maven-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Hervé BOUTEMY <herve.bout...@free.fr>
Subject Re: [VOTE] Release Apache Maven 3.5.2
Date Sat, 21 Oct 2017 02:17:31 GMT
+1
tested on Linux and Windows 10 (with cmd, PowerShell, GitBash, Cygwin)

this time, color appears on Windows in every configuration I know of :)

verification of binary artifacts: I tried to compare binary artifacts built 
locally with artifacts in staging repo (using diffoscope)

Good news: using my own JDK 8 (which is not exactly the same as Stephen, and I 
suppose we don't have the same OS: OSX vs Linux), I got the same .class 
binaries
The only differences are the usual ones on generated content: I found 2 
notable new little differences in maven-core-3.5.2.jar:
1. META-INF/sisu/javax.inject.Named content ordering (not a surprise given 
same issue in META-INF/plexus/components.xml)
2. org/apache/maven/messages/build.properties:
  -buildNumber=NON-CANONICAL_2017-10-20T00:16:35+02:00_herve
  -timestamp=1508451395983
  +buildNumber=138edd61fd100ec658bfa2d307c43b76940a5d7d
  +timestamp=1508313493546

this second difference is important to me, since this is exactly one case 
where "reproducible build" objective is against another key Apache objective, 
which is to build from source tarball disconnected from scm and keep 
traceability inside the built artifact

but in general, this makes me think that by defining the major level of JDK 
used to build the reference binary artifacts (and improving the known issues), 
we can get binary verifiable artifacts
ie we can check that the artifacts are not modified by simply checking hash 
(instead of using diffoscope and manually analyzing the output)

Regards,

Hervé

Le mercredi 18 octobre 2017, 03:50:43 CEST Stephen Connolly a écrit :
> Hi,
> 
> We solved 26 issues:
> https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12338964&styl
> eName=Text&projectId=12316922
> 
> There are 357 issues left in JIRA for Maven core:
> https://issues.apache.org/jira/issues/?jql=project%20%3D%20MNG%20AND%20resol
> ution%20%3D%20Unresolved%20ORDER%20BY%20due%20ASC%2C%20priority%20DESC%2C%20
> created%20ASC
> 
> Staging repo:
> https://repository.apache.org/content/repositories/maven-1373/
> 
> The distributable binaries and sources can be found here:
> https://repository.apache.org/content/repositories/maven-1373/org/apache/mav
> en/apache-maven/3.5.2/
> 
> Specifically the zip, tarball and source archives can be found here:
> https://repository.apache.org/content/repositories/maven-1373/org/apache/mav
> en/apache-maven/3.5.2/apache-maven-3.5.2-bin.zip
> https://repository.apache.org/content/repositories/maven-1373/org/apache/ma
> ven/apache-maven/3.5.2/apache-maven-3.5.2-bin.tar.gz
> https://repository.apache.org/content/repositories/maven-1373/org/apache/ma
> ven/apache-maven/3.5.2/apache-maven-3.5.2-src.zip
> https://repository.apache.org/content/repositories/maven-1373/org/apache/ma
> ven/apache-maven/3.5.2/apache-maven-3.5.2-src.tar.gz
> 
> Source release checksum(s):
> apache-maven-3.5.2-src.tar.gz sha1: 97d6d7b18485b7906dd7f313cdd41191d16dde46
> apache-maven-3.5.2-src.zip: sha1: dc8caa5cdacb400943d2491a020f742a518e8f08
> 
> Git tag:
> https://git-wip-us.apache.org/repos/asf?p=maven.git;a=commit;h=138edd61fd100
> ec658bfa2d307c43b76940a5d7d
> 
> Staging site:
> https://maven.apache.org/components/ref/3-LATEST/
> 
> Vote open for 72 hours.
> 
> [ ] +1
> [ ] +0
> [ ] -1
> 
> Thanks,
> 
> Stephen.



---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org


Mime
View raw message