Thank you for all the valuable feedback. I appreciate the time you've taken to review the release candidate so thoroughly.
I'd like to provide some context about Apache KIE podling. We're a mature project with over 15 years of history, and we've been on the Apache Incubation journey for more than a year now. During this time, we've made many changes to fit into the Apache Foundation, including adjusting headers, changing CI, tweaking code, and untangling dependencies and removing legal restricted dependencies. We've also simplified the structure, going from 23 separate repositories to just a handful. We understand there are some issues with the current release candidate. We're starting a RC3 now and will make sure to include 'incubating' in the filenames and revise the NOTICE file to focus on source code rather than binary dependencies. We'll also check how it's possible to add the LICENSE, NOTICE, and DISCLAIMER-WIP files to the container image exports (I'm not sure if this is possible, to be honest.. but we'll check). We know that some changes might take more time due to the project's complexity. We see incubation as a journey and we're committed to improving step by step. Right now, the main goal is to get the first release out after over a year of hard work, while we keep working towards meeting all Apache standards. We have a large community of users that are anxious to get access to this release... as this is the first time in 15 years that we don't have a release in more than a year. Best, Alex On Wed, Oct 9, 2024 at 6:36 PM PJ Fanning <fannin...@apache.org> wrote: > > I chose one of the binary artifacts at random. > incubator-kie-10.0.0-rc2-sonataflow-operator-image.tar.gz > > It contains no LICENSE file. I don't think this is right. I think all > the zips and tar.gz files in the RC folder [1] should contain a > LICENSE, NOTICE and DISCLAIMER-WIP. > > The LICENSE and NOTICE files should be tailored to the contents of > each zips and tar.gz file. > > [1] https://dist.apache.org/repos/dist/dev/incubator/kie/10.0.0-rc2/ > > On Wed, 9 Oct 2024 at 23:27, PJ Fanning <fannin...@gmail.com> wrote: > > > > Incubator PMC members expect to find no jars or zips in source > > releases. There may be good reasons to have them as test resources but > > you should document them to make it easier for reviewers. Many IPMC > > members will use tools like Apache Rat to validate the release and the > > binary files will be reported as out of the ordinary. > > > > I would also suggest that source release zip should have a base > > directory that includes everything instead of having the LICENSE etc > > in the root folder. It makes it easier for reviewers if the zip > > doesn't unzip files into their working dir. Again, I would encourage > > you to look at other ASF Incubator or non-Incubator source releases to > > see what they look like. > > > > I still remain -1 because of the 'incubating' part of the file name > > not being there. > > > > On Wed, 9 Oct 2024 at 23:20, Alex Porcelli <porce...@apache.org> wrote: > > > > > > All those `binary` files (jar, zips) are needed for testing purposes. > > > > > > On Wed, Oct 9, 2024 at 6:16 PM PJ Fanning <fannin...@gmail.com> wrote: > > > > > > > > The NOTICE in the source release is not valid. It is a long list of > > > > binary dependencies. NOTICE files in source releases are about the > > > > source code not about binary dependencies that are linked and not > > > > included directly in the release. > > > > > > > > There are compiled jars in the source release. This is not normally > > > > allowed. > > > > > > > > ./incubator-kie-kogito-runtimes/quarkus/integration-tests/integration-tests-quarkus-gradle/integration-tests-quarkus-gradle-project/gradle/wrapper/gradle-wrapper.jar > > > > ./incubator-kie-kogito-runtimes/.mvn/wrapper/maven-wrapper.jar > > > > ./incubator-kie-kogito-runtimes/kogito-codegen-modules/kogito-codegen-core/src/test/resources/empty.jar > > > > ./incubator-kie-tools/packages/stunner-editors/errai-ui/src/test/resources/less.jar > > > > ./incubator-kie-kogito-apps/.mvn/wrapper/maven-wrapper.jar > > > > ./incubator-kie-drools/efesto/efesto-core/efesto-common-api/src/test/resources/TestJar.jar > > > > ./incubator-kie-drools/efesto/efesto-core/efesto-runtime-manager/efesto-runtime-manager-core/src/test/resources/TestJar.jar > > > > ./incubator-kie-drools/efesto/efesto-core/efesto-common-core/src/test/resources/TestJar.jar > > > > ./incubator-kie-drools/drools-compiler/src/test/resources/primespoc.jar > > > > ./incubator-kie-drools/drools-compiler/src/test/resources/eventing-example.jar > > > > ./incubator-kie-drools/drools-compiler/src/test/resources/KAModelTest.jar > > > > ./incubator-kie-drools/drools-compiler/src/test/resources/JarWithSourceFiles.jar > > > > ./incubator-kie-drools/drools-test-coverage/test-compiler-integration/src/test/resources/only-jar-pojo-not-kjar-no-kmodule-1.0.0.jar > > > > ./incubator-kie-drools/drools-test-coverage/test-compiler-integration/src/test/resources/org/drools/mvel/compiler/compiler/xml/changeset/changeset.jar > > > > ./incubator-kie-drools/drools-test-coverage/test-compiler-integration/src/test/resources/billasurf.jar > > > > ./incubator-kie-drools/drools-test-coverage/test-compiler-integration/src/test/resources/kie-project-simple-1.0.0.jar > > > > ./incubator-kie-drools/drools-test-coverage/test-compiler-integration/src/test/resources/testEnum.jar > > > > ./incubator-kie-drools/drools-verifier/drools-verifier-drl/src/test/resources/org/drools/verifier/model.jar > > > > ./incubator-kie-drools/kie-ci/src/test/resources/kjar/kjar-module-before.jar > > > > ./incubator-kie-drools/kie-ci/src/test/resources/kjar/kjar-module-after.jar > > > > ./incubator-kie-drools/drools-legacy-test-util/src/test/resources/billasurf.jar > > > > > > > > On Wed, 9 Oct 2024 at 23:11, PJ Fanning <fannin...@apache.org> wrote: > > > > > > > > > > I guess it's fine to use that key then. Do you have the pub, uid, sub > > > > > headers though? The KEYS file looks strange without them. > > > > > > > > > > On Wed, 9 Oct 2024 at 23:08, Alex Porcelli <porce...@apache.org> > > > > > wrote: > > > > > > > > > > > > PJ, > > > > > > > > > > > > Apache KIE has a fully automated release (we followed the > > > > > > requirements > > > > > > from Apache security of reproducible builds etc), so we are able to > > > > > > use the priv...@kie.apache.org because it was signed directly by the > > > > > > pipelines. > > > > > > > > > > > > The KEYS file content for the priv...@kie.apache.org was provided by > > > > > > Apache Infra. > > > > > > > > > > > > On Wed, Oct 9, 2024 at 6:03 PM PJ Fanning <fannin...@apache.org> > > > > > > wrote: > > > > > > > > > > > > > > May I also enquire about the signing key? It is usually a personal > > > > > > > signing key not a shared signing key (priv...@kie.apache.org). > > > > > > > > > > > > > > The KEYS file is not ideal afaic. It has no header bit for that > > > > > > > priv...@kie.apache.org key. Can you add that? > > > > > > > https://downloads.apache.org/incubator/kie/KEYS > > > > > > > > > > > > > > I'm talking about the missing pub, uid, sub headers. > > > > > > > > > > > > > > On Wed, 9 Oct 2024 at 22:55, PJ Fanning <fannin...@apache.org> > > > > > > > wrote: > > > > > > > > > > > > > > > > The names of the files in the RC directory [1] seem incorrect. > > > > > > > > It is good to include the '-rc2' in the directory name but the > > > > > > > > source > > > > > > > > and binary archives should omit the '-rc2' part. This is > > > > > > > > because if > > > > > > > > and when the votes passes, you need to release the files that > > > > > > > > were > > > > > > > > voted on. This means you can't rename them after the vote. > > > > > > > > > > > > > > > > -1 binding (fanningpj IPMC) > > > > > > > > because the source release does not have 'incubating' in the > > > > > > > > name of > > > > > > > > the file. I know it has incubating but the requirement is for > > > > > > > > it to be > > > > > > > > 'incubating'. You have 'incubator-kie-10.0.0-rc2-sources.zip' > > > > > > > > In fact, it is also the norm to have 'apache' in the file name > > > > > > > > too. > > > > > > > > Have a look at the Apache Uniffle candidate [2] to see the > > > > > > > > format of > > > > > > > > the filenames. > > > > > > > > > > > > > > > > The rule about 'incubating' in the name appears in our Release > > > > > > > > Guide [3] > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > [1] > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/kie/10.0.0-rc2/ > > > > > > > > [2] > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/uniffle/0.9.1-rc1/ > > > > > > > > [3] https://incubator.apache.org/guides/releasemanagement.html > > > > > > > > > > > > > > > > On Wed, 9 Oct 2024 at 22:40, Alex Porcelli > > > > > > > > <porce...