetephra-1011 Release artifacts are signed with the following key: http://people.apache.org/keys/committer/jamestaylor KEYS file available: https://dist.apache.org/repos/dist/dev/incubator/tephra/KEYS For information about the contents of this release, see: https://dist.apache.org/repos/dist/dev/incubator/tephra/0.14.0-incubating-rc1/CHANGES.txt Please vote on releasing this package as Apache Tephra 0.14.0-incubating The vote will be open for 72 hours. [ ] +1 Release this package as Apache Tephra 0.14.0-incubating [ ] +0 no opinion [ ] -1 Do not release this package because ... Thanks, James - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: Minified Javascript in source releases (was Re: [VOTE] Release Apache ECharts (incubating) 4.1.0.rc3)
On Mon, May 21, 2018, 21:12 Justin Mcleanwrote: > Hi, > > > Why does this need to be included at all? Why not just provide a pointer > to > > the canonical minified version? > > Most common occurrence (off the top of my head) is a minified version of > bootstrap for project site / documentations. So your view is that that > shouldn’t be included in a source release? > Sure. D3 and jQuery will wind up in the same boat. I would not go so far as to emphatically say not to include them, but I don't see the real need to include them given that they are so easily downloadable. A URL and a checksum keeps the distro clean. >
Re: [VOTE] Release of Apache Tephra-0.14.0-incubating [rc1]
On 21 May 2018 at 23:51, James Taylorwrote: > Hi all, > > This is a call for a vote on releasing Apache Tephra 0.14.0-incubating, > release candidate 1. This is the seventh release of Tephra. The Tephra dev > community has voted on and approved a proposal to release Tephra > 0.14.0-incubating, release candidate 1. > > PPMC Vote Call: https://s.apache.org/jWVD > > PPMC Vote Result: https://s.apache.org/zwog > > The source tarball, including signatures, digests, etc. can be found at: > https://dist.apache.org/repos/dist/dev/incubator/tephra/0.14.0-incubating-rc1/src MD5 hashes are deprecated and should not be used for new releases. > The tag to be voted upon is v0.14.0-incubating: > https://git-wip-us.apache.org/repos/asf?p=incubator-tephra.git;a=shortlog;h=refs/tags/v0.14.0-incubating > > The release hash is e93942adae0ece286157a8f6a2e5c63b53669e03: > https://git-wip-us.apache.org/repos/asf?p=incubator-tephra.git;a=commit;h=e93942adae0ece286157a8f6a2e5c63b53669e03 > > The Nexus Staging URL: > https://repository.apache.org/content/repositories/orgapachetephra-1011 > > Release artifacts are signed with the following key: > http://people.apache.org/keys/committer/jamestaylor > > KEYS file available: > https://dist.apache.org/repos/dist/dev/incubator/tephra/KEYS > > For information about the contents of this release, see: > https://dist.apache.org/repos/dist/dev/incubator/tephra/0.14.0-incubating-rc1/CHANGES.txt > > Please vote on releasing this package as Apache Tephra 0.14.0-incubating > > The vote will be open for 72 hours. (at least) > > [ ] +1 Release this package as Apache Tephra 0.14.0-incubating > [ ] +0 no opinion > [ ] -1 Do not release this package because ... > > Thanks, > James - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
[VOTE] Release of Apache Tephra-0.14.0-incubating [rc1]
Hi all, This is a call for a vote on releasing Apache Tephra 0.14.0-incubating, release candidate 1. This is the seventh release of Tephra. The Tephra dev community has voted on and approved a proposal to release Tephra 0.14.0-incubating, release candidate 1. PPMC Vote Call: https://s.apache.org/jWVD PPMC Vote Result: https://s.apache.org/zwog The source tarball, including signatures, digests, etc. can be found at: https://dist.apache.org/repos/dist/dev/incubator/tephra/0.14.0-incubating-rc1/src The tag to be voted upon is v0.14.0-incubating: https://git-wip-us.apache.org/repos/asf?p=incubator-tephra.git;a=shortlog;h=refs/tags/v0.14.0-incubating The release hash is e93942adae0ece286157a8f6a2e5c63b53669e03: https://git-wip-us.apache.org/repos/asf?p=incubator-tephra.git;a=commit;h=e93942adae0ece286157a8f6a2e5c63b53669e03 The Nexus Staging URL: https://repository.apache.org/content/repositories/orgapachetephra-1011 Release artifacts are signed with the following key: http://people.apache.org/keys/committer/jamestaylor KEYS file available: https://dist.apache.org/repos/dist/dev/incubator/tephra/KEYS For information about the contents of this release, see: https://dist.apache.org/repos/dist/dev/incubator/tephra/0.14.0-incubating-rc1/CHANGES.txt Please vote on releasing this package as Apache Tephra 0.14.0-incubating The vote will be open for 72 hours. [ ] +1 Release this package as Apache Tephra 0.14.0-incubating [ ] +0 no opinion [ ] -1 Do not release this package because ... Thanks, James
Re: [VOTE] Release Apache Omid 0.9.0.0 (incubating)
+1 (transferring my vote over from dev list vote) On Mon, May 21, 2018 at 12:39 PM, Ohad Shachamwrote: > Hi, > > > The Apache Omid community has voted on and approved a proposal > to release Apache Omid 0.9.0.0-incubating. > > PPMC Vote Call:http://mail-archives.apache.org/mod_mbox/omid-dev/ > 201805.mbox/%3cCAHuxFyOJZ8=Ud2xUQ2DRbGPZZnoQpVAUnBxPXwYO5 > gs_xr+...@mail.gmail.com%3e > > > PPMC Vote Result: > > http://mail-archives.apache.org/mod_mbox/omid-dev/201805. > mbox/%3cCANQiJeUua0BiH+MAsqPirN2UTRFnF7dcE+iPyLYjA6eA03txLg@mail.gmail. > com%3e > > > PPMC Vote Summary: > 3 binding (IPMC member) +1 votes > 0 non-binding PPMC member +1 votes > No -1 votes > > Release notes for the 0.9.0.0 > release:https://dist.apache.org/repos/dist/dev/incubator/ > omid/0.9.0.0-rc3/RELEASE_NOTES.html > > > Git tag for the release: > > https://git-wip-us.apache.org/repos/asf/incubator-omid.git/? > p=incubator-omid.git;a=tag;h=229831bc377e47431cc7cbc211803069158b5711 > > > Sources for the release: > > https://dist.apache.org/repos/dist/dev/incubator/omid/0.9.0. > 0-rc3/apache-omid-incubating-0.9.0.0-src.tar.gz > > > Source release verification: PGP Signature: > > https://dist.apache.org/repos/dist/dev/incubator/omid/0.9.0. > 0-rc3/apache-omid-incubating-0.9.0.0-src.tar.gz.asc > > > SHA512 Hash: > > https://dist.apache.org/repos/dist/dev/incubator/omid/0.9.0. > 0-rc3/apache-omid-incubating-0.9.0.0-src.tar.gz.sha512 > > > Keys to verify the signature of the release artifact are available at: > > https://dist.apache.org/repos/dist/dev/incubator/omid/0.9.0.0-rc3/KEYS > > > We request the permission of IPMC to publish the above release candidate as > Apache Omid 0.9.0.0-incubating. Please try out the package and vote. The > vote is open for a minimum of 72 hours or until the necessary number of > votes (3 binding +1s) is reached. [ ] +1 Release this package as Apache > Omid 0.9.0.0-incubating [ ] 0 I don't feel strongly about it, but I'm okay > with the release [ ] -1 Do not release this package because... Please add > (binding) if your vote is binding. > > > Thanks, > Ohad >
Re: [VOTE] Release Apache NetBeans 9.0 RC1 (incubating) rc1
On Mon, May 21, 2018 at 10:20 PM, Justin Mcleanwrote: > Hi, > > > Quote from Apache Legal FAQ: > > https://www.apache.org/legal/resolved.html#prohibited > > > > "[...] For example, using a GPL'ed tool during the build is OK, however > > including GPL'ed source code is not.[...]" > > > > Apache Netbeans uses external tools when building and at least GPLv2- > > CP > > code is used. The license is referred to by the > > /external/-license.txt file. That file holds > > additional meta data for the dependency. > > Why include the license of something that is not bundled in the release? > Regarding nbbuild/licenses/GPL-2-CP and its copies in a handful of */external/*-license.txt files (which are AFAIK used only for compile-time/optional dependencies), it seems to me that marking those with licenses helps with proper handling of licenses. I.e., we could leave the dependencies without specifying a license, but: -what if someone is interested to know what is the license of the compile-time dependency? Do they need to investigate on their own? -what we would write these compile-time dependencies to the DEPENDENCIES file? Or should we eliminate the "Compile time dependencies" from the file altogether? So, overall, it seems to me it is a better service for the users of the release to have the license included, than to hide it? (Please note that this license is, AFAIK, not included or referred to from the LICENSE file for neither the release nor the convenience binaries.) Jan > Thanks, > Justin > > - > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > For additional commands, e-mail: general-h...@incubator.apache.org > >
Re: [VOTE]: Release Apache Dubbo (Incubating) 2.6.2 [RC1]
