myfaces-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Mike Kienenberger <mkien...@gmail.com>
Subject Re: [VOTE] release of MyFaces Core 2.1.9
Date Thu, 13 Sep 2012 15:44:19 GMT
I still have to vote -1 until we have fixed the licenses for all files
that need licenses.  Licensing is one of the few absolute requirements
for an approved release.

I know that this vote is dying the death of a thousand cuts, but I am
doing the best I can to identify as many problems at once.   What has
taken me several hours to identify this morning could have been done
by someone knowledgeable with maven in a few minutes.


On Thu, Sep 13, 2012 at 11:22 AM, Leonardo Uribe <lu4242@gmail.com> wrote:
> Hi
>
> Ok, good to know that. Maybe we can enable rat on the next release. I
> think we can continue with the release vote too.
>
> regards,
>
> Leonardo
>
> 2012/9/13 Mike Kienenberger <mkienenb@gmail.com>:
>> And here's what I did to come up with this list:
>>
>> mvn apache-rat:check -Drat.numUnapprovedLicenses=9999
>>
>> ls -1 */target/rat.txt
>>
>> api/target/rat.txt
>> bundle/target/rat.txt
>> implee6/target/rat.txt
>> impl/target/rat.txt
>> parent/target/rat.txt
>> shaded-impl/target/rat.txt
>> shared-public/target/rat.txt
>> shared/target/rat.txt
>>
>> and then went through that list of files by hand.
>>
>>
>> On Thu, Sep 13, 2012 at 11:07 AM, Mike Kienenberger <mkienenb@gmail.com> wrote:
>>> Due to my lack of maven experience, it's taken me awhile to figure out
>>> how to configure apache rat so that I could get past the two license
>>> exceptions in the api project.
>>>
>>> Here's the full list of unapproved files in the rest of the project:
>>>
>>> implee6/src/main/resources/META-INF/services/javax.servlet.ServletContainerInitializer
>>>
>>> impl/src/test/java/org/apache/myfaces/config/annotation/ClassByteCodeAnnotationFilterTest.java
>>> impl/src/test/resources/META-INF/services/org.apache.myfaces.config.annotation.LifecycleProvider
>>> impl/src/test/resources/org/apache/myfaces/view/facelets/tag/composite/testSimpleThisResourceReference.xhtml
>>> impl/src/test/resources/org/apache/myfaces/view/facelets/tag/composite/javax.faces/jsf.js
>>> impl/src/test/resources/org/apache/myfaces/view/facelets/tag/jsf/html/javax.faces/jsf.js
>>> impl/src/test/resources/org/apache/myfaces/view/facelets/updateheadres/resources/javax.faces/jsf.js
>>> impl/src/test/resources/org/apache/myfaces/lifecycle/view2.xhtml
>>> impl/src/test/resources/org/apache/myfaces/lifecycle/view1.jsp
>>> impl/src/test/resources/org/apache/myfaces/context/nestedScriptCDATA.xml
>>> impl/src/main/resources/META-INF/xdoc-component.vmimpl/src/main/resources/META-INF/licenses/glassfish-LICENSE.txt
>>> impl/src/main/resources/META-INF/licenses/facelets-LICENSE.txt
>>> impl/src/main/resources/META-INF/services/org.apache.myfaces.config.annotation.LifecycleProvider
>>> impl/src/main/resources/META-INF/xdoc-tag.vm
>>> impl/src/main/resources/META-INF/xdoc-web-config.vm
>>> impl/src/main/resources/org/apache/myfaces/resource/javaee_5.xsd
>>> impl/src/main/resources/org/apache/myfaces/resource/javaee_web_services_client_1_2.xsd
>>> impl/src/main/conf/META-INF/.standard-faces-config-base.xml.jsfdia
>>>
>>> shared-public/src/test/resources/org/apache/myfaces/shared/application/view2.xhtml
>>> shared-public/src/test/resources/org/apache/myfaces/shared/application/view1.jsp
>>>
>>> shared/src/test/resources/org/apache/myfaces/shared/application/view2.xhtml
>>> shared/src/test/resources/org/apache/myfaces/shared/application/view1.jsp
>>>
>>>
>>> Here is what needed to be added to the api/om.xml file in order to
>>> skip the two files.   From what I can tell, we probably should write
>>> license rules for these files rather than exclude them, but that's not
>>> a show-stopper.
