+1 (binding)
Checks I marked as MINOR and I'm fine with them being fixed prior to the
release (website/github issues updates) or in the next release
(license/reproducibility)
I checked:
[OK] hashes and signatures of source and helper binaries are correct
[OK] signature of git tag is correct
[OK] source release matches git tag
[OK] source compiles using yarn package
[OK] tests pass using yarn test
[OK] RAT check passes
[OK] no unexpected binaries in source
[OK] vsix installs without error
[OK] No open CVE's found using sbt-dependency-check plugin and yarn
audit (except for false positives)
[OK] played around with autocomplete and seemed to work as expected
[MINOR] Page for release candidate published on website
- Missing site on daffodil.apache.org, PR opened but not merged
[MINOR] compiled source matches convenience binary where expected
- The JAXB generated class files in daffodil-debugger jar are different
when I build from source. It's not clear to me what is different
(javap shows no differences) but this makes reproducible builds
difficult to verify and is a bit concerning. I don't know why these
files would be different. Even if generated from JAXB, I would expect
it to be deterministic and create the same .class files. Please look
into this for the next major release, reproducible builds are
important.
[MINOR] no closed issues without a milestone
- There are a number of issues that have been closed but have not been
assigned a milestone. Were they closed as part of 1.3.1? Can they be
added to this milestone or a previous milestone so there's a record of
what release fixed these issue?
https://github.com/apache/daffodil-vscode/issues?q=is%3Aissue+is%3Aclosed+no%3Amilestone
[MINOR] src and binaries include correct LICENSE/NOTICE
- typescript is listed in the NONOTICE file but is a devDependency and
isn't bundled in the vsix file and so does not need to be mentioned
- org.apache.tika.tika-core-2.7.0.jar is bundled as part of omega-edit.
It is licensed under ALv2 so is compatible, but its NOTICE content is
is missing from build/package/NOTICE
On 2023-09-05 04:25 PM, Shane Dell wrote:
Hello all,
I'd like to call a vote to release Apache Daffodil VS Code 1.3.1-rc2.
All distribution packages, including signatures, digests, etc. can be
found at:
https://dist.apache.org/repos/dist/dev/daffodil/daffodil-vscode/1.3.1-rc2
This release has been signed with PGP key
86DDE7B41291E380237934F007570D3ADC76D51B, corresponding
to [email protected], which is included in the KEYS file here:
https://downloads.apache.org/daffodil/KEYS
The release candidate has been tagged in git with 1.3.1-rc2.
For reference, here is a list of all closed GitHub issues tagged with 1.3.1:
https://github.com/apache/daffodil-vscode/milestone/10?closed=1
Please review and vote. The vote will be open for at least 72 hours
(Friday, 08 September 2023, 4:30pm EST).
[ ] +1 approve
[ ] +0 no opinion
[ ] -1 disapprove (and reason why)
Documentation for 1.3.1 can be found here
https://github.com/apache/daffodil-vscode/wiki/Apache-Daffodil%E2%84%A2-Extension-for-Visual-Studio-Code:-v1.3.1.
Thank you,
- Shane Dell