On 21 May 2018 at 21:16, Justin Mcleanwrote: > Hi, > >> I don't think there should be anything in the source release that is >> not in the source repo. > > It reasonably common (from my review of 100’s of releases) that the build > process may modify and/or add some files (e.g config files). I wouldn’t > expect any code to change or be added. It's also important that there is nothing in the release tar that is not in the source repo or which cannot be readily derived from it (though that is too broad an exception). I have seen release tars that include spurious files that happened to be present in the workspace. In one case a file held private information. Your original mail said: >>> Which is OK many project release are not 100% identical to what is in the >>> release tar what is important is that none of the source code has changed. This could be taken to mean that it does not matter what goes into the release tar other than the source files. I think it's important to be clear that the release tar should have minimal changes from the source repo, and what sort of changes are allowed. > Thanks, > Justin - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: [VOTE] Retire the Slider podling
+1 (binding). With YARN services in Apache Hadoop 3.1 release, there is a good path forward. Thanks +Vind > On May 20, 2018, at 10:59 AM, Billie Rinaldiwrote: > > After a long period of low activity, the Slider PPMC has recently decided > upon retirement [1]. Please vote on whether we should retire the Slider > podling. Here is my +1 (binding). > > [ ] +1 Retire Slider > [ ] +0 No opinion > [ ] -1 Do not retire Slider because ... > > This vote will remain open for 72 hours. > > [1]: https://s.apache.org/V8SB - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: [VOTE] Release Apache NetBeans 9.0 RC1 (incubating) rc1
Hi, > Quote from Apache Legal FAQ: > https://www.apache.org/legal/resolved.html#prohibited > > "[...] For example, using a GPL'ed tool during the build is OK, however > including GPL'ed source code is not.[...]" > > Apache Netbeans uses external tools when building and at least GPLv2- > CP > code is used. The license is referred to by the > /external/-license.txt file. That file holds > additional meta data for the dependency. Why include the license of something that is not bundled in the release? Thanks, Justin - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: [VOTE]: Release Apache Dubbo (Incubating) 2.6.2 [RC1]
Hi, > I don't think there should be anything in the source release that is > not in the source repo. It reasonably common (from my review of 100’s of releases) that the build process may modify and/or add some files (e.g config files). I wouldn’t expect any code to change or be added. Thanks, Justin
Re: Minified Javascript in source releases (was Re: [VOTE] Release Apache ECharts (incubating) 4.1.0.rc3)
Hi, > Why does this need to be included at all? Why not just provide a pointer to > the canonical minified version? Most common occurrence (off the top of my head) is a minified version of bootstrap for project site / documentations. So your view is that that shouldn’t be included in a source release? Thanks, Justin
[VOTE] Release Apache Omid 0.9.0.0 (incubating)
Hi, The Apache Omid community has voted on and approved a proposal to release Apache Omid 0.9.0.0-incubating. PPMC Vote Call:http://mail-archives.apache.org/mod_mbox/omid-dev/201805.mbox/%3cCAHuxFyOJZ8=ud2xuq2drbgpzznoqpvaunbxpxwyo5gs_xr+...@mail.gmail.com%3e PPMC Vote Result: http://mail-archives.apache.org/mod_mbox/omid-dev/201805.mbox/%3ccanqijeuua0bih+masqpirn2utrfnf7dce+ipylyja6ea03t...@mail.gmail.com%3e PPMC Vote Summary: 3 binding (IPMC member) +1 votes 0 non-binding PPMC member +1 votes No -1 votes Release notes for the 0.9.0.0 release:https://dist.apache.org/repos/dist/dev/incubator/omid/0.9.0.0-rc3/RELEASE_NOTES.html Git tag for the release: https://git-wip-us.apache.org/repos/asf/incubator-omid.git/?p=incubator-omid.git;a=tag;h=229831bc377e47431cc7cbc211803069158b5711 Sources for the release: https://dist.apache.org/repos/dist/dev/incubator/omid/0.9.0.0-rc3/apache-omid-incubating-0.9.0.0-src.tar.gz Source release verification: PGP Signature: https://dist.apache.org/repos/dist/dev/incubator/omid/0.9.0.0-rc3/apache-omid-incubating-0.9.0.0-src.tar.gz.asc SHA512 Hash: https://dist.apache.org/repos/dist/dev/incubator/omid/0.9.0.0-rc3/apache-omid-incubating-0.9.0.0-src.tar.gz.sha512 Keys to verify the signature of the release artifact are available at: https://dist.apache.org/repos/dist/dev/incubator/omid/0.9.0.0-rc3/KEYS We request the permission of IPMC to publish the above release candidate as Apache Omid 0.9.0.0-incubating. Please try out the package and vote. The vote is open for a minimum of 72 hours or until the necessary number of votes (3 binding +1s) is reached. [ ] +1 Release this package as Apache Omid 0.9.0.0-incubating [ ] 0 I don't feel strongly about it, but I'm okay with the release [ ] -1 Do not release this package because... Please add (binding) if your vote is binding. Thanks, Ohad
Re: [VOTE] Retire the Slider podling
+1 (binding) Regards JB On 20/05/2018 19:59, Billie Rinaldi wrote: After a long period of low activity, the Slider PPMC has recently decided upon retirement [1]. Please vote on whether we should retire the Slider podling. Here is my +1 (binding). [ ] +1 Retire Slider [ ] +0 No opinion [ ] -1 Do not retire Slider because ... This vote will remain open for 72 hours. [1]: https://s.apache.org/V8SB - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: [VOTE] Retire the Slider podling
+1 On 21 May 2018 at 12:10, Josh Elserwrote: > +1 (binding) > > Thanks for pushing this to completion, Billie! > > > On 5/20/18 1:59 PM, Billie Rinaldi wrote: > >> After a long period of low activity, the Slider PPMC has recently decided >> upon retirement [1]. Please vote on whether we should retire the Slider >> podling. Here is my +1 (binding). >> >> [ ] +1 Retire Slider >> [ ] +0 No opinion >> [ ] -1 Do not retire Slider because ... >> >> This vote will remain open for 72 hours. >> >> [1]: https://s.apache.org/V8SB >> >> > - > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > For additional commands, e-mail: general-h...@incubator.apache.org > > -- Matt Sicker
Re: [VOTE] Retire the Slider podling
+1 (binding) Thanks for pushing this to completion, Billie! On 5/20/18 1:59 PM, Billie Rinaldi wrote: After a long period of low activity, the Slider PPMC has recently decided upon retirement [1]. Please vote on whether we should retire the Slider podling. Here is my +1 (binding). [ ] +1 Retire Slider [ ] +0 No opinion [ ] -1 Do not retire Slider because ... This vote will remain open for 72 hours. [1]: https://s.apache.org/V8SB - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: [VOTE]: Release Apache Dubbo (Incubating) 2.6.2 [RC1]
On 21 May 2018 at 08:59, Justin Mcleanwrote: > Hi, > >> As I cannot build the binary without doing some changes on the pom file, I >> had to vote -1 (binding) here. > > You don’t need to modify the pom file to compile you can specify > -Dcheckstyle.skip to compile id check style is acting up for you. > > Up to you if you want to vote -1 but I just want to remind people here > (mostly the Dubbo PMC who are new to this) that: > - a -1 vote is not a veto (but should be carefully considered) > - a release only need 3 +1 votes and more +1 than -1 to pass > - you can vote +0 or change you vote if you think the issue can be fixed next > release > >> 2. I checked the source zip[1], it is not same with github tag one[2]. >> There are some log files and empty directories which is not in the git >> repo, I guess it relates to the builder's workspace. > > Which is OK many project release are not 100% identical to what is in the > release tar what is important is that none of the source code has changed. Huh? I don't think there should be anything in the source release that is not in the source repo. > Thanks, > Justin > > > - > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > For additional commands, e-mail: general-h...@incubator.apache.org > - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: [VOTE] Release Apache SkyWalking (incubating) version 5.0.0-beta
