> If you put them under /dev/ for the vote, that makes it easier for the > reviewer to see what is actually intended for the release area.
Yes and no. Where do we get this zip from? The answer is: from repository.apache.org. Because all this is set up in the ASF own apache-parent pom.xml! You are indeed right in pointing out that the original vote mail should have added the sha1 of the source zip to vote on. Let's fix that: b51aebefc01e94f96df3d1a6664835524b855cf7 But you are wrong by assuming that with dist/dev all would be perfect. Indeed, a SVN location is not worth much either if you don't know the _exact_ SVN revision! And this is missing in almost all votes as well. By forcing dist/dev you basically render the staging area of repository.apache.org useless. You agree? And one more drawback is that ditching a failed release from SVN will _not_ free the occupied storage. That might or might not be an issue. But it still would be a change to what we do in many TLPs since many years. In my personal opinion the dist/dev is a fine solution if the project does not leverage a fully automated release build. But for projects which use the maven-release-plugin doing a release is as easy as mvn release:prepare + mvn release:perform. All the rest is done automatically, including the deployment to a staging area at repository.apache.org. Forcing dist/dev for those projects would imo be more or less a step back to deploying release candidates to people.a.o as we did a decade ago. There was a good reason why we did get rid of that, you probably remember... Don't get me wrong: it's always good to review and discuss our release process. What Reinhard did with the BatchEE release is really identical to what we do in many TLPs. What we really need to fix is the part with the sha1 (even better would be sha256 though) as this is the only 100% way to ensure the VOTE is really on the right source zip. Is this documented in the incubator release howto already? LieGrue, strub > Am 07.12.2017 um 15:01 schrieb sebb <seb...@gmail.com>: > > On 7 December 2017 at 10:22, Mark Struberg <strub...@yahoo.de.invalid> wrote: >> Hi Sebb! >> >> commits got pushed to the ASF repo >> https://github.com/apache/incubator-batchee/commits/master >> >> And we clarified the dist question with Infra. >> All is fine as repository.apache.org is ASF owned and operated territory. >> The only thing which we must make sure is that the source zip get's copied >> over to dist.a.o once the VOTE did succeed. > > If you put them under /dev/ for the vote, that makes it easier for the > reviewer to see what is actually intended for the release area. > >> And we have to ofc make sure that it is really the same as voted upon. We >> ensure this via the sha1. > > I don't understand how that can work, given the content of the VOTE mail. > Note that the Nexus repo URLs are transient and not version controlled AFAICT. > Nor are they unique as the numbers will eventually wrap. > > Try to use the SHA1 of any of the files in the previous release to > prove that the file is the one that was voted on. > > For example, under > www.apache.org/dist/incubator/batchee/0.4-incubating/ > we have > batchee-0.4-incubating-source-release.zip.sha1 > which contains > 05535de5554b598356f27bdb475853675b80b8b4 > > The release vote is here: > https://lists.apache.org/thread.html/fc112978fe7682a95189f9d14567ddef23bd2fc860bbce89903bf5c9@%3Cgeneral.incubator.apache.org%3E > > How do you prove that the source zip is the one that was voted on? > >> txs and LieGrue, >> strub >> >> >> >>> Am 06.12.2017 um 23:16 schrieb sebb <seb...@gmail.com>: >>> >>> On 6 December 2017 at 17:06, Mark Struberg <strub...@yahoo.de.invalid> >>> wrote: >>>> No sebb, the tag does NOT need to be owned by the PPMC. >>>> We just have to make sure that the tag gets moved over to ASF _AFTER_ the >>>> vote is closed. >>>> That's how GIT works and that's how we work with GIT since many years at >>>> the ASF. >>>> >>>>> The source must be released through the ASF mirror system, >>>>> The source must be released through the ASF mirror system, >>>>> The staging area for that is here: >>>> >>>> That's also ONLY valid for AFTER the vote! >>> >>> No, the /dev/ area is the normal location for RCs >>> >>>> So once the VOTE passes we will copy it over. >>> >>> Once the vote passes you SVN copy/move /dev/ to /release/ >>> >>>> Again: we handle it that way in TLPs and many podlings since MANY years. >>> >>> There have been changes over the years, including the introduction of >>> dist.apache.org. >>> >>> The point is to provide a staged copy of the release candidate under >>> /dev/ that reviewers can check. >>> >>> Ideally also provide the SVN revision of the folder in the vote email. >>> >>> This then provides traceability from the vote to the /release/ >>> (assuming SVN is used to move/copy the files from /dev/ to /release/). >>> >>>>> The KEYS file must be under >>>>> https://www.apache.org/dist/incubator/batchee/ as must the sigs and >>>>> hashes. >>>> >>>> again AFTER the VOTE! >>> >>> The KEYS file can be updated at any time to include the RM's key. >>> It's vital that it is in place ready in case the vote succeeds. >>> So it makes sense to reference it in the VOTE email. >>> >>>> for the record: Romain and my votes are IPMC binding ones. >>> >>>> txs and LieGrue, >>>> strub >>>> >>>> >>>>> Am 06.12.2017 um 16:41 schrieb sebb <seb...