Re: [VOTE] Release apache-calcite-1.9.0 (release candidate 1)

[Julian Hyde]

> As for the signature not being in the web of trust, perhaps we could have a
> virtual key signing party at some point?

I like that idea. Key-signing over email is not secure (risk of 
man-in-the-middle attack) but key-signing over a hangout would be secure, I 
think. Let’s discuss in another thread.

Julian

Re: [VOTE] Release apache-calcite-1.9.0 (release candidate 1)

[Michael Mior]

+1 (non-binding)

Verified signatures/hashes and compiled and ran tests. Also ran some of the
integration tests. Unfortunately the VM doesn't seem to build properly at
the moment, but that's a separate issue.

As for the signature not being in the web of trust, perhaps we could have a
virtual key signing party at some point?

--
Michael Mior
mm...@uwaterloo.ca

2016-09-17 7:49 GMT-04:00 Jesus Camachorodriguez :

> Hi all,
>
> I have created a build for Apache Calcite 1.9.0, release candidate 1.
>
> Thanks to everyone who has contributed to this release.
> You can read the release notes here:
> https://github.com/apache/calcite/blob/calcite-1.9.0/site/_docs/history.md
>
> The commit to be voted upon:
> http://git-wip-us.apache.org/repos/asf/calcite/commit/08c56b1
>
> Its hash is 08c56b158ffcfcf205a919cc9fff77a692e649f6.
>
> The artifacts to be voted on are located here:
> https://dist.apache.org/repos/dist/dev/calcite/apache-calcite-1.9.0-rc1/
>
> The hashes of the artifacts are as follows:
> src.tar.gz.md5 b3b6a15671b1e8ffd7f989398e050de4
> src.tar.gz.sha1 8f17b2d7896bac6123ae4a1491e04f4960094a59
> src.zip.md5 7c66353701d1924a9e2656bd76e570cb
> src.zip.sha1 8a5c7d27b0240cbcacd565eadf451de9dff6d2fa
>
> A staged Maven repository is available for review at:
> https://repository.apache.org/content/repositories/orgapachecalcite-1024
>
> Release artifacts are signed with the following key:
> https://people.apache.org/keys/committer/jcamacho.asc
>
> Please vote on releasing this package as Apache Calcite 1.9.0.
>
> The vote is open for the next 96 hours and passes if a majority of
> at least three +1 PMC votes are cast.
>
> [ ] +1 Release this package as Apache Calcite 1.9.0
> [ ]  0 I don't feel strongly about it, but I'm okay with the release
> [ ] -1 Do not release this package because...
>
>
> Here is my vote:
>
> +1 (binding)
>
> Jesús
>
>

Re: [VOTE] Release apache-calcite-1.9.0 (release candidate 1)

[Josh Elser]

+1 (binding)

* xsums/sigs OK
* L look reasonable
* `mvn verify` passes
* `mvn apache-rat:check` passes with the expected exclusions
* Release notes look good

Jesus Camachorodriguez wrote:

Hi all,

I have created a build for Apache Calcite 1.9.0, release candidate 1.

Thanks to everyone who has contributed to this release.
You can read the release notes here:
https://github.com/apache/calcite/blob/calcite-1.9.0/site/_docs/history.md

The commit to be voted upon:
http://git-wip-us.apache.org/repos/asf/calcite/commit/08c56b1

Its hash is 08c56b158ffcfcf205a919cc9fff77a692e649f6.

The artifacts to be voted on are located here:
https://dist.apache.org/repos/dist/dev/calcite/apache-calcite-1.9.0-rc1/

The hashes of the artifacts are as follows:
src.tar.gz.md5 b3b6a15671b1e8ffd7f989398e050de4
src.tar.gz.sha1 8f17b2d7896bac6123ae4a1491e04f4960094a59
src.zip.md5 7c66353701d1924a9e2656bd76e570cb
src.zip.sha1 8a5c7d27b0240cbcacd565eadf451de9dff6d2fa

A staged Maven repository is available for review at:
https://repository.apache.org/content/repositories/orgapachecalcite-1024

Release artifacts are signed with the following key:
https://people.apache.org/keys/committer/jcamacho.asc

Please vote on releasing this package as Apache Calcite 1.9.0.

The vote is open for the next 96 hours and passes if a majority of
at least three +1 PMC votes are cast.

[ ] +1 Release this package as Apache Calcite 1.9.0
[ ]  0 I don't feel strongly about it, but I'm okay with the release
[ ] -1 Do not release this package because...


Here is my vote:

+1 (binding)

Jesús

Re: [VOTE] Release apache-calcite-1.9.0 (release candidate 1)

[Julian Hyde]

+1

Downloaded, checked signatures, LICENSE, NOTICE, README, compiled, ran tests.

Note: When I imported your keys I got the message 

gpg: Signature made Sat Sep 17 01:05:57 2016 PDT
gpg:using RSA key 0x931E4AB3C516B444
gpg: Good signature from "Jesus Camacho Rodriguez "
gpg: WARNING: This key is not certified with a trusted signature!
gpg:  There is no indication that the signature belongs to the owner.

This means that you are not part of the “web of trust”. You should join it when 
you get the chance, best done face-to-face. Note a show-stopper, but best done 
before the release is announced. See [1].

Julian

[1] https://www.apache.org/dev/release-signing#link-into-wot 


> On Sep 17, 2016, at 4:49 AM, Jesus Camachorodriguez  
> wrote:
> 
> Hi all,
> 
> I have created a build for Apache Calcite 1.9.0, release candidate 1.
> 
> Thanks to everyone who has contributed to this release.
> You can read the release notes here:
> https://github.com/apache/calcite/blob/calcite-1.9.0/site/_docs/history.md
> 
> The commit to be voted upon:
> http://git-wip-us.apache.org/repos/asf/calcite/commit/08c56b1
> 
> Its hash is 08c56b158ffcfcf205a919cc9fff77a692e649f6.
> 
> The artifacts to be voted on are located here:
> https://dist.apache.org/repos/dist/dev/calcite/apache-calcite-1.9.0-rc1/
> 
> The hashes of the artifacts are as follows:
> src.tar.gz.md5 b3b6a15671b1e8ffd7f989398e050de4
> src.tar.gz.sha1 8f17b2d7896bac6123ae4a1491e04f4960094a59
> src.zip.md5 7c66353701d1924a9e2656bd76e570cb
> src.zip.sha1 8a5c7d27b0240cbcacd565eadf451de9dff6d2fa
> 
> A staged Maven repository is available for review at:
> https://repository.apache.org/content/repositories/orgapachecalcite-1024
> 
> Release artifacts are signed with the following key:
> https://people.apache.org/keys/committer/jcamacho.asc
> 
> Please vote on releasing this package as Apache Calcite 1.9.0.
> 
> The vote is open for the next 96 hours and passes if a majority of
> at least three +1 PMC votes are cast.
> 
> [ ] +1 Release this package as Apache Calcite 1.9.0
> [ ]  0 I don't feel strongly about it, but I'm okay with the release
> [ ] -1 Do not release this package because...
> 
> 
> Here is my vote:
> 
> +1 (binding)
> 
> Jesús
>