thanks Dave, i will research it more, but i manually verified the license
+1 stands
On Tue, Sep 3, 2024 at 3:13 PM David Grove <gro...@us.ibm.com> wrote:
> That’s odd…. It seems to suggest something wrong with either wc or cmp -n
> in your environment. It’s complaining about an expected suffix to the
> license file, and rcverify.sh is supposed to handle that (snippet appended).
>
> I am not seeing that diff being flagged (same version of rcverify.sh as
> you; on MacOS with cmp v3.10 coming from GNU diffutils via homebrew).
>
> --dave
>
> # If a project bundles any dependencies, there will be additional
> # text appended to LICENSE.txt to summarize the additional licenses.
> # Therefore only enforce a prefix match between the project's
> # LICENSE.txt and the official text of the Apache LICENSE-2.0.
> printf "verifying license..."
> LICENSE_LEN=$(wc -c "$DIR/LICENSE-2.0" | awk '{print $1}')
> CMD="cmp -n $LICENSE_LEN '$DIR/LICENSE-2.0' '$DIR/$BASE/LICENSE.txt'"
> CMP=$(eval "$CMD")
> validate $? 0 "$CMD"
>
>
>
> From: Rodric Rabbah <rod...@gmail.com>
> Date: Tuesday, September 3, 2024 at 2:07 PM
> To: dev@openwhisk.apache.org <dev@openwhisk.apache.org>
> Subject: [EXTERNAL] Re: [VOTE] Release Apache OpenWhisk Runtime Docker
> (v1.16.0, rc1)
> i'm +1 but note that
>
> rcverify failed for me on this, here's the log below and the diff
>
> diff
>
> '/var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX/LICENSE-2.0'
>
> '/var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX/openwhisk-runtime-docker-1.16.0/LICENSE.txt'
> 202a203,210
> >
> > ========================================================================
> > Apache License 2.0
> > ========================================================================
> >
> > This product bundles the files gradlew and gradlew.bat from Gradle v5.5
> > which are distributed under the Apache License, Version 2.0.
> > For details see ./gradlew and ./gradlew.bat.
>
>
>
> > ./rcverify.sh openwhisk-runtime-docker 1.16.0 rc1
> rcverify.sh (script SHA1: 6DC9 462D 3035 5FD0 ADE6 9EF9 D0DF 1A25 13E1
> 5CFD)
> working in the following directory:
> /var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX
> fetching tarball and signatures from
> https://dist.apache.org/repos/dist/dev/openwhisk/rc1
> fetching openwhisk-runtime-docker-1.16.0-sources.tar.gz... ok
> fetching openwhisk-runtime-docker-1.16.0-sources.tar.gz.asc... ok
> fetching openwhisk-runtime-docker-1.16.0-sources.tar.gz.sha512... ok
> fetching apache license... ok
> fetching release keys... ok
> importing keys... ok (new keys imported (processed 14 unchanged ))
> gpg: key 72AF0CC22C4CF320: public key "Vincent Hou (Release manager of
> OpenWhisk) <houshen...@apache.org>" imported
> gpg: key 22907064147F886E: public key "Dave Grove <gro...@us.ibm.com>"
> imported
> gpg: key 44667BC927C86D51: public key "Rodric Rabbah <rab...@apache.org>"
> imported
> gpg: key B1457C3D7101CC78: public key "James Thomas <
> jamestho...@apache.org>"
> imported
> gpg: key A600E3331427515D: public key "Olivier Tardieu <tard...@apache.org
> >"
> imported
> gpg: key 804F627B2D1BD1A0: 6 signatures not checked due to missing keys
> gpg: key 804F627B2D1BD1A0: public key "Alexander Klimetschek (Adobe Work
> Email) <aklim...@adobe.com>" imported
> gpg: key 758C332F8D30E5A2: 1 signature not checked due to a missing key
> gpg: key 758C332F8D30E5A2: public key "Alexander Klimetschek (Apache
> Committer Key) <alex...@apache.org>" imported
> gpg: key B5B8ADA933BB2FFF: public key "Dominic Kim <styl...@apache.org>"
> imported
> gpg: key A1F071AF3F62EEFF: 3 signatures not checked due to missing keys
> gpg: key A1F071AF3F62EEFF: public key "keybase.io/akrabat <
> akra...@keybase.io>" imported
> gpg: key 395282A61D88D0AC: public key "Matt Rutkowski <
> mrutkow...@apache.org>"
> imported