@gmail.com>: >>>>> >>>>> On 6 December 2017 at 08:08, Reinhard Sandtner <rsandt...@apache.org> >>>>> wrote: >>>>>> Hey incubator PMCs, >>>>>> >>>>>> The Apache BatchEE community has voted and approved the proposal to >>>>>> release Apache BatchEE 0.5-incubating. >>>>>> Apache BatchEE is a JBatch implementation (JSR-352) which provides many >>>>>> enhancements and extensions. >>>>>> >>>>>> You may find the VOTE thread here: >>>>>> https://lists.apache.org/thread.html/50c023e02cebcb61bc61aa2ea6112d366b1dba0db04c045b7c1b415b@%3Cdev.batchee.apache.org%3E >>>>>> >>>>>> <http://mail-archives.apache.org/mod_mbox/batchee-dev/201712.mbox/%3c501767c2-1220-41f1-a8f9-73330969d...@apache.org%3E> >>>>>> >>>>>> the RESULT VOTE thread can be found here: >>>>>> https://lists.apache.org/thread.html/6d05ea8439167e15d720d318c9c2845fbd134ae2967321e3b7540386@%3Cdev.batchee.apache.org%3E >>>>>> >>>>>> <https://lists.apache.org/thread.html/6d05ea8439167e15d720d318c9c2845fbd134ae2967321e3b7540386@%3Cdev.batchee.apache.org%3E> >>>>>> >>>>>> For information about the contents of this release, see: >>>>>> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12314924&version=12334679 >>>>>> >>>>>> <https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12314924&version=12334679> >>>>>> >>>>>> The tag is available on my github fork >>>>>> https://github.com/rsandtner/incubator-batchee/tree/batchee-0.5-incubating >>>>>> >>>>>> <https://github.com/rsandtner/incubator-batchee/tree/batchee-0.5-incubating> >>>>> >>>>> That does not seem right. >>>>> Tags need to be permanent and 'owned' by the (P)PMC >>>>> >>>>>> Staging Repo is here: >>>>>> https://repository.apache.org/content/repositories/orgapachebatchee-1005<https://repository.apache.org/content/repositories/orgapachebatchee-1005> >>>>> >>>>> That is only the Maven staging area. >>>>> >>>>> The source must be released through the ASF mirror system, >>>>> >>>>> The staging area for that is here: >>>>> >>>>> https://dist.apache.org/repos/dist/dev/incubator/batchee/ >>>>> >>>>> [If the vote succeeds, the files can be moved here: >>>>> https://dist.apache.org/repos/dist/release/incubator/batchee/] >>>>> >>>>>> Sources can be found here: >>>>>> https://repository.apache.org/content/repositories/orgapachebatchee-1005/org/apache/batchee/batchee/0.5-incubating/batchee-0.5-incubating-source-release.zip<https://repository.apache.org/content/repositories/orgapachebatchee-1005/org/apache/batchee/batchee/0.5-incubating/batchee-0.5-incubating-source-release.zip> >>>>>> >>>>>> Release artifacts are singed with the KEY: >>>>>> https://github.com/apache/incubator-batchee/blob/master/KEYS<https://github.com/apache/incubator-batchee/blob/master/KEYS> >>>>> >>>>> The KEYS file must be under >>>>> https://www.apache.org/dist/incubator/batchee/ as must the sigs and >>>>> hashes. >>>>> >>>>> >>>>>> The vote is open for 72 hours >>>>> >>>>> At least 72 hours. >>>>> >>>>>> [ ] +1 batchEE -> coolShipIt() >>>>>> [ ] +0 don’t care >>>>>> [ ] -1 do not release because… >>>>>> >>>>>> thanks, lg >>>>>> reini >>>>> >>>>> --------------------------------------------------------------------- >>>>> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org >>>>> For additional commands, e-mail: general-h...@incubator.apache.org >>>> >>>> >>>> --------------------------------------------------------------------- >>>> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org >>>> For additional commands, e-mail: general-h...@incubator.apache.org >>>> >>> >>> --------------------------------------------------------------------- >>> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org >>> For additional commands, e-mail: general-h...@incubator.apache.org >> >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org >> For additional commands, e-mail: general-h...@incubator.apache.org >> > > --------------------------------------------------------------------- > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > For additional commands, e-mail: general-h...@incubator.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
