+1 (binding) Verified signatures Verified no binaries in source Verified no bundled binaries in war (no more war) Verified NOTICE, LICENSE and DISCLAIMER files exist
Noted NOTICE copyright date, which is already logged as an issue and has been a non-blocking issue in the past On Tue Jan 27 2015 at 3:57:14 PM Robert Douglas < [email protected]> wrote: > +1 > > On Sun, Jan 25, 2015 at 3:54 PM, Matt Franklin <[email protected]> > wrote: > > > On Sun Jan 25 2015 at 4:44:12 PM John D. Ament <[email protected]> > > wrote: > > > > > On Sun Jan 25 2015 at 4:02:32 PM Ate Douma <[email protected]> wrote: > > > > > > > On 2015-01-25 14:12, John D. Ament wrote: > > > > > Steve, > > > > > > > > > > Then more likely than not your license and notice files are not > > > correct. > > > > Why? > > > > > > > > > > > If you have dependencies on non-AL artifacts, their licenses should be > in > > > your license file. > > > > > > > This is for bundled bits or code only [1], not for linked artifacts using > > the build system (maven). This release does not bundle external bits nor > > does it include code not donated/written by the project. > > > > [1] http://www.apache.org/dev/licensing-howto.html#bundled- > vs-non-bundled > > > > > > > > > > Likewise your NOTICE should reflect these dependencies, in case of any > > > reciprocity requirements. > > > > > > > The NOTICE should only reflect copyright statements from compatible > > licenses that require notification of copyright external to the LICENSE > > file. > > > > > > > > > > Here's how NIFI does it, which is pretty close to what you may need. > > > Again, I haven't looked at all of your dependencies to tell, but if > > you're > > > using things outside of maven central (though distributing via maven > > > central doesn't imply AL either mind you), there's a strong chance you > > have > > > non-AL dependencies in here (since this usually indicates a project > that > > is > > > not very mature and simply guessed on a license to use). > > > > > > https://github.com/apache/incubator-nifi/blob/develop/nifi/NOTICE > > > https://github.com/apache/incubator-nifi/blob/develop/nifi/LICENSE > > > > > > > > > > > > > > > > > I'm not even sure I saw a NOTICE in your bundle. > > > > Sure there is a NOTICE file in AFAIK every deployed artifact. > > > > Not sure what you mean with 'bundle' but if you refer to the source > > > > distribution: that one also contains the required NOTICE file. > > > > > > > > There is no hard or strict requirement that 3rd party (Maven) > > > dependencies > > > > must > > > > come from Maven Central, even if it is preferred. > > > > Note also that Maven Central actually is owned and controlled by > > > Sonatype, > > > > NOT > > > > the Maven project... > > > > > > > > > > You're saying a lot more than what I said. I said not good practice. > > > > > > John > > > > > > > > > > > > > > > > > > > > http://www.apache.org/dev/licensing-howto.html > > > > > > > > > > John > > > > > > > > > > On Sat Jan 24 2015 at 8:39:07 PM Steve Blackmon < > > [email protected]> > > > > > wrote: > > > > > > > > > >> John, > > > > >> > > > > >> Created https://issues.apache.org/jira/browse/STREAMS-270 to > > address > > > > the > > > > >> NOTICE timeframe. > > > > >> > > > > >> We do have a handful of dependencies that are not in apache or > maven > > > > >> central. I understand this is not ideal. > > > > >> > > > > >> STREAMS-155 already exists to remove the dependency on cloudera > > > > artifacts. > > > > >> > > > > >> From my perspective, issues to rewrite modules with dependencies > on > > > > >> projects that are inactive or unorganized are valid and welcome. > > > > >> > > > > >> Thanks for your feedback. > > > > >> > > > > >> > > > > >> > > > > >> > > > > >> Steve Blackmon > > > > >> [email protected] > > > > >> > > > > >> On Sat, Jan 24, 2015 at 5:03 PM, John D. Ament < > > > [email protected]> > > > > >> wrote: > > > > >> > > > > >>> Steve, > > > > >>> > > > > >>> Please update your copyright years. It's listed as 2012-2013, > but > > > > should > > > > >>> at least include 2015. (NOTICE file) > > > > >>> > > > > >>> Your Maven pom's are referencing some 3P repositories, yet you > only > > > > >> declare > > > > >>> one 3P dependency in some unknown to me file. Do you need these > > > other > > > > >>> repos? It's generally not considered good practice in apache. > > > > >>> > > > > >>> John > > > > >>> > > > > >>> On Sat Jan 24 2015 at 5:53:34 PM Steve Blackmon < > > > [email protected]> > > > > >>> wrote: > > > > >>> > > > > >>>> I've created a streams-project 0.1-incubating release candidate, > > > with > > > > >> the > > > > >>>> following artifacts up for a vote: > > > > >>>> > > > > >>>> Git tag streams-project-0.1-incubating-rc3 (commit fdb6445) > > > > >>>> *https://git-wip-us.apache.org/repos/asf?p=incubator- > > > > >>>> streams.git;a=commit;h=fdb6445ff30134793812856670159f4ade310f5d > > > > >>>> <https://git-wip-us.apache.org/repos/asf?p=incubator- > > > > >>>> streams.git;a=commit;h=fdb6445ff30134793812856670159f > 4ade310f5d>* > > > > >>>> > > > > >>>> Maven staging repo: > > > > >>>> * > > > > >>> https://repository.apache.org/content/repositories/ > > > > orgapachestreams-1003 > > > > >>>> < > > > > >>> https://repository.apache.org/content/repositories/ > > > > orgapachestreams-1003 > > > > >>>>> * > > > > >>>> > > > > >>>> Source release: > > > > >>>> https://repository.apache.org/service/local/repositories/ > > > > >>>> orgapachestreams-1003/content/org/apache/streams/streams- > > > > >>>> project/0.1-incubating/streams-project-0.1- > > > > >> incubating-source-release.zip > > > > >>>> > > > > >>>> Release artifacts are signed with the following key: > > > > >>>> https://people.apache.org/keys/committer/sblackmon.asc > > > > >>>> > > > > >>>> The release candidate was generated from branch 0.1-rc3, which > is > > > > >> master > > > > >>> + > > > > >>>> current version of all open PRs related to sub-tasks of > > STREAMS-244 > > > + > > > > >> all > > > > >>>> PRs merged to master since the vote for rc1 began + several > > commits > > > > >> which > > > > >>>> address feedback mentioned in -1 votes for rc1 + several commits > > > which > > > > >>>> address feedback mentioned in -1 votes for rc2. 0.1-rc3 will be > > > > >> promoted > > > > >>>> to master and STREAMS-244 closed if this release candidate is > > > > approved. > > > > >>>> > > > > >>>> Please take the time to verify the artifacts before casting your > > > vote. > > > > >>>> > > > > >>>> Vote will be open for 72 hours. > > > > >>>> > > > > >>>> [ ] +1 approve > > > > >>>> [ ] +0 no opinion > > > > >>>> [ ] -1 disapprove (and reason why) > > > > >>>> > > > > >>>> Steve Blackmon > > > > >>>> [email protected] > > > > >>>> > > > > >>> > > > > >> > > > > > > > > > > > > > > > > > > >
