Re: [VOTE] Release Apache SDAP (incubating) 1.2.0-rc2
This is what I've found: Our code does not explicitly install or use chardet; however, some of the dependencies our code does install/use have chardet as a dependency and may be using it. I believe I've identified all the dependencies resulting in chardet being installed and am working to update them. As it stands, is this still a blocker for this release? -Riley On 2023/11/02 15:46:50 Stepheny Perez wrote: > Hello everyone, > > This is a call for a vote to release Apache SDAP (incubating) release > candidate rc2 for version 1.2.0. > > The Apache SDAP community has voted to approve release of Apache SDAP > (incubating) version 1.2.0-rc2. > > We now request the Incubator PMC review and vote on this release. > > SDAP community thread > https://lists.apache.org/thread/gowz58vvjmns25sv1b03mgo9d8kqq5x8 > > Changes made between previous candidate (rc1) and this one (rc2) are as > follows: > > - Fix build issues with Apple Silicon M1/M2 > - Install protobuf through PyPi instead of from source > > CHANGELOG for version 1.2.0 are available here: > https:/github.com/apache/incubator-sdap-ingester/blob/1.2.0-rc2/CHANGELOG.md > https:/github.com/apache/incubator-sdap-nexus/blob/1.2.0-rc2/CHANGELOG.md > > Instructions for building docker images from source can be found here: > https://github.com/apache/incubator-sdap-nexus/blob/1.2.0-rc2/docs/build.rst > Instructions for deploying locally to test can be found here: > https://github.com/apache/incubator-sdap-nexus/blob/1.2.0-rc2/docs/quickstart.rst > > The release files, including signatures, digests, etc. can be found at: > https://dist.apache.org/repos/dist/dev/incubator/sdap/apache-sdap-1.2.0-rc2/ > > For convenience, the tags we built the release artifacts to be voted on > from are 1.2.0-rc2: > > - ingester: > - URL: https://github.com/apache/incubator-sdap-ingester/tree/1.2.0-rc2 > - Commit: a9f0673abdd8fc5aebbbcd3051ba43f6f7f040fe > > - nexus: > - URL: https://github.com/apache/incubator-sdap-nexus/tree/1.2.0-rc2 > - Commit: 955938afddd8824b1240b1582355f941f2139dec > > For verification, the hashes (SHA-512) of the .tar.gz artifacts we are voting > on are as follows: > > apache-sdap-ingester-1.2.0-incubating-src.tar.gz: > 9717675657a7f6cdf38f6a965fcee70fc602a4d1d879c45f93df5824d09375a088a81e9f5ffdba4b8c9aeb46ccec89fff732fb3899734b4a59eaf99668ee6c15 > > apache-sdap-nexus-1.2.0-incubating-src.tar.gz: > ea5eb29f69d4955c0bfdca9af0be193eb0ed0c5fc6750cbb51f2b5e1796fa8fe73e17b72a92a22831fd7fdefa1b33378a753a083697913c95dc645c76c5a > > Release artifacts are signed with the following key: > https://keyserver.ubuntu.com/pks/lookup?op=get=0x2E8418801953621FAA322169D6F360887071C194 > > Please vote on releasing this package as Apache SDAP (incubating) 1.2.0. > > The vote is open for 72 hours and passes if at least 3 +1 PMC votes are cast. > > [ ] +1 Release this package as Apache SDAP (incubating) 1.2.0 > [ ] +0 No opinion > [ ] -1 Do not release this package because ... > > Thank you, > Stepheny Perez > > - > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > For additional commands, e-mail: general-h...@incubator.apache.org > > - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: [VOTE] Release Apache SDAP (incubating) 1.2.0-rc2
Hi Justin, I checked more thoroughly and that requirements file doesn't appear to be used anywhere so I've deleted it. However, I did also check the docker images built from this release candidate and found chardet installed in a number of them (not explicitly, but in the installation process of other dependencies) so I'm in the process of figuring out what's causing that. On 2023/11/06 01:17:37 Justin Mclean wrote: > Hi, > > I just looked in the requirements file and remembered that chardet was > LGPL-licensed, but I assume there’s an automated way to do it. > > Justin > - > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > For additional commands, e-mail: general-h...@incubator.apache.org > > - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: [VOTE] Release Apache SDAP (incubating) 1.2.0-rc2
Hi, I just looked in the requirements file and remembered that chardet was LGPL-licensed, but I assume there’s an automated way to do it. Justin - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: [VOTE] Release Apache SDAP (incubating) 1.2.0-rc2