The following are the version settings in the releasing step: 1. The version in sources and binaries to be such as: 5.0.0-beta 2. The tag in Github to be such as: 5.0.0-beta[RC1] If the vote accepted then create a new tag named 5.0.0-beta or change the tag from 5.0.0-beta[RC1] to 5.0.0-beta. If not, then (1) update the sources and binaries, keep version unchanged. (2) delete the tag 5.0.0-beta[RC1] (3) create a new tag 5.0.0-beta[RC2] and revote. So, If we do it as this steps. We can save the version number named 5.0.0-beta when vote not accept. — Yongsheng Peng Apache SkyWalking PPMC member > 在 2018年5月21日,21:23,Stian Soiland-Reyes写道: > > On Mon, 21 May 2018 15:31:49 +0800, "吴晟 Sheng Wu" > wrote: >> I understand in next time, we should add svn revision number. And do >> you suggest we should add checksum in the mail? > > Yes, checksums in the vote email can be good as they are easy to > cross-check, say if there is an RC2 vote followed by RC1, > a PMC member who accidentally tests the old one again would not get the > right checksum. > > > Another reason is archival - a checksum sent to the email list, while > unencrypted it is archived in multiple distributed archives and so > becomes a permanent record about the versioned archive the PMC > (eventually) publish and easy for anyone (say a Debian maintainer) to > check/hardcode independent of the more origin-centric GPG signature. > > > This would also make it easier to detect a 'rogue committer' (or more > likely a wrong command line) that publish something that was not voted > on. In the end the checksum files on the https://www.apache.org/dist/ > should then match a vote email. > (AFAIK, nobody has attempted to automate such a check :) > > > You have done well switching to secure sha512, but unlike say md5 and > sha1 these are unfortunately not so email-friendly due to long lines, > so if you want to try with sha512, sha512224, or fall back to sha1 for > votes.. I don't know what would be easiest for your project. > > So I would let that be up to the SkyWalking community to decide, but > IMHO at least one of either either svn revision or checksum should be in > the email so it's clear what is being voted on. :) > > > -- > Stian Soiland-Reyes > The University of Manchester > https://www.esciencelab.org.uk/ > https://orcid.org/-0001-9842-9718 > > > - > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > For additional commands, e-mail: general-h...@incubator.apache.org >
Re: [VOTE] Release Apache NetBeans 9.0 RC1 (incubating) rc1
Yes, I saw here http://www.apache.org/dev/release-publishing.html that > .md5's in dist.apache.org/repos/dist/release/ must be removed manually. And I was planning on doing just that after the vote. I've also wondered why we generate MD5s to begin with... I've added https://issues.apache.org/jira/browse/NETBEANS-821 to keep track of this. --emi ‐‐‐ Original Message ‐‐‐ On 21 May 2018 6:44 PM, sebbwrote: > On 20 May 2018 at 23:33, Emilian Bold emilian.b...@protonmail.ch wrote: > > > Hi all, > > > > The Apache NetBeans community has voted on and approved a proposal to > > release Apache NetBeans 9.0 RC1 (incubating) rc1. > > > > We now kindly request that the Incubator PMC members review and vote on > > this incubator release candidate. > > > > Apache NetBeans 9.0 RC1 (incubating) vote thread: > > > > https://lists.apache.org/thread.html/c2a06adc83e2819e6d96c7dff8d0e22a97001f99bfda12515d4d9609@ > > > > Apache NetBeans 9.0 RC1 (incubating) vote result thread: > > > > https://lists.apache.org/thread.html/94f7a5e4601e26c7edb8264df7df53dd8ed215ecfc568816a162f2af@ > > > > Apache NetBeans 9.0 RC1 (incubating) constitutes all the modules in the > > Apache NetBeans Git repo, which together provide the NetBeans Platform > > (i.e., the underlying application framework), as well as all the modules > > that provide the Java SE-related features of Apache NetBeans. > > > > In short, Apache NetBeans 9.0 RC1 (incubating) is a full IDE for Java SE > > development. > > > > Build artifacts available here: > > > > https://dist.apache.org/repos/dist/dev/incubator/netbeans/incubating-netbeans-java/incubating-9.0-rc1-rc1 > > MD5 hashes are deprecated and should not be used for new releases. > > They can just be removed from the dist dir (and download page). > > No need to redo the release, but please update scripts to stop creating them. > > > The specific artifact to be voted on: > > > > https://dist.apache.org/repos/dist/dev/incubator/netbeans/incubating-netbeans-java/incubating-9.0-rc1-rc1/incubating-netbeans-java-9.0-rc1-source.zip > > > > Included in the above are the DEPENDENCIES, DISCLAIMER, LICENSE, and NOTICE > > files, as well as a README file with build instructions, which are the same > > as these: > > > > https://github.com/apache/incubator-netbeans/blob/master/README.md > > > > SHA1: a1a265455c8246f849b14982fa3c36b351b21876 > > > > KEYS file: > > > > https://dist.apache.org/repos/dist/release/incubator/netbeans/KEYS > > > > Apache NetBeans Git Repo tag: 9.0-rc1-rc1: > > > > https://github.com/apache/incubator-netbeans/tree/9.0-rc1-rc1 > > > > Note: NetBeans license violation checks are managed via the > > rat-exclusions.txt file: > > > > https://github.com/apache/incubator-netbeans/blob/master/nbbuild/rat-exclusions.txt > > > > Rat report shows no unknown licenses, except for license files: > > > > https://builds.apache.org/job/incubator-netbeans-release/302/artifact/rat-java-temp/nbbuild/build/rat-report.txt > > > > The license files listed in the Rat report are known and an issue exists > > for solving this: > > > > https://issues.apache.org/jira/browse/NETBEANS-305 > > > > Included as a convenience binary, not relevant for the voting purposes > > (unzip it, run it and you'll see Apache NetBeans): > > > > https://dist.apache.org/repos/dist/dev/incubator/netbeans/incubating-netbeans-java/incubating-9.0-rc1-rc1/incubating-netbeans-java-9.0-rc1-bin.zip > > > > Also included as a convenience binary the NBMs: > > > > https://dist.apache.org/repos/dist/dev/incubator/netbeans/incubating-netbeans-java/incubating-9.0-rc1-rc1/nbms > > > > New & Noteworthy features of the 9.0 Release: > > > > https://cwiki.apache.org/confluence/display/NETBEANS/Apache+NetBeans+9.0+New+and+Noteworthy > > > > Release specific wiki page: > > > > https://cwiki.apache.org/confluence/display/NETBEANS/Apache+NetBeans+9.0+RC1 > > > > How (and what) to try out the release: > > > > 1. Download the artifact to be voted on and unzip it. > > 2. Build it using the README provided by the artifact. > > 3. Look in nbbuild/netbeans for the NetBeans installation created by the > > build process. > > 4. Run the NetBeans executable and (if you're running on JDK 8) you'll be > > prompted to install nb-javac, after agreeing to its licensing terms, and > > (if you're running on JDK 9), you'll be able to use javac directly from JDK > > 9 and, optionally, you'll be prompted to install nb-javac, after agreeing > > to its licensing terms. > > > > If the above succeeds, i.e., Apache NetBeans installs and starts up, you > > will have a development environment that complies with Apache IP > > requirements and you should vote +1 in this thread. > > > > Please try out the package, using the instructions above, and vote! > > > > The vote is open for 7 days > > > > [ ] +1 Release this package as Apache NetBeans 9.0 RC1 (incubating) > > > > [ ] 0 I don't feel strongly about
Re: [VOTE] Release Apache ECharts (incubating) 4.1.0.rc3
Mike and Ted, thanks a lot for your detailed explanation! I've been gradually understanding the way that the community thinks about the "release". And I will fix the artifact soon. Thanks, Shuang -- Su Shuang (100pah) -- 2018-05-21 14:01 GMT+08:00 Ted Dunning: > The general meaning of source code is that it is the artifact that people > will edit and which they can inspect by normal textual or graphical means > to ensure that there are no surprises. > > Javascript code that is minified or combined in any major way is much more > like binary code in that respect. It is true that somebody *could* inspect > the correlation, but it is not true that this inspection is either normally > done or easily done. > > As a rule of thumb, you should not include any artifacts that require more > work to verify than you expect nearly all release reviewers to do for > *every* release candidate. Usually that means that there are no derived > artifacts at all in a source release since that is the only case which is > easy for reviewers. > > > > On Sun, May 20, 2018 at 10:07 PM, SHUANG SU > wrote: > > > Thanks, Justin, > > > > I think I should remove the jar about rat from the artifact, and then > there > > is no binary code anymore. > > > > But I am puzzled about the definition of the term "compiled code". > > Generally, the JavaScript code does not need to be compiled to binary. > > The code in "dist/**" is also JavaScript code, which is combined to some > > single files > > and some of them are minified. And the ".map" file is provided for > mapping > > each term > > of the combined code to the original code in src/**. Without or without > the > > ".map", > > the combined code can be checked. > > I think this kind of combined code is not "compiled code", but I don't > know > > the formal definition > > about this case. > > > > Thanks, > > Shuang > > > > > > > > > > -- > > Su Shuang (100pah) > > -- > > > > > > 2018-05-21 5:31 GMT+08:00 Justin Mclean : > > > > > Hi, > > > > > > Releases at the ASF must not contain compiled code. You can if you want > > > also produce a conviance binary for users at the same time but the > source > > > release needs to contain no compiled code otherwise it's not open > source. > > > > > > Thanks, > > > Justin > > > > > > On Mon., 21 May 2018, 7:10 am SHUANG SU, > wrote: > > > > > > > Thanks, Willem. > > > > > > > > But I will explain the reason that provides an all-in-one artifact. > > > > > > > > I understand that one of the reasons for separating src and binary > > files > > > > is that in some project the compilation is depending on the target > > > runtime > > > > environment and thus the products cannot be enumerated completely. > > > > The other reason might be that the binary files are different to be > > > > checked. > > > > (Am I correct? or miss something notable?) > > > > > > > > But in this kind of JavaScript program, the built products is > > environment > > > > independent and can be enumerated completely. > > > > > > > > And the build products of the JavaScript project is text-based, which > > can > > > > be > > > > checked basically. > > > > > > > > Moreover, there are too many approaches to require and use a > JavaScript > > > > project. > > > > First of all, a user project may be a browser project or run on > > > > a server (Node.js) or both. > > > > Both in those runtime environments, the user project may need to > > > required a > > > > pre-combined > > > > built file via AMD or CommonJS module loader or global variable or > some > > > > bundle tools like > > > > Webpack and rollup.js (provided in dist/**). > > > > Or the user project may intent to require files separately on demand > > via > > > > CommonJS > > > > or some bundle tools like Webpack and rollup.js (provided in lib/**). > > > > Or the user project may intent to require files via ES module loader > > > > (provided in src/**). > > > > During the development of user projects, probably more than one > > > approaches > > > > are needed. > > > > > > > > So we both provide those files all-in-one in the artifacts for the > > > > convenience of the users. > > > > And this way follows the convention of most of the JavaSript libs, > and > > it > > > > works well for years in > > > > the ECharts community. > > > > > > > > > > > > Truly, > > > > Su Shuang > > > > > > > > > > > > > > > > -- > > > > Su Shuang (100pah) > > > > -- > > > > > > > > > > > > 2018-05-21 0:25 GMT+08:00 Kevin A. McGrail : > > > > > > > > > If the release candidate isn't correct for the artifacts you need > to > > > roll > > > > > an rc4 which might be two files not one and send that for a vote. > > > > > > > > > > On Sat, May 19, 2018, 22:34 Willem Jiang
Re: [VOTE] Release Apache NetBeans 9.0 RC1 (incubating) rc1
On 20 May 2018 at 23:33, Emilian Boldwrote: > Hi all, > > The Apache NetBeans community has voted on and approved a proposal to release > Apache NetBeans 9.0 RC1 (incubating) rc1. > > We now kindly request that the Incubator PMC members review and vote on this > incubator release candidate. > > Apache NetBeans 9.0 RC1 (incubating) vote thread: > > https://lists.apache.org/thread.html/c2a06adc83e2819e6d96c7dff8d0e22a97001f99bfda12515d4d9609@%3Cdev.netbeans.apache.org%3E > > Apache NetBeans 9.0 RC1 (incubating) vote result thread: > > https://lists.apache.org/thread.html/94f7a5e4601e26c7edb8264df7df53dd8ed215ecfc568816a162f2af@%3Cdev.netbeans.apache.org%3E > > Apache NetBeans 9.0 RC1 (incubating) constitutes all the modules in the > Apache NetBeans Git repo, which together provide the NetBeans Platform (i.e., > the underlying application framework), as well as all the modules that > provide the Java SE-related features of Apache NetBeans. > In short, Apache NetBeans 9.0 RC1 (incubating) is a full IDE for Java SE > development. > > Build artifacts available here: > > https://dist.apache.org/repos/dist/dev/incubator/netbeans/incubating-netbeans-java/incubating-9.0-rc1-rc1 MD5 hashes are deprecated and should not be used for new releases. They can just be removed from the dist dir (and download page). No need to redo the release, but please update scripts to stop creating them. > The specific artifact to be voted on: > > https://dist.apache.org/repos/dist/dev/incubator/netbeans/incubating-netbeans-java/incubating-9.0-rc1-rc1/incubating-netbeans-java-9.0-rc1-source.zip > > Included in the above are the DEPENDENCIES, DISCLAIMER, LICENSE, and NOTICE > files, as well as a README file with build instructions, which are the same > as these: > > https://github.com/apache/incubator-netbeans/blob/master/README.md > > SHA1: a1a265455c8246f849b14982fa3c36b351b21876 > > KEYS file: > > https://dist.apache.org/repos/dist/release/incubator/netbeans/KEYS > > Apache NetBeans Git Repo tag: 9.0-rc1-rc1: > > https://github.com/apache/incubator-netbeans/tree/9.0-rc1-rc1 > > Note: NetBeans license violation checks are managed via the > rat-exclusions.txt file: > > https://github.com/apache/incubator-netbeans/blob/master/nbbuild/rat-exclusions.txt > > Rat report shows no unknown licenses, except for license files: > > https://builds.apache.org/job/incubator-netbeans-release/302/artifact/rat-java-temp/nbbuild/build/rat-report.txt > > The license files listed in the Rat report are known and an issue exists for > solving this: > > https://issues.apache.org/jira/browse/NETBEANS-305 > > Included as a convenience binary, not relevant for the voting purposes (unzip > it, run it and you'll see Apache NetBeans): > > https://dist.apache.org/repos/dist/dev/incubator/netbeans/incubating-netbeans-java/incubating-9.0-rc1-rc1/incubating-netbeans-java-9.0-rc1-bin.zip > > Also included as a convenience binary the NBMs: > > https://dist.apache.org/repos/dist/dev/incubator/netbeans/incubating-netbeans-java/incubating-9.0-rc1-rc1/nbms > > New & Noteworthy features of the 9.0 Release: > > https://cwiki.apache.org/confluence/display/NETBEANS/Apache+NetBeans+9.0+New+and+Noteworthy > > Release specific wiki page: > > https://cwiki.apache.org/confluence/display/NETBEANS/Apache+NetBeans+9.0+RC1 > > How (and what) to try out the release: > > 1. Download the artifact to be voted on and unzip it. > 2. Build it using the README provided by the artifact. > 3. Look in nbbuild/netbeans for the NetBeans installation created by the > build process. > 4. Run the NetBeans executable and (if you're running on JDK 8) you'll be > prompted to install nb-javac, after agreeing to its licensing terms, and (if > you're running on JDK 9), you'll be able to use javac directly from JDK 9 > and, optionally, you'll be prompted to install nb-javac, after agreeing to > its licensing terms. > > If the above succeeds, i.e., Apache NetBeans installs and starts up, you will > have a development environment that complies with Apache IP requirements and > you should vote +1 in this thread. > > Please try out the package, using the instructions above, and vote! > > The vote is open for 7 days > > [ ] +1 Release this package as Apache NetBeans 9.0 RC1 (incubating) > [ ] 0 I don't feel strongly about it, but I'm okay with the release > [ ] -1 Do not release this package because... > > > Emilian Bold > on behalf of the Apache NetBeans PPMC > > - > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > For additional commands, e-mail: general-h...@incubator.apache.org > - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: [VOTE] Release Apache NetBeans 9.0 RC1 (incubating) rc1
[Resend incuding general@incubator.apache.org] Hi Ate, Am Montag, den 21.05.2018, 14:54 +0200 schrieb Ate Douma: > a) nbbuild/licenses folder still has the GPL license file, which I > thought/expected no longer should be needed with the fix from > NETBEANS-305 [1]? > Is there still a GPL usage left? If so this then could be a blocker > IMO. Quote from Apache Legal FAQ: https://www.apache.org/legal/resolved.html#prohibited "[...] For example, using a GPL'ed tool during the build is OK, however including GPL'ed source code is not.[...]" Apache Netbeans uses external tools when building and at least GPLv2- CP code is used. The license is referred to by the /external/-license.txt file. That file holds additional meta data for the dependency. For example the build directory nbbuild holds: nbbuild/external/langtools-9-license.txt Holds the license for the OpenJDK Javac, which is GPLv2-CP. It also declares, that the dependency is only used at compile time (though Apache might have bigger problem, as the java projects are missing the runtime dependency (or is there an ALv2 compatible JDK?)). The presence of the license file alone is no reason for a negative answer, although it has already happened. Greetings Matthias - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: Minified Javascript in source releases (was Re: [VOTE] Release Apache ECharts (incubating) 4.1.0.rc3)
On Mon, May 21, 2018 at 12:52 AM, Justin Mcleanwrote: > Hi, > > > Javascript code that is minified or combined in any major way is much > more > > like binary code in that respect. It is true that somebody *could* > inspect > > the correlation, but it is not true that this inspection is either > normally > > done or easily done. > > Thanks Ted I’ve not thought of it in that way before. I've seen several > source releases that include minified javascript I'm just curious what > people think about this. > > Do people think it OK to include minified JS in a source release if: > 1. It's ASF developed code and the full unminified source code is included > as well. > I would much rather simply provide instructions for creating the minified version. > 2. The minified JS is 3rd party code, is identified by version (and thus > can be checked via a comparison with the canonical minified version) > Why does this need to be included at all? Why not just provide a pointer to the canonical minified version?
