On 10 December 2017 at 10:35, Mark Struberg <strub...@yahoo.de.invalid> wrote: > >> If you put them under /dev/ for the vote, that makes it easier for the >> reviewer to see what is actually intended for the release area. > > Yes and no. Where do we get this zip from? > The answer is: from repository.apache.org. Because all this is set up in the > ASF own apache-parent pom.xml!
Or from target on the RM's system. > You are indeed right in pointing out that the original vote mail should have > added the sha1 of the source zip to vote on. > Let's fix that: > b51aebefc01e94f96df3d1a6664835524b855cf7 > > But you are wrong by assuming that with dist/dev all would be perfect. > Indeed, a SVN location is not worth much either if you don't know the _exact_ > SVN revision! > And this is missing in almost all votes as well. Obviously one needs to include the revision number as well. > By forcing dist/dev you basically render the staging area of > repository.apache.org useless. You agree? No, because the Maven artifacts need to reside there. > And one more drawback is that ditching a failed release from SVN will _not_ > free the occupied storage. > That might or might not be an issue. Infra have ways of dealing with that if necessary. > But it still would be a change to what we do in many TLPs since many years. Does not make it the best solution. > In my personal opinion the dist/dev is a fine solution if the project does > not leverage a fully automated release build. > But for projects which use the maven-release-plugin doing a release is as > easy as mvn release:prepare + mvn release:perform. > All the rest is done automatically, including the deployment to a staging > area at repository.apache.org. > > Forcing dist/dev for those projects would imo be more or less a step back to > deploying release candidates to people.a.o as we did a decade ago. > There was a good reason why we did get rid of that, you probably remember... The replacement for people/minotaur is precisely dist.apache.org. > Don't get me wrong: it's always good to review and discuss our release > process. > What Reinhard did with the BatchEE release is really identical to what we do > in many TLPs. > What we really need to fix is the part with the sha1 (even better would be > sha256 though) as this is the only 100% way to ensure the VOTE is really on > the right source zip. Indeed, but for projects with multiple release artifacts the dist/dev URL plus revision number is shorter. The dist/dev URL also makes it more obvious exactly what is planned to be released to the ASF mirror system. Wheres the parent dir for the source archive (*) includes files that won't be published. (*) https://repository.apache.org/content/repositories/orgapachebatchee-1005/org/apache/batchee/batchee/0.5-incubating/ > Is this documented in the incubator release howto already? > > LieGrue, > strub > >> Am 07.12.2017 um 15:01 schrieb sebb <seb...@gmail.com>: >> >> On 7 December 2017 at 10:22, Mark Struberg <strub...@yahoo.de.invalid> wrote: >>> Hi Sebb! >>> >>> commits got pushed to the ASF repo >>> https://github.com/apache/incubator-batchee/commits/master >>> >>> And we clarified the dist question with Infra. >>> All is fine as repository.apache.org is ASF owned and operated territory. >>> The only thing which we must make sure is that the source zip get's copied >>> over to dist.a.o once the VOTE did succeed. >> >> If you put them under /dev/ for the vote, that makes it easier for the >> reviewer to see what is actually intended for the release area. >> >>> And we have to ofc make sure that it is really the same as voted upon. We >>> ensure this via the sha1. >> >> I don't understand how that can work, given the content of the VOTE mail. >> Note that the Nexus repo URLs are transient and not version controlled >> AFAICT. >> Nor are they unique as the numbers will eventually wrap. >> >> Try to use the SHA1 of any of the files in the previous release to >> prove that the file is the one that was voted on. >> >> For example, under >> www.apache.org/dist/incubator/batchee/0.4-incubating/ >> we have >> batchee-0.4-incubating-source-release.zip.sha1 >> which contains >> 05535de5554b598356f27bdb475853675b80b8b4 >> >> The release vote is here: >> https://lists.apache.org/thread.html/fc112978fe7682a95189f9d14567ddef23bd2fc860bbce89903bf5c9@%3Cgeneral.incubator.apache.org%3E >> >> How do you prove that the source zip is the one that was voted on? >> >>> txs and LieGrue, >>> strub >>> >>> >>> >>>> Am 06.12.2017 um 23:16 schrieb sebb <seb...@gmail.com>: >>>> >>>> On 6 December 2017 at 17:06, Mark Struberg <strub...