Hi Bertrand, Thank you very much for your comments.
Let me clarify what you mean by one module: Does it mean we can try to release one of the 13 modules, like openwhisk, or openwhisk-cli, or consolidate all the 13 projects into one for release? * The key can be accessed at https://dist.apache.org/repos/dist/dev/incubator/openwhisk/KEYS. You missed "dev/" in your link. * So far the header is not verified with RAT. We have a unitiy repo call openwhisk-utility(https://github.com/apache/incubator-openwhisk-utilities) to scan all the code. RAT has issues, since I have never got it running correctly in openwhisk. The Travis build uses this openwhisk-utility to verify the headers for every incoming commit. * RSA private key should have some instructions. We will work on it. * We do not release binary this time. * We will look at the .scala code files. * For README, let me make the build instruction more clear. Best wishes. Vincent Hou (侯胜博) Advisory Software Engineer, OpenWhisk Contributor, Open Technology, IBM Cloud Notes ID: Vincent S Hou/Raleigh/IBM, E-mail: s...@us.ibm.com, Phone: +1(919)254-7182 Address: 4205 S Miami Blvd (Cornwallis Drive), Durham, NC 27703, United States -----Bertrand Delacretaz <bdelacre...@apache.org> wrote: ----- To: dev@openwhisk.apache.org From: Bertrand Delacretaz <bdelacre...@apache.org> Date: 06/21/2018 07:04AM Subject: Re: [VOTE] Release Apache OpenWhisk 0.9.0-incubating Hi Vincent, Thanks for your work in preparing this release! On Wed, Jun 20, 2018 at 11:16 PM Vincent S Hou <s...@us.ibm.com> wrote: > ...There are totally 13 OpenWhisk projects within this release.... As mentioned earlier I don't think it is a good idea to release multiple modules in your first Incubator release: if a single module has a problem the whole release will fail, and it's not convenient for Incubator PMC reviewers (who might not be very familiar with your code) to review multiple modules in one go. I'm not sure if the Incubator PMC would even accept voting on multiple artifacts with a single vote. I recommend releasing one module first, to validate the release voting process and to get feedback that's probably applicable for other modules as well. With this in mind I have just looked at openwhisk-0.9.0-incubating-sources.tar.gz so far, here are my comments: 1) The digests match. 2) The 22CC20CC key used to sign the release is not available at https://dist.apache.org/repos/dist/release/incubator/openwhisk/KEYS (that file doesn't exist) nor at https://people.apache.org/keys/group/openwhisk.asc 3) I don't find build instructions in the README (which is also at https://github.com/apache/incubator-openwhisk), for convenience I'm not very familiar with gradle, tried this: ./gradlew tasks doesn't show anything specific to OpenWhisk IIUC ./gradlew tasks --all shows many tasks, it's unclear where to start I usually expect to see clear build instructions in such a release archive, but maybe I missed something. 4) LICENSE, DISCLAIMER, NOTICE look good to me 5) The .scala code files are in whisk.* packages, that should be org.apache.openwhisk.* for an Apache project. 6) I suppose you used Apache Rat to validate the license headers, I don't see instructions on how to run it to make those checks myself. 7) There's an RSA private key in the source archive, if it's for testing purposes it should be clearly identified as such (ideally named test- something) to reassure people that it's not problematic to distribute it (./ansible/roles/nginx/files/openwhisk-server-key.pem). 8) I don't see binary files in the release archive which is good, except for ./gradle/wrapper/gradle-wrapper.jar which I think is acceptable - but its digest should be kept track of, maybe in a jira ticket so people can validate it if they want. Those are the types of comments that you might get when the Incubator PMC validates releases, I suppose many of them apply to multiple projects so it's easier to start with just one module, fix or clarify these things and then do the rest. -Bertrand (with my incubation mentor hat on)