Re: [VOTE] Release Apache SkyWalking (incubating) version 5.0.0-beta
On Mon, 21 May 2018 15:31:49 +0800, "吴晟 Sheng Wu"wrote: > I understand in next time, we should add svn revision number. And do > you suggest we should add checksum in the mail? Yes, checksums in the vote email can be good as they are easy to cross-check, say if there is an RC2 vote followed by RC1, a PMC member who accidentally tests the old one again would not get the right checksum. Another reason is archival - a checksum sent to the email list, while unencrypted it is archived in multiple distributed archives and so becomes a permanent record about the versioned archive the PMC (eventually) publish and easy for anyone (say a Debian maintainer) to check/hardcode independent of the more origin-centric GPG signature. This would also make it easier to detect a 'rogue committer' (or more likely a wrong command line) that publish something that was not voted on. In the end the checksum files on the https://www.apache.org/dist/ should then match a vote email. (AFAIK, nobody has attempted to automate such a check :) You have done well switching to secure sha512, but unlike say md5 and sha1 these are unfortunately not so email-friendly due to long lines, so if you want to try with sha512, sha512224, or fall back to sha1 for votes.. I don't know what would be easiest for your project. So I would let that be up to the SkyWalking community to decide, but IMHO at least one of either either svn revision or checksum should be in the email so it's clear what is being voted on. :) -- Stian Soiland-Reyes The University of Manchester https://www.esciencelab.org.uk/ https://orcid.org/-0001-9842-9718 - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: [VOTE] Release Apache NetBeans 9.0 RC1 (incubating) rc1
I'm inclined to vote positive on this RC1, overall looks great! - verified the MD5 and SHA1, and PGP signatures with the ASC files. - executed rat check (ant rat) and verified the report. - build and run the source (using JDK8), and all seems fine. However I still have two questions: a) nbbuild/licenses folder still has the GPL license file, which I thought/expected no longer should be needed with the fix from NETBEANS-305 [1]? Is there still a GPL usage left? If so this then could be a blocker IMO. b) Justin provided detailed feedback on the 9.0-Beta-RC3 on (possible) needed improvements/fixes for the binary dist LICENSE/NOTICE file [2], thereafter recorded as a todo action list on the wiki [3] (end of page). Some of those points have been addressed (marked DONE), but many/most are not, and neither resolved/fixed (or otherwise marked as NVT). As just an example, Justin noticed for the ./ide/modules/ext/smackx.jar file that it included the BSD licensed JZlib, which wasn't mentioned in the LICENSE file. And still isn't for this 9.0-RC1. I don't think any of those are blockers, but it would be good to address these (create NETBEANS issues for them) before the final 9.0 release. Regards, Ate [1] https://issues.apache.org/jira/browse/NETBEANS-305 https://github.com/apache/incubator-netbeans/pull/540 [2] http://mail-archives.apache.org/mod_mbox/incubator-general/201801.mbox/%3cc4c5d5c4-ab44-4afe-ade2-9e91f593a...@classsoftware.com%3e [3] https://cwiki.apache.org/confluence/display/NETBEANS/Apache+NetBeans+9.0+Beta+rc3 On 2018-05-21 00:33, Emilian Bold wrote: Hi all, The Apache NetBeans community has voted on and approved a proposal to release Apache NetBeans 9.0 RC1 (incubating) rc1. We now kindly request that the Incubator PMC members review and vote on this incubator release candidate. Apache NetBeans 9.0 RC1 (incubating) vote thread: https://lists.apache.org/thread.html/c2a06adc83e2819e6d96c7dff8d0e22a97001f99bfda12515d4d9609@%3Cdev.netbeans.apache.org%3E Apache NetBeans 9.0 RC1 (incubating) vote result thread: https://lists.apache.org/thread.html/94f7a5e4601e26c7edb8264df7df53dd8ed215ecfc568816a162f2af@%3Cdev.netbeans.apache.org%3E Apache NetBeans 9.0 RC1 (incubating) constitutes all the modules in the Apache NetBeans Git repo, which together provide the NetBeans Platform (i.e., the underlying application framework), as well as all the modules that provide the Java SE-related features of Apache NetBeans. In short, Apache NetBeans 9.0 RC1 (incubating) is a full IDE for Java SE development. Build artifacts available here: https://dist.apache.org/repos/dist/dev/incubator/netbeans/incubating-netbeans-java/incubating-9.0-rc1-rc1 The specific artifact to be voted on: https://dist.apache.org/repos/dist/dev/incubator/netbeans/incubating-netbeans-java/incubating-9.0-rc1-rc1/incubating-netbeans-java-9.0-rc1-source.zip Included in the above are the DEPENDENCIES, DISCLAIMER, LICENSE, and NOTICE files, as well as a README file with build instructions, which are the same as these: https://github.com/apache/incubator-netbeans/blob/master/README.md SHA1: a1a265455c8246f849b14982fa3c36b351b21876 KEYS file: https://dist.apache.org/repos/dist/release/incubator/netbeans/KEYS Apache NetBeans Git Repo tag: 9.0-rc1-rc1: https://github.com/apache/incubator-netbeans/tree/9.0-rc1-rc1 Note: NetBeans license violation checks are managed via the rat-exclusions.txt file: https://github.com/apache/incubator-netbeans/blob/master/nbbuild/rat-exclusions.txt Rat report shows no unknown licenses, except for license files: https://builds.apache.org/job/incubator-netbeans-release/302/artifact/rat-java-temp/nbbuild/build/rat-report.txt The license files listed in the Rat report are known and an issue exists for solving this: https://issues.apache.org/jira/browse/NETBEANS-305 Included as a convenience binary, not relevant for the voting purposes (unzip it, run it and you'll see Apache NetBeans): https://dist.apache.org/repos/dist/dev/incubator/netbeans/incubating-netbeans-java/incubating-9.0-rc1-rc1/incubating-netbeans-java-9.0-rc1-bin.zip Also included as a convenience binary the NBMs: https://dist.apache.org/repos/dist/dev/incubator/netbeans/incubating-netbeans-java/incubating-9.0-rc1-rc1/nbms New & Noteworthy features of the 9.0 Release: https://cwiki.apache.org/confluence/display/NETBEANS/Apache+NetBeans+9.0+New+and+Noteworthy Release specific wiki page: https://cwiki.apache.org/confluence/display/NETBEANS/Apache+NetBeans+9.0+RC1 How (and what) to try out the release: 1. Download the artifact to be voted on and unzip it. 2. Build it using the README provided by the artifact. 3. Look in nbbuild/netbeans for the NetBeans installation created by the build process. 4. Run the NetBeans executable and (if you're running on JDK 8) you'll be prompted to install nb-javac, after agreeing to its licensing terms, and (if you're running on JDK 9), you'll be able to use javac directly from
[VOTE] Release Apache Taverna Language 0.16.0-incubating RC1
