Mailing-List: contact dev-help@geronimo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@geronimo.apache.org
Received-SPF: pass (athena.apache.org: local policy)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.com;
  h=Received:X-YMail-OSG:X-Yahoo-Newman-Property:Message-Id:From:To:In-Reply-To:Content-Type:Content-Transfer-Encoding:Mime-Version:Subject:Date:References:X-Mailer;
  b=I2QxSIdbbq8sS82chARHviFftUPG9zJSEgtMuFnthIumMzZMr7WJiK2Citw3YiMNiRs5usVQ7v93/QrxneclNFbsj38PXV5AyLsobkzrKTLPBNlyTYQm+aZSs4K3zQ74DJ685zUiHdjXsn0TWhCDokEJRIlf4ZQ8L89/gT0hG0s=
  ;
Message-Id: <4B60FC3F-1AAC-4445-895C-8D01653BF221@yahoo.com>
From: David Jencks <david_jencks@yahoo.com>
To: dev@geronimo.apache.org
In-Reply-To: <4828469D.9050905@earthlink.net>
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v919.2)
Subject: Re: [DISCUSS] do additional artifacts need to be removed as part of
 the release process.
Date: Mon, 12 May 2008 10:12:37 -0700
References: <48283383.7070705@gmail.com> <4828469D.9050905@earthlink.net>


On May 12, 2008, at 6:31 AM, Joe Bohn wrote:

> Rick McGuire wrote:
>> This is an issue that came up with the vote on 1.0 Yoko release.   
>> The new release process detailed at
>> http://cwiki.apache.org/confluence/display/GMOxPMGT/Geronimo+release+process 
>>  generates a bunch of extra artifacts that are .md5 and sha1  
>> signatures for the .asc files. So, for every jar file, you will get  
>> a .asc file, plus additional asc.md5 and asc.sha1 files.
>> In our old release process, one of the steps was to erase all of  
>> the *.asc.* files before staging the release for a vote.  Now that  
>> this is done automatically by using the plugins, these extra  
>> artifacts get included, and even get staged to the repos.  For  
>> example, see the artifacts that got published for the last javamail  
>> release, which was the most recent release to use this process:
>> http://repo1.maven.org/maven2/org/apache/geronimo/javamail/geronimo-javamail_1.4_provider/1.4/ 
>>  Should our release process include the step to delete these  
>> additional files?  Or should this be something that should/could be  
>> fixed in the plugin so that these extraneous files don't get  
>> included accidentally?
>
>
> I had the same question when I released javamail.  After some  
> thought I decided that the extra files didn't hurt anything and  
> provide some measure of additional security in that you could (and  
> perhaps should) verify that the asc files themselves haven't been  
> corrupted.

I didn't understand why the original release instructions had the  
"delete the required signature files" step.  These files are required  
as part of an apache release and for uploading to a maven repo.  They  
should be checked as part of the release vote.  Don't remove them.

thanks
david jencks

>
>
> Joe