>>>
>>>       <plugin>
>>>         <groupId>org.apache.rat</groupId>
>>>         <artifactId>apache-rat-plugin</artifactId>
>>>         <configuration>
>>>           <excludes>
>>>             <exclude>src/main/resources/META-INF/licenses/dojo-LICENSE.TXT</exclude>
>>>             <exclude>src/main/resources/META-INF/licenses/facelets-LICENSE.txt</exclude>
>>>           </excludes>
>>>         </configuration>
>>>       </plugin>
>>>
>>>
>>> On Wed, Sep 12, 2012 at 2:08 AM, Leonardo Uribe <lu4242@gmail.com> wrote:
>>>> Hi
>>>>
>>>> I have updated the artifacts, so we can continue the vote. Please put
>>>> the vote on the mail with subject:
>>>>
>>>> [VOTE] release of Apache MyFaces 2.1.9
>>>> [VOTE] release of Apache MyFaces 2.0.15
>>>>
>>>> regards,
>>>>
>>>> Leonardo Uribe
>>>>
>>>> 2012/9/11 Leonardo Uribe <lu4242@gmail.com>:
>>>>> Hi
>>>>>
>>>>> It seems that one is the only artifact that does not have the update.
>>>>> All other source files installed in nexus repository are ok. Maybe it
>>>>> was because the assembly files were compiled before the final
>>>>> sources-release.zip file, so the old one was used.
>>>>>
>>>>> I'll rebuild everything everything again and send another vote mail.
>>>>> Thanks for notice it.
>>>>>
>>>>> regards,
>>>>>
>>>>> Leonardo
>>>>>
>>>>> 2012/9/11 Mike Kienenberger <mkienenb@gmail.com>:
>>>>>> So I finally thought to look at the dates of the files inside of
the
>>>>>>  the Sep 10th myfaces-core-module-2.1.9-source-release.zip file.
>>>>>> They are all from
>>>>>> Sep 4th, so the problem does appear to be that this piece wasn't
>>>>>> rebuilt in your last release.   This is probably why the license
files
>>>>>> are still missing.
>>>>>>
>>>>>>
>>>>>> On Tue, Sep 11, 2012 at 10:51 PM, Mike Kienenberger <mkienenb@gmail.com>
wrote:
>>>>>>> Leonardo,
>>>>>>>
>>>>>>> Rat is still complaining about the same 7 licensing issues.
>>>>>>>
>>>>>>> However, only certain instances of these files appear to be missing
licenses.
>>>>>>>
>>>>>>> myfaces-core-2.1.9-src> find . -name _ExtLang.js -exec ls
-1 {} \;
>>>>>>>
>>>>>>> .This one has the license header.  It comes from
>>>>>>> myfaces-api-2.1.9-sources.jar inside of
>>>>>>> myfaces-core-assembly-2.1.9-src.tar.gz
>>>>>>>
>>>>>>> exists -- ./src/META-INF/internal-resources/org.apache.myfaces.core.impl.util/_ExtLang.js
>>>>>>>
>>>>>>>
>>>>>>> The following two are identical.  The first one is the one rat
flags
>>>>>>> as needing a header.   I guess that's because it's the "source"
>>>>>>> version of all the rest of them.   It comes from
>>>>>>> myfaces-core-module-2.1.9-source-release.zip inside of
>>>>>>> myfaces-core-assembly-2.1.9-src.tar.gz.   Maybe this file also
needs
>>>>>>> to be fixed in svn?  I was not able to determine where this file
comes
>>>>>>> from in SVN.   You had said that module was essentially a snapshot
of
>>>>>>> SVN.   Maybe this snapshot did not get updated because we reused
the
>>>>>>> version number?