The Taverna PPMC has voted to release: Apache Taverna Language 0.16.0-incubating with +4 PPMC-binding votes. This email is the IPMC vote. Vote thread: https://lists.apache.org/thread.html/29405e13efcd3282e978982c2c4c02b1d1bf683460ce618c7248617a@%3Cdev.taverna.apache.org%3E Result: https://lists.apache.org/thread.html/6c30d76520c2e933c4b93db7dc87cef42f2d34871f0b6f334020d451@%3Cdev.taverna.apache.org%3E This carries forward one +1 IPMC binding vote from myself. Apache Taverna Language is a set of APIs for workflow definitions (SCUFL2), Research Object Bundles and workflow inputs/outputs/run (DataBundle), as consumed and produced by the Apache Taverna workflow system. The API includes support for the legacy formats from Taverna 2 and Taverna 1, and can be also used independently of Apache Taverna 3. The command line tool tavlang can be used for conversion and inspection of research objects and workflow bundles. The release candidate to be voted over is available at: https://dist.apache.org/repos/dist/dev/incubator/taverna/source/taverna-language-0.16.0-incubating-RC1/ Checksums: $ sha1sum *zip 1f6050994b4bd2661f343119cdcb18b83dc362cf apache-taverna-language-0.16.0-incubating-source-release.zip $ sha256sum *zip bcdba80fbea54b1532cb81b6846e5711f1efe98ad289ecd4a2c6dd2833767115 apache-taverna-language-0.16.0-incubating-source-release.zip $ sha512sum *zip 008672c7f7cb1e6e461a2d5113aa111208970cfe9e0b3507fb3a34bc95957db094f0d8e8829beca9496cfa6a6d023943409335839bacd0bdedc82db87d14b9aa apache-taverna-language-0.16.0-incubating-source-release.zip s Build the release candidate using: mvn clean install The release candidates correspond to the following git commit: https://git-wip-us.apache.org/repos/asf?p=incubator-taverna-language.git;a=commit;h=c48ef9d339d7d68791691617ef2ddc56d195131e The release candidate is signed with an (updated) GPG key: https://www.apache.org/dist/incubator/taverna/KEYS A staged Maven repository is available for review at: https://repository.apache.org/content/repositories/orgapachetaverna-1019 The changelog for this release is available from JIRA: https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12334881=12318322 Please vote on releasing these packages as: Apache Taverna Language 0.16.0-incubating The vote is open for at least 72 hours and passes if a majority of at least three +1 Apache Incubator PMC votes are cast. [ ] +1 Release this package [ ] 0 I don't feel strongly about it, but don't object [ ] -1 Do not release this package because... Anyone can participate in testing and voting, not just IPMC members, please feel free to try out the release candidate and provide your votes! How to review a release? https://s.apache.org/review-release -- Stian Soiland-Reyes https://orcid.org/-0001-9842-9718 - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: [VOTE]: Release Apache Dubbo (Incubating) 2.6.2 [RC1]
We decide to withdraw this release vote, and redo this release. Not only because we want a better release which honors feedbacks especially from William and Justin, but also because we need to address one compatibility issue found recently [1]. Thank you all for your feedback, hopefully we can start the new round vote today or tomorrow :) Regards, -Ian. 1. https://github.com/apache/incubator-dubbo/issues/1816: dubbo schema compatiblity. On Mon, May 21, 2018 at 4:00 PM Justin Mcleanwrote: > Hi, > > > As I cannot build the binary without doing some changes on the pom file, > I > > had to vote -1 (binding) here. > > You don’t need to modify the pom file to compile you can specify > -Dcheckstyle.skip to compile id check style is acting up for you. > > Up to you if you want to vote -1 but I just want to remind people here > (mostly the Dubbo PMC who are new to this) that: > - a -1 vote is not a veto (but should be carefully considered) > - a release only need 3 +1 votes and more +1 than -1 to pass > - you can vote +0 or change you vote if you think the issue can be fixed > next release > > > 2. I checked the source zip[1], it is not same with github tag one[2]. > > There are some log files and empty directories which is not in the git > > repo, I guess it relates to the builder's workspace. > > Which is OK many project release are not 100% identical to what is in the > release tar what is important is that none of the source code has changed. > > Thanks, > Justin > > > - > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > For additional commands, e-mail: general-h...@incubator.apache.org > >
Re: [VOTE]: Release Apache Dubbo (Incubating) 2.6.2 [RC1]
Hi, > As I cannot build the binary without doing some changes on the pom file, I > had to vote -1 (binding) here. You don’t need to modify the pom file to compile you can specify -Dcheckstyle.skip to compile id check style is acting up for you. Up to you if you want to vote -1 but I just want to remind people here (mostly the Dubbo PMC who are new to this) that: - a -1 vote is not a veto (but should be carefully considered) - a release only need 3 +1 votes and more +1 than -1 to pass - you can vote +0 or change you vote if you think the issue can be fixed next release > 2. I checked the source zip[1], it is not same with github tag one[2]. > There are some log files and empty directories which is not in the git > repo, I guess it relates to the builder's workspace. Which is OK many project release are not 100% identical to what is in the release tar what is important is that none of the source code has changed. Thanks, Justin - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Minified Javascript in source releases (was Re: [VOTE] Release Apache ECharts (incubating) 4.1.0.rc3)
Hi, > Javascript code that is minified or combined in any major way is much more > like binary code in that respect. It is true that somebody *could* inspect > the correlation, but it is not true that this inspection is either normally > done or easily done. Thanks Ted I’ve not thought of it in that way before. I've seen several source releases that include minified javascript I'm just curious what people think about this. Do people think it OK to include minified JS in a source release if: 1. It's ASF developed code and the full unminified source code is included as well. 2. The minified JS is 3rd party code, is identified by version (and thus can be checked via a comparison with the canonical minified version) Thanks, Justin - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: [VOTE] Release Apache SkyWalking (incubating) version 5.0.0-beta
Hi Stian I appreciate your very detail review for our release. I will move your points to the GitHub issue under `beta2` for helping the project to provide better release in next time. > Remember 72 hours is not a time-out, but a minimum period to wait. :) Yes. I know. I will be more patient :) And I got most of your points, and have one question. > For that reason the VOTE email should also include svn revision number from dist.apache.org, and/oor sha checksum of the files under vote. Assuming r26864 (from "svn log") aka sha512 checksums I understand in next time, we should add svn revision number. And do you suggest we should add checksum in the mail? Thank you very much. -- Sheng Wu Apache SkyWalking -- Original -- From: "Stian Soiland-Reyes"; Date: Mon, May 21, 2018 03:03 PM To: " Sheng Wu" ; Cc: "general" ; Subject: Re: [VOTE] Release Apache SkyWalking (incubating) version 5.0.0-beta On Sun, 20 May 2018 17:08:31 +0800, " Sheng Wu" wrote: > Hi, IPMC > I am asking the release vote, again. :) Haven't had one yet. Hope we can > have enough vote in 72 hours. Remember 72 hours is not a time-out, but a minimum period to wait. :) > Voting will start now (May 18th, 2018) and will remain open for at least 72 > hours, Request all IPMC members to give their vote. > [ ] +1 Release this package. > [ ] +0 No opinion. > [ ] -1 Do not release this package because??. My vote: +1 (binding) +1 gpg signatures verified +1 sha512 checksums correct +1 git commit matches -src.tgz +1 Release archive has -incubating in filename -1 Maven versions of submodules do NOT have -incubator or -incubating +1 Maven repo checksum matches binaries in dist +0 src/bin DISCLAIMER present, but it says "sponsored by Incubator" instead of "sponsored by the Apache Incubator PMC." +1 src LICENSE/NOTICE +1 bin zip vs .tar.gz +1 bin LICENSE - very good! +1 bin NOTICE +0 mvn clean package mostly builds (see below) build fails in apm-webapp because [ERROR] Failed to execute goal org.apache.maven.plugins:maven-checkstyle-plugin:2.17:check (validate) on project apm-webapp: Execution validate of goal org.apache.maven.plugins:maven-checkstyle-plugin:2.17:check failed: Plugin org.apache.maven.plugins:maven-checkstyle-plugin:2.17 or one of its dependencies could not be resolved: Could not find artifact org.apache.skywalking:apm-checkstyle:jar:5.0.0-beta in central (https://repo.maven.apache.org/maven2) -> [Help 1] This is fixed by using "mvn install" instead within apm-checkstyle > Release Candidate: > *https://dist.apache.org/repos/dist/dev/incubator/skywalking/5.0.0-beta/ I strongly recommend using suffixes like -RC1 