Oh, it's probably just an artifact from building the tarball -- the asf-ci build job checks out 4.0.x in git and builds from there.
- Rawlin On Fri, Feb 21, 2020 at 3:08 PM Rawlin Peters <rawlin.pet...@gmail.com> wrote: > > That's strange, because the asf-ci build job for 4.0.x doesn't have > any weasel issues: > https://builds.apache.org/view/S-Z/view/TrafficControl/job/trafficcontrol-4.0.x-build/18/artifact/dist/weasel.txt > > - Rawlin > > On Fri, Feb 21, 2020 at 3:00 PM Chris Lemmons <alfic...@gmail.com> wrote: > > > > The weasel is reporting that BUILD_NUMBER does not have a license > > header and it's not declared with a license in the dependency_license > > file. Since BUILD_NUMBER is very small and not code, it can survive > > without the header. I've opened up a fix here: > > https://github.com/apache/trafficcontrol/pull/4431 > > > > FWIW, it is important to verify that any present weasel errors are > > investigated prior to approving a release. People expect our stuff to > > be properly licensed. If the error had been something serious, we > > could have had a problem if we'd released. > > > > I did verify the signature is good. But I've not done any testing, so > > I'm only +0. > > > > On Fri, Feb 21, 2020 at 1:51 PM Dave Neuman <neu...@apache.org> wrote: > > > > > > +1 > > > I verified that sha512sum and signature. I was able to build all of the > > > components, but weasel failed for some reason. Since it's not critical to > > > running a CDN, I won't let that hold us up. > > > > > > On Tue, Feb 11, 2020 at 9:42 AM Rawlin Peters <raw...@apache.org> wrote: > > > > > > > Hello All, > > > > > > > > I've prepared a release for v4.0.0-RC4 > > > > > > > > The vote is open for at least 72 hours and passes if a majority of at > > > > least 3 +1 PMC votes are cast. > > > > > > > > [ ] +1 Approve the release > > > > > > > > [ ] -1 Do not release this package because ... > > > > > > > > Changes since 3.1.0: > > > > > > > > https://github.com/apache/trafficcontrol/compare/RELEASE-3.1.0...RELEASE-4.0.0-RC4 > > > > > > > > This corresponds to git: > > > > Hash: 92a14286c60e46da08d08c5dfa3114b31e44311a > > > > Tag: RELEASE-4.0.0-RC4 > > > > > > > > Which can be verified with the following: git tag -v RELEASE-4.0.0-RC4 > > > > > > > > My code signing key is available here: > > > > http://keys.gnupg.net/pks/lookup?search=0x8A0712500C70C06E&op=vindex > > > > > > > > Make sure you refresh from a key server to get all relevant signatures. > > > > > > > > The source .tgz file, pgp signature (.asc signed with my key from > > > > above), and sha512 checksums are provided here: > > > > > > > > https://dist.apache.org/repos/dist/dev/trafficcontrol/4.0.0/RC4 > > > > > > > > > > > > Thanks! > > > > Rawlin Peters raw...@apache.org > > > >