I had voted +1 on dev@ but I'm changing my vote until we clarify the use of chardet: 0 (binding) Is there an automated way to check the licenses of Python dependencies (analogous to how Java-based projects use RAT)? It would be useful for me (not a Python expert but voting on releases) and the project (automating their license hygiene). Julian On Sat, Nov 4, 2023 at 11:01 AM Justin Mclean wrote: > > Hi, > > -1 (binding), as I think you may have an issue here as > apache-sdap-nexus-1.2.0-incubating-src depends on LGPL licensed chardet. [1] > ASF project can not depend on LGPL software unless it is optional. Is this > the case here? > > I checked: > - incubating in names > - signatures and hashes are fine > - DISCLAIMER exists > - LICENSE and NOTICE are fine > - No unexpected binary files > - Source files have ASF headers > - I did not compile from source > > Kind Regards, > Justin > > 1. https://issues.apache.org/jira/browse/LEGAL-572 > - > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > For additional commands, e-mail: general-h...@incubator.apache.org > - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
Re: [VOTE] Release Apache SDAP (incubating) 1.2.0-rc2
Hi, -1 (binding), as I think you may have an issue here as apache-sdap-nexus-1.2.0-incubating-src depends on LGPL licensed chardet. [1] ASF project can not depend on LGPL software unless it is optional. Is this the case here? I checked: - incubating in names - signatures and hashes are fine - DISCLAIMER exists - LICENSE and NOTICE are fine - No unexpected binary files - Source files have ASF headers - I did not compile from source Kind Regards, Justin 1. https://issues.apache.org/jira/browse/LEGAL-572 - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
[VOTE] Release Apache SDAP (incubating) 1.2.0-rc2
Hello everyone, This is a call for a vote to release Apache SDAP (incubating) release candidate rc2 for version 1.2.0. The Apache SDAP community has voted to approve release of Apache SDAP (incubating) version 1.2.0-rc2. We now request the Incubator PMC review and vote on this release. SDAP community thread https://lists.apache.org/thread/gowz58vvjmns25sv1b03mgo9d8kqq5x8 Changes made between previous candidate (rc1) and this one (rc2) are as follows: - Fix build issues with Apple Silicon M1/M2 - Install protobuf through PyPi instead of from source CHANGELOG for version 1.2.0 are available here: https:/github.com/apache/incubator-sdap-ingester/blob/1.2.0-rc2/CHANGELOG.md https:/github.com/apache/incubator-sdap-nexus/blob/1.2.0-rc2/CHANGELOG.md Instructions for building docker images from source can be found here: https://github.com/apache/incubator-sdap-nexus/blob/1.2.0-rc2/docs/build.rst Instructions for deploying locally to test can be found here: https://github.com/apache/incubator-sdap-nexus/blob/1.2.0-rc2/docs/quickstart.rst The release files, including signatures, digests, etc. can be found at: https://dist.apache.org/repos/dist/dev/incubator/sdap/apache-sdap-1.2.0-rc2/ For convenience, the tags we built the release artifacts to be voted on from are 1.2.0-rc2: - ingester: - URL: https://github.com/apache/incubator-sdap-ingester/tree/1.2.0-rc2 - Commit: a9f0673abdd8fc5aebbbcd3051ba43f6f7f040fe - nexus: - URL: https://github.com/apache/incubator-sdap-nexus/tree/1.2.0-rc2 - Commit: 955938afddd8824b1240b1582355f941f2139dec For verification, the hashes (SHA-512) of the .tar.gz artifacts we are voting on are as follows: apache-sdap-ingester-1.2.0-incubating-src.tar.gz: 9717675657a7f6cdf38f6a965fcee70fc602a4d1d879c45f93df5824d09375a088a81e9f5ffdba4b8c9aeb46ccec89fff732fb3899734b4a59eaf99668ee6c15 apache-sdap-nexus-1.2.0-incubating-src.tar.gz: ea5eb29f69d4955c0bfdca9af0be193eb0ed0c5fc6750cbb51f2b5e1796fa8fe73e17b72a92a22831fd7fdefa1b33378a753a083697913c95dc645c76c5a Release artifacts are signed with the following key: https://keyserver.ubuntu.com/pks/lookup?op=get=0x2E8418801953621FAA322169D6F360887071C194 Please vote on releasing this package as Apache SDAP (incubating) 1.2.0. The vote is open for 72 hours and passes if at least 3 +1 PMC votes are cast. [ ] +1 Release this package as Apache SDAP (incubating) 1.2.0 [ ] +0 No opinion [ ] -1 Do not release this package because ... Thank you, Stepheny Perez - To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