> gpg: key 7050DAD4D8D21A6B: public key "Shawn Black <
> shawnalle...@apache.org>"
> imported
> gpg: key 1683F2D3AF54F2F1: public key "Tyson Norris <
> tysonnor...@apache.org>"
> imported
> gpg: key 44FA19E603F812E5: public key "Cosmin Stanciu (CODE SIGNING KEY) <
> stan...@apache.org>" imported
> gpg: key 44667BC927C86D51: "Rodric Rabbah <rab...@apache.org>" 3 new
> signatures
> gpg: Total number processed: 14
> gpg: imported: 13
> gpg: new signatures: 3
> gpg: marginals needed: 3 completes needed: 1 trust model: pgp
> gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
> gpg: next trustdb check due at 2026-12-14
> unpacking tar ball... ok
> cloning scancode... ok
> computing sha512 for openwhisk-runtime-docker-1.16.0-sources.tar.gz... ok
> openwhisk-runtime-docker-1.16.0-sources.tar.gz:
> 4195F7B3 BD4D2B9F 8D59CF1A 4AF3EA42 E9E74DE8 EB8BDB85 CF9A7EC4 064B2E66
> 275DEC13 6A84341B A38026C3 96E5862C 837C38A4 02B7133B 929E8F75 D5B9BF53
> validating sha512... passed
> verifying asc... passed (signed-by: Dave Grove <dgr...@apache.org>)
> verifying notice... passed
> verifying absence of DISCLAIMER.txt passed
> verifying license...cmp: EOF on
> /var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX/LICENSE-2.0
> failed (cmp -n 11358
>
> '/var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX/LICENSE-2.0'
>
> '/var/folders/b7/f7jgzjn11m3fglrnltk37cxr0000gp/T/tmp.VAqSGcEujX/openwhisk-runtime-docker-1.16.0/LICENSE.txt')
> verifying sources have proper headers... passed
> scanning for executable files... passed
> scanning for unexpected file types... passed
> scanning for archives... passed
> scanning for packages... passed
> scanning package.json for version match... passed (none detected)
> scanning package-lock.json for version match... passed (none detected)
>
> On Tue, Sep 3, 2024 at 1:21 PM David Grove <gro...@us.ibm.com> wrote:
>
> > Hi,
> >
> > This is a call to vote on releasing version 1.16.0 release candidate rc1
> > of the following project module with artifacts built from the Git
> > repositories and commit IDs listed below.
> >
> > * OpenWhisk Runtime Docker: 64943d7cfb393b6d4d137569f502e61a0efd212e
> >
> >
> https://github.com/apache/openwhisk-runtime-docker/commit/64943d7cfb393b6d4d137569f502e61a0efd212e
> >
> >
> https://dist.apache.org/repos/dist/dev/openwhisk/rc1/openwhisk-runtime-docker-1.16.0-sources.tar.gz
> >
> >
> https://dist.apache.org/repos/dist/dev/openwhisk/rc1/openwhisk-runtime-docker-1.16.0-sources.tar.gz.asc
> >
> >
> https://dist.apache.org/repos/dist/dev/openwhisk/rc1/openwhisk-runtime-docker-1.16.0-sources.tar.gz.sha512
> >
> > This release is comprised of source code distribution only.
> >
> > You can use this UNIX script to download the release and verify the
> > checklist below:
> >
> https://github.com/apache/openwhisk-release/blob/1f9463f/tools/rcverify.sh
> >
> > Usage:
> > curl -s "
> >
> https://raw.githubusercontent.com/apache/openwhisk-release/1f9463f/tools/rcverify.sh
> "
> > -o rcverify.sh
> > chmod +x rcverify.sh
> > ./rcverify.sh openwhisk-runtime-docker 1.16.0 rc1
> >
> > Please vote to approve this release:
> >
> > [ ] +1 Approve the release
> > [ ] 0 Don't care
> > [ ] -1 Don't release, because ...
> >
> > Release verification checklist for reference:
> > [ ] Download links are valid.
> > [ ] Checksums and PGP signatures are valid.
> > [ ] Source code artifacts have correct names matching the current
> > release.
> > [ ] LICENSE and NOTICE files are correct for each OpenWhisk repository.
> > [ ] All files have license headers as specified by OpenWhisk project
> > policy [1].
> > [ ] No compiled archives bundled in source archive.
> >
> > This majority vote is open for at least 72 hours.
> >
> >
> > [1]
> >
> https://github.com/apache/openwhisk-release/blob/master/docs/license_compliance.md
> >
> >
>