in the release candidate URL and tag -- how do voters (and anyone checking the vote later) know if you happened to make a 'second 5.0.0-beta' release candidate? For that reason the VOTE email should also include svn revision number from dist.apache.org, and/oor sha checksum of the files under vote. Assuming r26864 (from "svn log") aka sha512 checksums 33b13cc7bc4ddea46d727ed8910c54c2e3b9acd6614a7f937e01e34ae6403942791ec3505d16de674605c665a4c0805271eb90a94775701d941462c530a99d11 apache-skywalking-apm-incubating-5.0.0-beta-src.tgz 770ad70ad3e23fbd93ea675528a81735848a92557f91036b23652b4c2a0282a7198bf9a09fd4570f8bef180d956e81e4f93a9c2308106de1b3d815feeb0dfd84 apache-skywalking-apm-incubating-5.0.0-beta.tar.gz d4ca36ed94a6d3557b747fe3ba3daf1dee5dca6d0f827af404762344c41214b4e5ff2173536e6c2feac383d9d0bdbaa648a5f0b8eee9f1b0913734d2c5adfffa apache-skywalking-apm-incubating-5.0.0-beta.zip > Maven 2 staging repository: > *https://repository.apache.org/content/repositories/orgapacheskywalking-1011/org/apache/skywalking/ > > Release Tag : > * v5.0.0-beta Should be v5.0.0-beta-RC1 (or later) while under vote, and then re-tagged once vote has been accepted. > Release CommitID : > * 5ddc4e714f2570421779a11f2589ffc32d2b8b21 (while incubating) please, include the URL of the git repository, particularly as skywalking is for some reason not in git.apache.org Assuming https://github.com/apache/incubator-skywalking/commit/5ddc4e714f2570421779a11f2589ffc32d2b8b21 and git submodules c02c12af12116121e25155d1f3fca0fadee5f2e9 apm-protocol/apm-network/src/main/proto (v1.1.1) 43ae106a15a77937a255c790a478c620b549d742 skywalking-ui (v5.0.0-alpha-44-g43ae106) which means that https://github.com/apache/incubator-skywalking-ui/commit/43ae106a15a77937a255c790a478c620b549d742 is also covered by this release vote. But 43ae106a15a77937a255c790a478c620b549d742 in skywalking-ui does not have a corresponding tag there. Presumably a v5.0.0-beta tag will be added there after successful vote. > Keys to verify the Release Candidate : > * http://pgp.mit.edu:11371/pks/lookup?op=get=0x2EF5026E70A55777 > corresponding to
Re: [VOTE] Release Apache SkyWalking (incubating) version 5.0.0-beta
On Sun, 20 May 2018 17:08:31 +0800, "吴晟 Sheng Wu"wrote: > Hi, IPMC > I am asking the release vote, again. :) Haven't had one yet. Hope we can > have enough vote in 72 hours. Remember 72 hours is not a time-out, but a minimum period to wait. :) > Voting will start now (May 18th, 2018) and will remain open for at least 72 > hours, Request all IPMC members to give their vote. > [ ] +1 Release this package. > [ ] +0 No opinion. > [ ] -1 Do not release this package because…. My vote: +1 (binding) +1 gpg signatures verified +1 sha512 checksums correct +1 git commit matches -src.tgz +1 Release archive has -incubating in filename -1 Maven versions of submodules do NOT have -incubator or -incubating +1 Maven repo checksum matches binaries in dist +0 src/bin DISCLAIMER present, but it says "sponsored by Incubator" instead of "sponsored by the Apache Incubator PMC." +1 src LICENSE/NOTICE +1 bin zip vs .tar.gz +1 bin LICENSE - very good! +1 bin NOTICE +0 mvn clean package mostly builds (see below) build fails in apm-webapp because [ERROR] Failed to execute goal org.apache.maven.plugins:maven-checkstyle-plugin:2.17:check (validate) on project apm-webapp: Execution validate of goal org.apache.maven.plugins:maven-checkstyle-plugin:2.17:check failed: Plugin org.apache.maven.plugins:maven-checkstyle-plugin:2.17 or one of its dependencies could not be resolved: Could not find artifact org.apache.skywalking:apm-checkstyle:jar:5.0.0-beta in central (https://repo.maven.apache.org/maven2) -> [Help 1] This is fixed by using "mvn install" instead within apm-checkstyle > Release Candidate: > *https://dist.apache.org/repos/dist/dev/incubator/skywalking/5.0.0-beta/ I strongly recommend using suffixes like -RC1 in the release candidate URL and tag -- how do voters (and anyone checking the vote later) know if you happened to make a 'second 5.0.0-beta' release candidate? For that reason the VOTE email should also include svn revision number from dist.apache.org, and/oor sha checksum of the files under vote. Assuming r26864 (from "svn log") aka sha512 checksums 33b13cc7bc4ddea46d727ed8910c54c2e3b9acd6614a7f937e01e34ae6403942791ec3505d16de674605c665a4c0805271eb90a94775701d941462c530a99d11 apache-skywalking-apm-incubating-5.0.0-beta-src.tgz 770ad70ad3e23fbd93ea675528a81735848a92557f91036b23652b4c2a0282a7198bf9a09fd4570f8bef180d956e81e4f93a9c2308106de1b3d815feeb0dfd84 apache-skywalking-apm-incubating-5.0.0-beta.tar.gz d4ca36ed94a6d3557b747fe3ba3daf1dee5dca6d0f827af404762344c41214b4e5ff2173536e6c2feac383d9d0bdbaa648a5f0b8eee9f1b0913734d2c5adfffa apache-skywalking-apm-incubating-5.0.0-beta.zip > Maven 2 staging repository: > *https://repository.apache.org/content/repositories/orgapacheskywalking-1011/org/apache/skywalking/ > > Release Tag : > * v5.0.0-beta Should be v5.0.0-beta-RC1 (or later) while under vote, and then re-tagged once vote has been accepted. > Release CommitID : > * 5ddc4e714f2570421779a11f2589ffc32d2b8b21 (while incubating) please, include the URL of the git repository, particularly as skywalking is for some reason not in git.apache.org Assuming https://github.com/apache/incubator-skywalking/commit/5ddc4e714f2570421779a11f2589ffc32d2b8b21 and git submodules c02c12af12116121e25155d1f3fca0fadee5f2e9 apm-protocol/apm-network/src/main/proto (v1.1.1) 43ae106a15a77937a255c790a478c620b549d742 skywalking-ui (v5.0.0-alpha-44-g43ae106) which means that https://github.com/apache/incubator-skywalking-ui/commit/43ae106a15a77937a255c790a478c620b549d742 is also covered by this release vote. But 43ae106a15a77937a255c790a478c620b549d742 in skywalking-ui does not have a corresponding tag there. Presumably a v5.0.0-beta tag will be added there after successful vote. > Keys to verify the Release Candidate : > * http://pgp.mit.edu:11371/pks/lookup?op=get=0x2EF5026E70A55777 > corresponding to pen...@apache.org +1 matches key from KEYS :) > Guide to build the release from source : > * > https://github.com/apache/incubator-skywalking/blob/master/docs/en/How-to-build.md Very good, thank you! - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: [VOTE]: Release Apache Dubbo (Incubating) 2.6.2 [RC1]
> 1. there is bunch of dubbo-2.6.2-SNAPSHOT in the pom.xml file, I guess the > maven release plugin doesn't take all of them. > .//bom/pom.xml: dubbo-2.6.2-SNAPSHOT > .//dependencies-bom/pom.xml: dubbo-2.6.2-SNAPSHOT > .//distribution/pom.xml:2.6.2-SNAPSHOT-SNAPSHOT > .//pom.xml: dubbo-2.6.2-SNAPSHOT > > 2. I checked the source zip[1], it is not same with github tag one[2]. > There are some log files and empty directories which is not in the git > repo, I guess it relates to the builder's workspace. > It could be addressed by generate the source release kit in the > distribution like we did here[3]. We rely on the release and assembly plugin to finish these works, there may have some inappropriate plugin configuration. I will check the problems you mentioned and fix them by following your guides. > 3. I tried to build the source from kit, it looks the check style is > enabled when since JDK 1.8 and I just got the out of memory error there. > I found there are comment about this check style issue (it takes lots of > time and it doesn't work on my box). So I created an issue[4] of it. > I can build the source by modify the pom to skip the check style check, but > it kind of hiking , so I had to vote -1 (binding) for it. During the internal dubbo community vote, Justin, Huxing and Ian also reported the checkstyle plugin problem (cost time and resources) when build. Since this problem has confused you and maybe others from building the source, we plan to solve this problem and start a new round of voting. > 4. I checked the binary kit, it only includes the jars file of dubbo[5], as > we cannot provide the apache maven