@apache.org> wrote: > > > > > > > > > > > > > > > > > > Hello everyone, > > > > > > > > > > > > > > > > > > This is a call for the vote to release Apache KIE(Incubating) > > > > > > > > > v10.0.0-rc2. > > > > > > > > > > > > > > > > > > The Apache KIE community has voted and approved the release > > > > > > > > > of Apache > > > > > > > > > KIE(incubating) v10.0.0-rc2. We now kindly request the IPMC > > > > > > > > > members > > > > > > > > > review and vote for this release. > > > > > > > > > > > > > > > > > > Apache KIE(incubating) - The home of the most popular business > > > > > > > > > automation open-source technologies including Drools, jBPM, > > > > > > > > > SonataFlow, Optaplanner, Kogito and Tools. > > > > > > > > > > > > > > > > > > KIE community vote thread: > > > > > > > > > https://lists.apache.org/thread/t72b95d3q1qvcyd7lbqkrt8cdx2cgsp2 > > > > > > > > > > > > > > > > > > Vote result thread: > > > > > > > > > https://lists.apache.org/thread/tjbbhlo3bo8dqqxs30f9sbj1wpxgxpyp > > > > > > > > > > > > > > > > > > The release candidate: > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/kie/10.0.0-rc2/ > > > > > > > > > > > > > > > > > > The maven staging repos for this release: > > > > > > > > > - Drools: > > > > > > > > > https://repository.apache.org/content/repositories/orgapachekie-1046 > > > > > > > > > - Optaplanner: > > > > > > > > > https://repository.apache.org/content/repositories/orgapachekie-1047 > > > > > > > > > - Kogito Runtimes: > > > > > > > > > https://repository.apache.org/content/repositories/orgapachekie-1048 > > > > > > > > > - Kogito Apps: > > > > > > > > > https://repository.apache.org/content/repositories/orgapachekie-1049 > > > > > > > > > - Kogito Apps - JITExecutor Native Linux: > > > > > > > > > https://repository.apache.org/content/repositories/orgapachekie-1050 > > > > > > > > > - Kogito Apps - JITExecutor Native Windows: > > > > > > > > > https://repository.apache.org/content/repositories/orgapachekie-1051 > > > > > > > > > - Kogito Apps - JITExecutor Native MacOS: > > > > > > > > > https://repository.apache.org/content/repositories/orgapachekie-1052 > > > > > > > > > - KIE Tools - JBPM Quarkus DevUI: > > > > > > > > > https://repository.apache.org/content/repositories/orgapachekie-1053 > > > > > > > > > - KIE Tools - Sonataflow Quarkus DevUI: > > > > > > > > > https://repository.apache.org/content/repositories/orgapachekie-1054 > > > > > > > > > > > > > > > > > > The artifacts are signed with PGP key corresponding to > > > > > > > > > [priv...@kie.apache.org], found in the KEYS file: > > > > > > > > > > > > > > > > > > https://downloads.apache.org/incubator/kie/KEYS > > > > > > > > > > > > > > > > > > The vote will be open for at least 72 hours until the > > > > > > > > > necessary number > > > > > > > > > of votes are reached. > > > > > > > > > > > > > > > > > > Please vote accordingly: > > > > > > > > > [ ] +1 approve > > > > > > > > > [ ] +0 no opinion > > > > > > > > > [ ] -1 disapprove with the reason > > > > > > > > > > > > > > > > > > To learn more about KIE, please see https://kie.apache.org/ > > > > > > > > > > > > > > > > > > Checklist for reference: > > > > > > > > > > > > > > > > > > [ ] Download KIE artifacts are valid. > > > > > > > > > [ ] Checksums and PGP signatures are valid. > > > > > > > > > [ ] Source code distributions have correct names matching the > > > > > > > > > current release. > > > > > > > > > [ ] LICENSE and NOTICE files are correct. > > > > > > > > > [ ] All files have license headers if necessary. > > > > > > > > > [ ] No compiled archives bundled in source archive. > > > > > > > > > [ ] Can compile from source. > > > > > > > > > > > > > > > > > > For updated information on how to verify the release, please > > > > > > > > > refer to: > > > > > > > > > https://kie.apache.org/docs/community/verify > > > > > > > > > > > > > > > > > > For updated information on how to build from source zip, > > > > > > > > > please refer to: > > > > > > > > > https://kie.apache.org/docs/community/build > > > > > > > > > > > > > > > > > > Best, > > > > > > > > > Alex > > > > > > > > > > > > > > > > > > --------------------------------------------------------------------- > > > > > > > > > To unsubscribe, e-mail: > > > > > > > > > general-unsubscr...@incubator.apache.org > > > > > > > > > For additional commands, e-mail: > > > > > > > > > general-h...@incubator.apache.org > > > > > > > > > > > > > > > > > --------------------------------------------------------------------- > > > > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > > > > For additional commands, e-mail: general-h...@incubator.apache.org > > > > > > > > > > --------------------------------------------------------------------- > > > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > > > For additional commands, e-mail: general-h...@incubator.apache.org > > > --------------------------------------------------------------------- To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
