accumulo-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Sean Busbey <bus...@apache.org>
Subject Re: [VOTE] Apache Accumulo 1.9.0-rc1
Date Sun, 15 Apr 2018 14:12:48 GMT
sorry, that should have been "staged maven repository should stick to MUST guidance"



On 2018/04/15 14:11:43, Sean Busbey <busbey@apache.org> wrote: 
> -1 on the RC vote
> 
> I agree that in the staged maven repository we should stick to SHOULD guidance until
such time that the maven tooling has a supported option to use correct checksums. (Have we
verified that the relevant tooling at a minimum has a request in to add it?)
> 
> However, I can't verify that the source artifact or any other artifacts that we'll eventually
place in dist.a.o/release has correct checksums that meet the current release distribution
policy simply because we don't have the relevant bits posted here in the RC.
> 
> Why don't we go back to providing both a staged maven repo and an RC directory in the
ASF dev part of dist.a.o[4]? Plenty of other projects use that area to stage RCs that have
correct checksums.
> 
> [4]: https://dist.apache.org/repos/dist/dev/accumulo/
> 
> On 2018/04/15 05:35:39, Christopher <ctubbsii@apache.org> wrote: 
> > Mike,
> > 
> > We use stronger checksums (SHA512) in the SVN[1] area and downloads page[2]
> > after a vote passes. In fact, we're one of the only "perfect projects" in
> > regards to compliance with this policy[3].
> > 
> > The Maven staging area doesn't follow all the "SHOULD" statements, but
> > that's only because these checksums are automatically generated by
> > maven-deploy-plugin, and not under our direct control. However, it still
> > follows all the "MUST" statements, so it is still in compliance with the
> > cited policy. Unless we're willing to circumvent standard Maven tooling and
> > risk breaking things which depend on the conventions established by this
> > tooling (which, to be clear, I think would be a really terribly bad idea),
> > we simply cannot follow all the "SHOULD" statements for the Maven staging
> > area.
> > 
> > [1]: https://www.apache.org/dist/accumulo/
> > [2]: https://accumulo.apache.org/downloads/
> > [3]: https://checker.apache.org/dist/unsummed.html
> > 
> > On Sat, Apr 14, 2018 at 11:13 PM Mike Drob <mdrob@mdrob.com> wrote:
> > 
> > > -0
> > >
> > > please do not publish md5 sums
> > > please add missing sha256 sums
> > >
> > > apache release policy:
> > > http://www.apache.org/dev/release-distribution#sigs-and-sums
> > >
> > > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch <mwalch@apache.org> wrote:
> > >
> > > > +1
> > > >
> > > > * Verified sha1 & md5 hashes matched
> > > > * Verified signatures
> > > > * Ran binary tarball locally using Uno
> > > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > > >
> > > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher <ctubbsii@apache.org>
> > > wrote:
> > > >
> > > > > Accumulo Developers,
> > > > >
> > > > > Please consider the following candidate for Apache Accumulo 1.9.0.
> > > > >
> > > > > Git Commit:
> > > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > Branch:
> > > > >     1.9.0-rc1
> > > > >
> > > > > If this vote passes, a gpg-signed tag will be created using:
> > > > >     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > >
> > > > > Staging repo:
> > > > >
> > > >
> > > https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> > > > > Source (official release artifact):
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> > > > > Binary:
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> > > > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash
for a
> > > > > given artifact.)
> > > > >
> > > > > All artifacts were built and staged with:
> > > > >     mvn release:prepare && mvn release:perform
> > > > >
> > > > > Signing keys are available at
> > > https://www.apache.org/dist/accumulo/KEYS
> > > > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > > > >
> > > > > Release notes (in progress) can be found at:
> > > > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > > > >
> > > > > Please vote one of:
> > > > > [ ] +1 - I have verified and accept...
> > > > > [ ] +0 - I have reservations, but not strong enough to vote against...
> > > > > [ ] -1 - Because..., I do not accept...
> > > > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > > > >
> > > > > This vote will remain open until at least Sun Apr 15 22:30:00 UTC
2018
> > > > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > > > Voting continues until the release manager sends an email closing
the
> > > > vote.
> > > > >
> > > > > Thanks!
> > > > >
> > > > > P.S. Hint: download the whole staging repo with
> > > > >     wget -erobots=off -r -l inf -np -nH \
> > > > >
> > > > >
> > > >
> > > https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
> > > > >     # note the trailing slash is needed
> > > > >
> > > >
> > >
> > 
> 

Mime
View raw message