>>>>>>>
>>>>>>> missing -- ./src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_ExtLang.js
>>>>>>>
>>>>>>> missing -- ./src/myfaces-core-module-2.1.9/api/target/classes/META-INF/internal-resources/org.apache.myfaces.core.impl.util/_ExtLang.js
>>>>>>>
>>>>>>> [........ The rest of this email can likely be ignored....]
>>>>>>>
>>>>>>> The following two are the compressed-down versions with no extra
>>>>>>> whitespace or comments, which is what you would expect:
>>>>>>>
>>>>>>> missing -- ./src/myfaces-core-module-2.1.9/api/target/classes/META-INF/internal-resources/javax.faces/META-INF/resources/myfaces/_impl/_util/_ExtLang.js
>>>>>>>
>>>>>>> missing -- ./src/myfaces-core-module-2.1.9/api/target/classes/META-INF/resources/myfaces/META-INF/resources/myfaces/_impl/_util/_ExtLang.js
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> I have double and triple-checked to insure that I have a new
>>>>>>> myfaces-core-assembly-2.1.9-src.tar.gz download, and all of the
files
>>>>>>> inside it were built on Sep 10, 8-to-10pm EST, which is right
before
>>>>>>> the email you sent out.
>>>>>>>
>>>>>>> -rw-r--r-- 1 mkienenb users 8119569 Sep 10 21:31
>>>>>>> myfaces-core-assembly-2.1.9-src.tar.gz
>>>>>>> -rw-r--r-- 1 mkienenb users 8119322 Sep 10 21:30
>>>>>>> myfaces-core-assembly-2.1.9-src.zip
>>>>>>>
>>>>>>> -rw-rw-r--  1 mkienenb users  900906 Sep 10 20:24 myfaces-api-2.1.9-sources.jar
>>>>>>> drwxrwxr-x 12 mkienenb users    4096 Sep 11 21:50 myfaces-core-module-2.1.9
>>>>>>> -rw-rw-r--  1 mkienenb users 5863230 Sep 10 20:24
>>>>>>> myfaces-core-module-2.1.9-source-release.zip
>>>>>>> -rw-rw-r--  1 mkienenb users 1809659 Sep 10 20:24 myfaces-impl-2.1.9-sources.jar
>>>>>>> -rw-rw-r--  1 mkienenb users  423440 Sep 10 20:24
>>>>>>> myfaces-impl-shared-2.1.9-sources.jar
>>>>>>> \
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> Unapproved licenses:
>>>>>>>
>>>>>>>   /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_EvalHandlers.js
>>>>>>>   /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_RuntimeQuirks.js
>>>>>>>   /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/xhrCore/engine/BaseRequest.js
>>>>>>>   /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_DomExperimental.js
>>>>>>>   /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_ExtLang.js
>>>>>>>   /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/dojo-LICENSE.TXT
>>>>>>>   /home/mkienenb/temp/myfaces/people.apache.org/~lu4242/myfaces219binsrc/sources/myfaces-core-2.1.9-src/src/myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/facelets-LICENSE.txt
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> On Mon, Sep 10, 2012 at 10:06 PM, Leonardo Uribe <lu4242@gmail.com>
wrote:
>>>>>>>> Hi
>>>>>>>>
>>>>>>>> I have fixed the files with missing licenses, included a
fix for
>>>>>>>> MYFACES-3605, so I'll send another vote over the new artifacts
soon.
>>>>>>>>
>>>>>>>> regards,
>>>>>>>>
>>>>>>>> Leonardo Uribe
>>>>>>>>
>>>>>>>> 2012/9/7 Leonardo Uribe <lu4242@gmail.com>:
>>>>>>>>> Hi
>>>>>>>>>
>>>>>>>>> 2012/9/7 Mike Kienenberger <mkienenb@gmail.com>:
>>>>>>>>>>  [X] -1 for fatal flaws that should cause these bits
not to be released:
>>>>>>>>>>
>>>>>>>>>> Looks like we have 5 files missing licensing information.
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> 7 Unknown Licenses
>>>>>>>>>>
>>>>>>>>>> *******************************
>>>>>>>>>>
>>>>>>>>>> Unapproved licenses:
>>>>>>>>>>
>>>>>>>>>> The five files below appear to be missing any kind
of licensing
>>>>>>>>>> information.    The rest of the files in this directory
have licensing
>>>>>>>>>> information.
