That’s odd…. It seems to suggest something wrong with either wc or cmp -n in
your environment. It’s complaining about an expected suffix to the license
file, and rcverify.sh is supposed to handle that (snippet appended).
I am not seeing that diff being flagged (same version of rcverify.sh as you; on
MacOS with cmp v3.10 coming from GNU diffutils via homebrew).
--dave
# If a project bundles any dependencies, there will be additional
# text appended to LICENSE.txt to summarize the additional licenses.
# Therefore only enforce a prefix match between the project's
# LICENSE.txt and the official text of the Apache LICENSE-2.0.
printf "verifying license..."
LICENSE_LEN=$(wc -c "$DIR/LICENSE-2.0" | awk '{print $1}')
CMD="cmp -n $LICENSE_LEN '$DIR/LICENSE-2.0' '$DIR/$BASE/LICENSE.txt'"
CMP=$(eval "$CMD")
validate $? 0 "$CMD"
From: Rodric Rabbah <rod...@gmail.com>
Date: Tuesday, September 3, 2024 at 2:07 PM
To: dev@openwhisk.apache.org <dev@openwhisk.apache.org>
Subject: [EXTERNAL] Re: [VOTE] Release Apache OpenWhisk Runtime Docker
(v1.16.0, rc1)
i'm +1 but note that
rcverify failed for me on this, here's the log below and the diff
diff
'/var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX/LICENSE-2.0'
'/var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX/openwhisk-runtime-docker-1.16.0/LICENSE.txt'
202a203,210
>
> ========================================================================
> Apache License 2.0
> ========================================================================
>
> This product bundles the files gradlew and gradlew.bat from Gradle v5.5
> which are distributed under the Apache License, Version 2.0.
> For details see ./gradlew and ./gradlew.bat.
> ./rcverify.sh openwhisk-runtime-docker 1.16.0 rc1
rcverify.sh (script SHA1: 6DC9 462D 3035 5FD0 ADE6 9EF9 D0DF 1A25 13E1
5CFD)
working in the following directory:
/var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX
fetching tarball and signatures from
https://dist.apache.org/repos/dist/dev/openwhisk/rc1
fetching openwhisk-runtime-docker-1.16.0-sources.tar.gz... ok
fetching openwhisk-runtime-docker-1.16.0-sources.tar.gz.asc... ok
fetching openwhisk-runtime-docker-1.16.0-sources.tar.gz.sha512... ok
fetching apache license... ok
fetching release keys... ok
importing keys... ok (new keys imported (processed 14 unchanged ))
gpg: key 72AF0CC22C4CF320: public key "Vincent Hou (Release manager of
OpenWhisk) <houshen...@apache.org>" imported
gpg: key 22907064147F886E: public key "Dave Grove <gro...@us.ibm.com>"
imported
gpg: key 44667BC927C86D51: public key "Rodric Rabbah <rab...@apache.org>"
imported
gpg: key B1457C3D7101CC78: public key "James Thomas <jamestho...@apache.org>"
imported
gpg: key A600E3331427515D: public key "Olivier Tardieu <tard...@apache.org>"
imported
gpg: key 804F627B2D1BD1A0: 6 signatures not checked due to missing keys
gpg: key 804F627B2D1BD1A0: public key "Alexander Klimetschek (Adobe Work
Email) <aklim...@adobe.com>" imported
gpg: key 758C332F8D30E5A2: 1 signature not checked due to a missing key
gpg: key 758C332F8D30E5A2: public key "Alexander Klimetschek (Apache
Committer Key) <alex...@apache.org>" imported
gpg: key B5B8ADA933BB2FFF: public key "Dominic Kim <styl...@apache.org>"
imported
gpg: key A1F071AF3F62EEFF: 3 signatures not checked due to missing keys
gpg: key A1F071AF3F62EEFF: public key "keybase.io/akrabat <
akra...@keybase.io>" imported
gpg: key 395282A61D88D0AC: public key "Matt Rutkowski <mrutkow...@apache.org>"
imported
gpg: key 7050DAD4D8D21A6B: public key "Shawn Black <shawnalle...@apache.org>"