release now, it could cause some trouble > for the user to consume the binary without third party dependencies. Do we > have any plan for it ? Besides the apache binary release, we will also publish the convenient maven artifacts to the central maven repository, which are not mentioned in this vote thread since it’s not a necessary part of the apache release. This way, users can consume from the central repository as before. In the next release, when the groupid change to “org.apache.dubbo”, we will switch from central maven repository to apache maven repository, and will include the apache maven staging repo address in the vote. The current binary zip, as you point out "only includes the jars file of dubbo[5]”, will be removed or replaced with more meaningful bin release, such as samples or quick start guides which users can help users start the journey of dubbo quickly. To conclude, we decide to start a new round of voting regarding the problems found during this round. Thanks for the vote. Best regards, Jun > On 21 May 2018, at 10:34 AM, Willem Jiangwrote: > > Hi, > > I did some check on the source zip and binary zip, the License and Notice > files looks good. But I also found some issues here. > As I cannot build the binary without doing some changes on the pom file, I > had to vote -1 (binding) here. > > Here are the issues that I found: > > 1. there is bunch of dubbo-2.6.2-SNAPSHOT in the pom.xml file, I guess the > maven release plugin doesn't take all of them. > .//bom/pom.xml: dubbo-2.6.2-SNAPSHOT > .//dependencies-bom/pom.xml: dubbo-2.6.2-SNAPSHOT > .//distribution/pom.xml:2.6.2-SNAPSHOT-SNAPSHOT > .//pom.xml: dubbo-2.6.2-SNAPSHOT > > 2. I checked the source zip[1], it is not same with github tag one[2]. > There are some log files and empty directories which is not in the git > repo, I guess it relates to the builder's workspace. > It could be addressed by generate the source release kit in the > distribution like we did here[3]. > BTW, it's quite important that every one can build the kit by following the > instruction. I didn't found the instruction file from the README. > > 3. I tried to build the source from kit, it looks the check style is > enabled when since JDK 1.8 and I just got the out of memory error there. > I found there are comment about this check style issue (it takes lots of > time and it doesn't work on my box). So I created an issue[4] of it. > I can build the source by modify the pom to skip the check style check, but > it kind of hiking , so I had to vote -1 (binding) for it. > > 4. I checked the binary kit, it only includes the jars file of dubbo[5], as > we cannot provide the apache maven release now, it could cause some trouble > for the user to consume the binary without third party dependencies. Do we > have any plan for it ? > > Another tip for the release check is running some applications which is > build on the top of the framework to make sure all the distribution is good. > > > [1] > https://dist.apache.org/repos/dist/dev/incubator/dubbo/2.6.2/dubbo-incubating-2.6.2-source-release.zip > [2]https://github.com/apache/incubator-dubbo/archive/dubbo-2.6.2.zip > [3] >
Re: [VOTE] Release Apache ECharts (incubating) 4.1.0.rc3
The general meaning of source code is that it is the artifact that people will edit and which they can inspect by normal textual or graphical means to ensure that there are no surprises. Javascript code that is minified or combined in any major way is much more like binary code in that respect. It is true that somebody *could* inspect the correlation, but it is not true that this inspection is either normally done or easily done. As a rule of thumb, you should not include any artifacts that require more work to verify than you expect nearly all release reviewers to do for *every* release candidate. Usually that means that there are no derived artifacts at all in a source release since that is the only case which is easy for reviewers. On Sun, May 20, 2018 at 10:07 PM, SHUANG SUwrote: > Thanks, Justin, > > I think I should remove the jar about rat from the artifact, and then there > is no binary code anymore. > > But I am puzzled about the definition of the term "compiled code". > Generally, the JavaScript code does not need to be compiled to binary. > The code in "dist/**" is also JavaScript code, which is combined to some > single files > and some of them are minified. And the ".map" file is provided for mapping > each term > of the combined code to the original code in src/**. Without or without the > ".map", > the combined code can be checked. > I think this kind of combined code is not "compiled code", but I don't know > the formal definition > about this case. > > Thanks, > Shuang > > > > > -- > Su Shuang (100pah) > -- > > > 2018-05-21 5:31 GMT+08:00 Justin Mclean : > > > Hi, > > > > Releases at the ASF must not contain compiled code. You can if you want > > also produce a conviance binary for users at the same time but the source > > release needs to contain no compiled code otherwise it's not open source. > > > > Thanks, > > Justin > > > > On Mon., 21 May 2018, 7:10 am SHUANG SU, wrote: > > > > > Thanks, Willem. > > > > > > But I will explain the reason that provides an all-in-one artifact. > > > > > > I understand that one of the reasons for separating src and binary > files > > > is that in some project the compilation is depending on the target > > runtime > > > environment and thus the products cannot be enumerated completely. > > > The other reason might be that the binary files are different to be > > > checked. > > > (Am I correct? or miss something notable?) > > > > > > But in this kind of JavaScript program, the built products is > environment > > > independent and can be enumerated completely. > > > > > > And the build products of the JavaScript project is text-based, which > can > > > be > > > checked basically. > > > > > > Moreover, there are too many approaches to require and use a JavaScript > > > project. > > > First of all, a user project may be a browser project or run on > > > a server (Node.js) or both. > > > Both in those runtime environments, the user project may need to > > required a > > > pre-combined > > > built file via AMD or CommonJS module loader or global variable or some > > > bundle tools like > > > Webpack and rollup.js (provided in dist/**). > > > Or the user project may intent to require files separately on demand > via > > > CommonJS > > > or some bundle tools like Webpack and rollup.js (provided in lib/**). > > > Or the user project may intent to require files via ES module loader > > > (provided in src/**). > > > During the development of user projects, probably more than one > > approaches > > > are needed. > > > > > > So we both provide those files all-in-one in the artifacts for the > > > convenience of the users. > > > And this way follows the convention of most of the JavaSript libs, and > it > > > works well for years in > > > the ECharts community. > > > > > > > > > Truly, > > > Su Shuang > > > > > > > > > > > > -- > > > Su Shuang (100pah) > > > -- > > > > > > > > > 2018-05-21 0:25 GMT+08:00 Kevin A. McGrail : > > > > > > > If the release candidate isn't correct for the artifacts you need to > > roll > > > > an rc4 which might be two files not one and send that for a vote. > > > > > > > > On Sat, May 19, 2018, 22:34 Willem Jiang > > wrote: > > > > > > > > > Hi, > > > > > > > > > > As there is only one zip file, I guess it just the src > distribution. > > > > > But after went through the file, I found lot of echart js files in > > the > > > > dist > > > > > directory and the rat jar. > > > > > > > > > > So I'm confused what's the purpose of apache-echarts-4.1.0.rc3- > > > > > incubating.zip > > > > > > > > > > Normally we distribute the src and binary files separately. > > > > > > > > > > > > > > > > > > > > Willem Jiang > > > > > > > > > > Blog: http://willemjiang.blogspot.com (English) > > > > >