On 18 December 2014 at 23:56, Luc Maisonobe <l...@spaceroots.org> wrote: > Le 19/12/2014 00:50, sebb a écrit : >> On 18 December 2014 at 23:19, Luc Maisonobe <l...@spaceroots.org> wrote: >>> This is a [VOTE] for releasing Apache Commons Math 3.4. >>> >>> Note that since [math] now uses git, access to the tag is slightly >>> different from other components. To clone a fresh tag, run this command >>> (beware I have split it in 2 lines below): >>> >>> git clone https://git-wip-us.apache.org/repos/asf/commons-math.git \ >>> --branch MATH_3_4_RC1 >> >> -1 >> >> This is insufficient to identify the code; branches are not immutable. >> >> Most (all?) other Git projects use a URL which includes the hash. >> For example, a current Incubator vote includes the following: >> >> The Git commit ID is 94b42b85e80efd817f951326238864 >> e37edc2cb0 >> https://git-wip-us.apache.org/repos/asf?p=incubator-brooklyn.git;a=commit;h=94b42b85e80efd817f951326238864e37edc2cb0 > > The SHA1 is stored directly in the manifest, withing the distribution. > For this release candidate, it is > > cf4a9d70c9ac24dd7196995390171150e4e56451 > > I agree I did not put it in the mail, but you can check it in the artifacts.
The point is to be able to trace provenance from the VOTE to the released artifacts. Also to make it easy for the reviewers to be able to check the release candidate without having to jump through hoops. It is not clear to me how I can use the SHA1 hash to get the exact set of files from Git that were used to create the release artifacts. The VOTE email should include all the information needed to validate a release. > best regards, > Luc > >> >> >> >>> To verify the tag (as git does sign tags with GPG), use this: >>> >>> cd commons-math >>> git tag -v MATH_3_4_RC1 >>> >>> The site will be available in the staging area, it takes a few hours to >>> transfer from my machine: >>> <http://commons.staging.apache.org/proper/commons-math/> >>> >>> Distribution files: >>> <https://dist.apache.org/repos/dist/dev/commons/math/> >> >> -1 >> >> The revision number is needed in order to uniquely identify the >> artifacts being voted on. >> Alternatively, provide hashes. >> >>> Maven artifacts: >>> >>> <https://repository.apache.org/content/repositories/orgapachecommons-1066/org/apache/commons/commons-math3/3.4/> >>> >>> >>> [ ] +1 Release it. >>> [ ] +0 Go ahead; I don't care. >>> [ ] -0 There are a few minor glitches: ... >>> [ ] -1 No, do not release it because ... >> >> -1 >> >> The NOTICE file needs severe pruning. >> I don't think any of the attributions are required. >> >>> This vote will close in 72 hours, at 2014-12-21T23:15:00Z (this is UTC >>> time). >>> >>> best regards, >>> Luc >>> >>> --------------------------------------------------------------------- >>> To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org >>> For additional commands, e-mail: dev-h...@commons.apache.org >>> >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org >> For additional commands, e-mail: dev-h...@commons.apache.org >> >> >> > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org > For additional commands, e-mail: dev-h...@commons.apache.org > --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mail: dev-h...@commons.apache.org