imported
gpg: key 1683F2D3AF54F2F1: public key "Tyson Norris <tysonnor...@apache.org>"
imported
gpg: key 44FA19E603F812E5: public key "Cosmin Stanciu (CODE SIGNING KEY) <
stan...@apache.org>" imported
gpg: key 44667BC927C86D51: "Rodric Rabbah <rab...@apache.org>" 3 new
signatures
gpg: Total number processed: 14
gpg: imported: 13
gpg: new signatures: 3
gpg: marginals needed: 3 completes needed: 1 trust model: pgp
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: next trustdb check due at 2026-12-14
unpacking tar ball... ok
cloning scancode... ok
computing sha512 for openwhisk-runtime-docker-1.16.0-sources.tar.gz... ok
openwhisk-runtime-docker-1.16.0-sources.tar.gz:
4195F7B3 BD4D2B9F 8D59CF1A 4AF3EA42 E9E74DE8 EB8BDB85 CF9A7EC4 064B2E66
275DEC13 6A84341B A38026C3 96E5862C 837C38A4 02B7133B 929E8F75 D5B9BF53
validating sha512... passed
verifying asc... passed (signed-by: Dave Grove <dgr...@apache.org>)
verifying notice... passed
verifying absence of DISCLAIMER.txt passed
verifying license...cmp: EOF on
/var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX/LICENSE-2.0
failed (cmp -n 11358
'/var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX/LICENSE-2.0'
'/var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX/openwhisk-runtime-docker-1.16.0/LICENSE.txt')
verifying sources have proper headers... passed
scanning for executable files... passed
scanning for unexpected file types... passed
scanning for archives... passed
scanning for packages... passed
scanning package.json for version match... passed (none detected)
scanning package-lock.json for version match... passed (none detected)
On Tue, Sep 3, 2024 at 1:21 PM David Grove <gro...@us.ibm.com> wrote:
> Hi,
>
> This is a call to vote on releasing version 1.16.0 release candidate rc1
> of the following project module with artifacts built from the Git
> repositories and commit IDs listed below.
>
> * OpenWhisk Runtime Docker: 64943d7cfb393b6d4d137569f502e61a0efd212e
>
> https://github.com/apache/openwhisk-runtime-docker/commit/64943d7cfb393b6d4d137569f502e61a0efd212e
>
> https://dist.apache.org/repos/dist/dev/openwhisk/rc1/openwhisk-runtime-docker-1.16.0-sources.tar.gz
>
> https://dist.apache.org/repos/dist/dev/openwhisk/rc1/openwhisk-runtime-docker-1.16.0-sources.tar.gz.asc
>
> https://dist.apache.org/repos/dist/dev/openwhisk/rc1/openwhisk-runtime-docker-1.16.0-sources.tar.gz.sha512
>
> This release is comprised of source code distribution only.
>
> You can use this UNIX script to download the release and verify the
> checklist below:
> https://github.com/apache/openwhisk-release/blob/1f9463f/tools/rcverify.sh
>
> Usage:
> curl -s "
> https://raw.githubusercontent.com/apache/openwhisk-release/1f9463f/tools/rcverify.sh
> "
> -o rcverify.sh
> chmod +x rcverify.sh
> ./rcverify.sh openwhisk-runtime-docker 1.16.0 rc1
>
> Please vote to approve this release:
>
> [ ] +1 Approve the release
> [ ] 0 Don't care
> [ ] -1 Don't release, because ...
>
> Release verification checklist for reference:
> [ ] Download links are valid.
> [ ] Checksums and PGP signatures are valid.
> [ ] Source code artifacts have correct names matching the current
> release.
> [ ] LICENSE and NOTICE files are correct for each OpenWhisk repository.
> [ ] All files have license headers as specified by OpenWhisk project
> policy [1].
> [ ] No compiled archives bundled in source archive.
>
> This majority vote is open for at least 72 hours.
>
>
> [1]
> https://github.com/apache/openwhisk-release/blob/master/docs/license_compliance.md
>
>