@yahoo.de.invalid> >>>> wrote: >>>>> No sebb, the tag does NOT need to be owned by the PPMC. >>>>> We just have to make sure that the tag gets moved over to ASF _AFTER_ the >>>>> vote is closed. >>>>> That's how GIT works and that's how we work with GIT since many years at >>>>> the ASF. >>>>> >>>>>> The source must be released through the ASF mirror system, >>>>>> The source must be released through the ASF mirror system, >>>>>> The staging area for that is here: >>>>> >>>>> That's also ONLY valid for AFTER the vote! >>>> >>>> No, the /dev/ area is the normal location for RCs >>>> >>>>> So once the VOTE passes we will copy it over. >>>> >>>> Once the vote passes you SVN copy/move /dev/ to /release/ >>>> >>>>> Again: we handle it that way in TLPs and many podlings since MANY years. >>>> >>>> There have been changes over the years, including the introduction of >>>> dist.apache.org. >>>> >>>> The point is to provide a staged copy of the release candidate under >>>> /dev/ that reviewers can check. >>>> >>>> Ideally also provide the SVN revision of the folder in the vote email. >>>> >>>> This then provides traceability from the vote to the /release/ >>>> (assuming SVN is used to move/copy the files from /dev/ to /release/). >>>> >>>>>> The KEYS file must be under >>>>>> https://www.apache.org/dist/incubator/batchee/ as must the sigs and >>>>>> hashes. >>>>> >>>>> again AFTER the VOTE! >>>> >>>> The KEYS file can be updated at any time to include the RM's key. >>>> It's vital that it is in place ready in case the vote succeeds. >>>> So it makes sense to reference it in the VOTE email. >>>> >>>>> for the record: Romain and my votes are IPMC binding ones. >>>> >>>>> txs and LieGrue, >>>>> strub >>>>> >>>>> >>>>>> Am 06.12.2017 um 16:41 schrieb sebb <seb...@gmail.com>: >>>>>> >>>>>> On 6 December 2017 at 08:08, Reinhard Sandtner <rsandt...@apache.org> >>>>>> wrote: >>>>>>> Hey incubator PMCs, >>>>>>> >>>>>>> The Apache BatchEE community has voted and approved the proposal to >>>>>>> release Apache BatchEE 0.5-incubating. >>>>>>> Apache BatchEE is a JBatch implementation (JSR-352) which provides many >>>>>>> enhancements and extensions. >>>>>>> >>>>>>> You may find the VOTE thread here: >>>>>>> https://lists.apache.org/thread.html/50c023e02cebcb61bc61aa2ea6112d366b1dba0db04c045b7c1b415b@%3Cdev.batchee.apache.org%3E >>>>>>> >>>>>>> <http://mail-archives.apache.org/mod_mbox/batchee-dev/201712.mbox/%3c501767c2-1220-41f1-a8f9-73330969d...@apache.org%3E> >>>>>>> >>>>>>> the RESULT VOTE thread can be found here: >>>>>>> https://lists.apache.org/thread.html/6d05ea8439167e15d720d318c9c2845fbd134ae2967321e3b7540386@%3Cdev.batchee.apache.org%3E >>>>>>> >>>>>>> <https://lists.apache.org/thread.html/6d05ea8439167e15d720d318c9c2845fbd134ae2967321e3b7540386@%3Cdev.batchee.apache.org%3E> >>>>>>> >>>>>>> For information about the contents of this release, see: >>>>>>> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12314924&version=12334679 >>>>>>> >>>>>>> <https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12314924&version=12334679> >>>>>>> >>>>>>> The tag is available on my github fork >>>>>>> https://github.com/rsandtner/incubator-batchee/tree/batchee-0.5-incubating >>>>>>> >>>>>>> <https://github.com/rsandtner/incubator-batchee/tree/batchee-0.5-incubating> >>>>>> >>>>>> That does not seem right. >>>>>> Tags need to be permanent and 'owned' by the (P)PMC >>>>>> >>>>>>> Staging Repo is here: >>>>>>> https://repository.apache.org/content/repositories/orgapachebatchee-1005<https://repository.apache.org/content/repositories/orgapachebatchee-1005> >>>>>> >>>>>> That is only the Maven staging area. >>>>>> >>>>>> The source must be released through the ASF mirror system, >>>>>> >>>>>> The staging area for that is here: >>>>>> >>>>>> https://dist.apache.org/repos/dist/dev/incubator/batchee/ >>>>>> >>>>>> [If the vote succeeds, the files can be moved here: >>>>>> https://dist.apache.org/repos/dist/release/incubator/batchee/] >>>>>> >>>>>>> Sources can be found here: >>>>>>> https://repository.apache.org/content/repositories/orgapachebatchee-1005/org/apache/batchee/batchee/0.5-incubating/batchee-0.5-incubating-source-release.zip<https://repository.apache.org/content/repositories/orgapachebatchee-1005/org/apache/batchee/batchee/0.5-incubating/batchee-0.5-incubating-source-release.zip> >>>>>>> >>>>>>> Release artifacts are singed with the KEY: >>>>>>> https://github.com/apache/incubator-batchee/blob/master/KEYS<https://github.com/apache/incubator-batchee/blob/master/KEYS> >>>>>> >>>>>> The KEYS file must be under >>>>>> https://www.apache.org/dist/incubator/batchee/ as must the sigs and >>>>>> hashes. >>>>>> >>>>>> >>>>>>> The vote is open for 72 hours >>>>>> >>>>>> At least 72 hours. >>>>>> >>>>>>> [ ] +1 batchEE -> coolShipIt() >>>>>>> [ ] +0 don’t care >>>>>>> [ ] -1 do not release because… >>>>>>> >>>>>>> thanks, lg >>>>>>> reini >>>>>> >>>>>> --------------------------------------------------------------------- >>>>>> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org >>>>>> For additional commands, e-mail: general-h...@incubator.apache.org >>>>> >>>>> >>>>> --------------------------------------------------------------------- >>>>> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org >>>>> For additional commands, e-mail: general-h...@incubator.apache.org >>>>> >>>> >>>> --------------------------------------------------------------------- >>>> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org >>>> For additional commands, e-mail: general-h...@incubator.apache.org >>> >>> >>> --------------------------------------------------------------------- >>> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org >>> For additional commands, e-mail: general-h...@incubator.apache.org >>> >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org >> For additional commands, e-mail: general-h...@incubator.apache.org > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > For additional commands, e-mail: general-h...@incubator.apache.org > --------------------------------------------------------------------- To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