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_EvalHandlers.js
>>>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/core/_RuntimeQuirks.js
>>>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/xhrCore/engine/BaseRequest.js
>>>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_DomExperimental.js
>>>>>>>>>> myfaces-core-module-2.1.9/api/src/main/javascript/META-INF/resources/myfaces/_impl/_util/_ExtLang.js
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> It seems to be related to some refactoring into our code
base.
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/dojo-LICENSE.TXT
>>>>>>>>>>
>>>>>>>>>> "New" BSD or AFL 2.1.  Bsd is approved, so maybe
just add to exclude list.
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> Yes
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> myfaces-core-module-2.1.9/api/src/main/resources/META-INF/licenses/facelets-LICENSE.txt
>>>>>>>>>>
>>>>>>>>>> APL 2, but unusual format? -- add to exclude list?
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> Yes.
>>>>>>>>>
>>>>>>>>> regards,
>>>>>>>>>
>>>>>>>>> Leonardo Uribe
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> Below is the link describing what we need to do to
add files to an exclude list.
>>>>>>>>>>
>>>>>>>>>> http://mail-archives.apache.org/mod_mbox/jackrabbit-dev/200907.mbox/%3C510143ac0907010606j73c9d973yf40d8c2b03896cba@mail.gmail.com%3E
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> On Thu, Sep 6, 2012 at 11:30 PM, Mike Kienenberger
<mkienenb@gmail.com> wrote:
>>>>>>>>>>> Thanks!  Not sure how I missed that one.   Withdrawing
my vote.   I'll
>>>>>>>>>>> let you know how it turns out.
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> On Thu, Sep 6, 2012 at 11:20 PM, Leonardo Uribe
<lu4242@gmail.com> wrote:
>>>>>>>>>>>> Hi
>>>>>>>>>>>>
>>>>>>>>>>>> This artifact:
>>>>>>>>>>>>
>>>>>>>>>>>> https://repository.apache.org/content/repositories/orgapachemyfaces-034/org/apache/myfaces/core/myfaces-core-module/2.1.9/myfaces-core-module-2.1.9-source-release.zip
>>>>>>>>>>>>
>>>>>>>>>>>> is the one that allows to build it using
maven. In practice, it is a
>>>>>>>>>>>> copy of the sources from the svn. This artifact
is included also in:
>>>>>>>>>>>>
>>>>>>>>>>>> https://repository.apache.org/content/repositories/orgapachemyfaces-034/org/apache/myfaces/core/myfaces-core-assembly/2.1.9/myfaces-core-assembly-2.1.9-src.zip
>>>>>>>>>>>>
>>>>>>>>>>>> Build it is quite simple: unpack and mvn
install.
>>>>>>>>>>>>
>>>>>>>>>>>> regards,
>>>>>>>>>>>>
>>>>>>>>>>>> Leonardo Uribe
>>>>>>>>>>>>
>>>>>>>>>>>> 2012/9/6 Mike Kienenberger <mkienenb@gmail.com>:
>>>>>>>>>>>>> So I'm doing the work to vote for a release
-- something I haven't
>>>>>>>>>>>>> participated in in a very long time.
>>>>>>>>>>>>>
>>>>>>>>>>>>> Leonardo's key in KEYS - check
>>>>>>>>>>>>> .jar.md5 matches - check
>>>>>>>>>>>>> .jar.asc.md5 matches - check
>>>>>>>>>>>>> .jar.sha1 matches -check
>>>>>>>>>>>>> .jar.asc.sha1 matches -check
>>>>>>>>>>>>> .asc files mat
>>>>>>>>>>>>>
>>>>>>>>>>>>> Includes source - check
>>>>>>>>>>>>> Source builds --  Not seeing any kind
of build system or build instructions.
>>>>>>>>>>>>>
>>>>>>>>>>>>> Checking our web site only shows how
to build from an svn checkout.
>>>>>>>>>>>>>
>>>>>>>>>>>>> Did we somehow lose the ability to build
from our released source when
>>>>>>>>>>>>> we switched to maven?
