openwhisk-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Bertrand Delacretaz <bdelacre...@apache.org>
Subject Re: [VOTE] Release Apache OpenWhisk 0.9.0-incubating
Date Thu, 21 Jun 2018 11:04:26 GMT
Hi Vincent,

Thanks for your work in preparing this release!

On Wed, Jun 20, 2018 at 11:16 PM Vincent S Hou <shou@us.ibm.com> wrote:
> ...There are totally 13 OpenWhisk projects within this release....

As mentioned earlier I don't think it is a good idea to release
multiple modules in your first Incubator release: if a single module
has a problem the whole release will fail, and it's not convenient for
Incubator PMC reviewers (who might not be very familiar with your
code) to review multiple modules in one go. I'm not sure if the
Incubator PMC would even accept voting on multiple artifacts with a
single vote.

I recommend releasing one module first, to validate the release voting
process and to get feedback that's probably applicable for other
modules as well.

With this in mind I have just looked at
openwhisk-0.9.0-incubating-sources.tar.gz so far, here are my
comments:

1) The digests match.

2) The 22CC20CC key used to sign the release is not available at
https://dist.apache.org/repos/dist/release/incubator/openwhisk/KEYS
(that file doesn't exist) nor at
https://people.apache.org/keys/group/openwhisk.asc

3) I don't find build instructions in the README (which is also at
https://github.com/apache/incubator-openwhisk), for convenience

I'm not very familiar with gradle, tried this:

./gradlew tasks
  doesn't show anything specific to OpenWhisk IIUC

./gradlew tasks --all
  shows many tasks, it's unclear where to start

I usually expect to see clear build instructions in such a release
archive, but maybe I missed something.

4) LICENSE, DISCLAIMER, NOTICE look good to me

5) The .scala code files are in whisk.* packages, that should be
org.apache.openwhisk.* for an Apache project.

6) I suppose you used Apache Rat to validate the license headers, I
don't see instructions on how to run it to make those checks myself.

7) There's an RSA private key in the source archive, if it's for
testing purposes it should be clearly identified as such (ideally
named test- something) to reassure people that it's not problematic to
distribute it (./ansible/roles/nginx/files/openwhisk-server-key.pem).

8) I don't see binary files in the release archive which is good,
except for ./gradle/wrapper/gradle-wrapper.jar which I think is
acceptable - but its digest should be kept track of, maybe in a jira
ticket so people can validate it if they want.

Those are the types of comments that you might get when the Incubator
PMC validates releases, I suppose many of them apply to multiple
projects so it's  easier to start with just one module, fix or clarify
these things and then do the rest.

-Bertrand (with my incubation mentor hat on)

Mime
View raw message