Yup. It's _only_ a problem on the actual release tarball. You don't need that file if you're checking out from git. That's why none of the tools caught it, but Dave did. He was testing against the proposed release.
On Fri, Feb 21, 2020 at 3:12 PM Rawlin Peters <[email protected]> wrote: > > Oh, it's probably just an artifact from building the tarball -- the > asf-ci build job checks out 4.0.x in git and builds from there. > > - Rawlin > > On Fri, Feb 21, 2020 at 3:08 PM Rawlin Peters <[email protected]> wrote: > > > > That's strange, because the asf-ci build job for 4.0.x doesn't have > > any weasel issues: > > https://builds.apache.org/view/S-Z/view/TrafficControl/job/trafficcontrol-4.0.x-build/18/artifact/dist/weasel.txt > > > > - Rawlin > > > > On Fri, Feb 21, 2020 at 3:00 PM Chris Lemmons <[email protected]> wrote: > > > > > > The weasel is reporting that BUILD_NUMBER does not have a license > > > header and it's not declared with a license in the dependency_license > > > file. Since BUILD_NUMBER is very small and not code, it can survive > > > without the header. I've opened up a fix here: > > > https://github.com/apache/trafficcontrol/pull/4431 > > > > > > FWIW, it is important to verify that any present weasel errors are > > > investigated prior to approving a release. People expect our stuff to > > > be properly licensed. If the error had been something serious, we > > > could have had a problem if we'd released. > > > > > > I did verify the signature is good. But I've not done any testing, so > > > I'm only +0. > > > > > > On Fri, Feb 21, 2020 at 1:51 PM Dave Neuman <[email protected]> wrote: > > > > > > > > +1 > > > > I verified that sha512sum and signature. I was able to build all of the > > > > components, but weasel failed for some reason. Since it's not critical > > > > to > > > > running a CDN, I won't let that hold us up. > > > > > > > > On Tue, Feb 11, 2020 at 9:42 AM Rawlin Peters <[email protected]> wrote: > > > > > > > > > Hello All, > > > > > > > > > > I've prepared a release for v4.0.0-RC4 > > > > > > > > > > The vote is open for at least 72 hours and passes if a majority of at > > > > > least 3 +1 PMC votes are cast. > > > > > > > > > > [ ] +1 Approve the release > > > > > > > > > > [ ] -1 Do not release this package because ... > > > > > > > > > > Changes since 3.1.0: > > > > > > > > > > https://github.com/apache/trafficcontrol/compare/RELEASE-3.1.0...RELEASE-4.0.0-RC4 > > > > > > > > > > This corresponds to git: > > > > > Hash: 92a14286c60e46da08d08c5dfa3114b31e44311a > > > > > Tag: RELEASE-4.0.0-RC4 > > > > > > > > > > Which can be verified with the following: git tag -v RELEASE-4.0.0-RC4 > > > > > > > > > > My code signing key is available here: > > > > > http://keys.gnupg.net/pks/lookup?search=0x8A0712500C70C06E&op=vindex > > > > > > > > > > Make sure you refresh from a key server to get all relevant > > > > > signatures. > > > > > > > > > > The source .tgz file, pgp signature (.asc signed with my key from > > > > > above), and sha512 checksums are provided here: > > > > > > > > > > https://dist.apache.org/repos/dist/dev/trafficcontrol/4.0.0/RC4 > > > > > > > > > > > > > > > Thanks! > > > > > Rawlin Peters [email protected] > > > > >