>>>>>>>>>>>>> Because unless something has changed
this is a big deal.
>>>>>>>>>>>>>
>>>>>>>>>>>>> http://www.apache.org/dev/release.html#what
>>>>>>>>>>>>> ====================
>>>>>>>>>>>>> What Must Every ASF Release Contain?
>>>>>>>>>>>>>
>>>>>>>>>>>>> Every ASF release *must* contain a source
package, which must be
>>>>>>>>>>>>> sufficient for a user to build and test
the release provided they have
>>>>>>>>>>>>> access to the appropriate platform and
tools.
>>>>>>>>>>>>> [...]
>>>>>>>>>>>>> What are the ASF requirements on approving
a release?
>>>>>>>>>>>>>
>>>>>>>>>>>>> [...] Before voting +1 PMC members are
required to download the signed
>>>>>>>>>>>>> source code package, compile it as provided,
and test the resulting
>>>>>>>>>>>>> executable on their own platform, along
with also verifying that the
>>>>>>>>>>>>> package contains the required contents.
>>>>>>>>>>>>> ====================
>>>>>>>>>>>>>
>>>>>>>>>>>>> We hit this issue in Cayenne a couple
years back and had to do some
>>>>>>>>>>>>> work to fix it.
>>>>>>>>>>>>>
>>>>>>>>>>>>> http://markmail.org/thread/njray5dbazwcdcts
>>>>>>>>>>>>>
>>>>>>>>>>>>> The natural inclination is to argue about
it and try to say it's not
>>>>>>>>>>>>> required.   One can read through lots
of threads on that if you really
>>>>>>>>>>>>> want to satisfy that need.
>>>>>>>>>>>>>
>>>>>>>>>>>>> But it all comes down to the fact that
our "open source" releases need
>>>>>>>>>>>>> to be something that someone can modify
and build.   And right now,
>>>>>>>>>>>>> that isn't doable.  Source control systems
come and go.   The ASF
>>>>>>>>>>>>> might disappear next year.   Or you might
just be some poor guy who,
>>>>>>>>>>>>> five years from now, has to work on a
project I wrote to fix some
>>>>>>>>>>>>> minor bug and find that the particular
branch for Myfaces 2.1.9
>>>>>>>>>>>>> accidentally got corrupted.  The reasons
for why it is done this way
>>>>>>>>>>>>> are numerous and worthwhile.   But even
if that doesn't sell you on
>>>>>>>>>>>>> it, in the end it comes down to being
a requirement of a release,
>>>>>>>>>>>>> whether or not you agree with it.
>>>>>>>>>>>>>
>>>>>>>>>>>>> http://mail-archives.apache.org/mod_mbox/cayenne-dev/201008.mbox/%3CAANLkTi=YKjoAW6SuKPTi_wfHcOLkLY4xCwO_CpfjXwOs@mail.gmail.com%3E
>>>>>>>>>>>>>
>>>>>>>>>>>>> http://mail-archives.apache.org/mod_mbox/cayenne-dev/201008.mbox/%3CAANLkTi=UT4HE_ntJQMaqN4tj2jXgBeAkBSrcDo9ZHtxo@mail.gmail.com%3E
>>>>>>>>>>>>>
>>>>>>>>>>>>> http://mail-archives.apache.org/mod_mbox/cayenne-dev/201008.mbox/%3CAANLkTikOgYVs+L8SyJ0bOvCuB1780xytfCA9bvMvE27w@mail.gmail.com%3E
>>>>>>>>>>>>>
>>>>>>>>>>>>> But don't just take my word on it, read
through the 123 messages on
>>>>>>>>>>>>> the legal discuss thread :)
>>>>>>>>>>>>>
>>>>>>>>>>>>> http://markmail.org/thread/njray5dbazwcdcts
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> So at least for now,
>>>>>>>>>>>>>
>>>>>>>>>>>>>  [X] -1 for fatal flaws that should cause
these bits not to be released:
>>>>>>>>>>>>>
>>>>>>>>>>>>> - Release cannot be built and tested
from source.

Mime
View raw message