Re: [accumulo] your /dist/ artifacts - 1 BAD signature

2014-09-25 Thread Christopher
[note: thread moved to dev@]

Okay, I just confirmed that the current files in dist are the same ones in
Maven Central are the same ones that we voted on. So, that issue is
resolved. I double checked and saw that the gpg-signed tag hasn't been
created for 1.6.1 (git tag -s 1.6.1 origin/1.6.1-rc1). I guess technically
anybody could do this, and merge it (along with the version bump to
1.6.2-SNAPSHOT commit) to 1.6.2-SNAPSHOT branch (and forward, with -sours),
if Corey doesn't have time/gets busy.


--
Christopher L Tubbs II
http://gravatar.com/ctubbsii

On Thu, Sep 25, 2014 at 2:21 PM, Corey Nolet cjno...@gmail.com wrote:

 There's still a few things I need to do before announcing the release to
 the user list. Merging the rc into the next version branch was one of them
 and creating the official release tag was another. I'll do these tonight as
 well as writing up the release notes for the site.


 On Thu, Sep 25, 2014 at 1:59 PM, Christopher ctubb...@apache.org wrote:

  Also, we can move this list to dev@. There's no reason for it to be
  private@
  .
 
 
  --
  Christopher L Tubbs II
  http://gravatar.com/ctubbsii
 
  On Thu, Sep 25, 2014 at 1:59 PM, Christopher ctubb...@apache.org
 wrote:
 
   There's one more problem that Keith and I found... it doesn't look like
   the rc1 branch got merged to 1.6.2-SNAPSHOT. I don't know if some other
   branch got accidentally merged instead.
  
  
   --
   Christopher L Tubbs II
   http://gravatar.com/ctubbsii
  
   On Thu, Sep 25, 2014 at 1:40 PM, Josh Elser josh.el...@gmail.com
  wrote:
  
   Things look good to me now. I checked the artifacts on dist/ against
  what
   I have from evaluating the RC and they appear to match.
  
   Anything else we need to do here?
  
  
   Christopher wrote:
  
   I was able to confirm the signature is bad. When I checked the RC,
 the
   signature was good, so I'm guessing the wrong one just got uploaded.
 I
   don't have a copy of the RC that I had previously downloaded, but I
 was
   able to grab a copy of what was deployed to Maven central and fix the
   dist
   sigs/checksums from that.
  
   Now, it's possible that the wrong artifacts were uploaded to Maven
   central
   (perhaps the wrong staging repo was promoted?) I can't know that for
   sure,
   until I can get to work and check my last download from the RC vote
 and
   compare with what's in Maven central now. If that is the case, then
 we
   need
   to determine precisely what is different from this upload and what
 was
   voted on and see if we need to immediately re-release as 1.6.2 to fix
  the
   problems.
  
  
   --
   Christopher L Tubbs II
   http://gravatar.com/ctubbsii
  
   On Thu, Sep 25, 2014 at 3:12 AM, Henk Penninghe...@apache.org
  wrote:
  
Hi PMC accumulo,
  
  I watch 'www.apache.org/dist/', and I noticed that :
  
  -- you have 1 BAD pgp signature
  
   accumulo/1.6.1/accumulo-1.6.1-src.tar.gz.asc
  
  Please fix this problem soon ; for details, see
  
  
  http://people.apache.org/~henkp/checker/sig.html#project-accumulo
http://people.apache.org/~henkp/checker/md5.html
  
  For information on how to fix problems, see the faq :
  
http://people.apache.org/~henkp/checker/faq.html
  
  Thanks a lot, regards,
  
  Henk Penning -- apache.org infrastructure
  
  PS. The contents of this message is generated,
  but the mail itself is sent by hand.
  PS. Please cc me on all relevant emails.
  
   -   _
   Henk P. Penning, ICT-beta  R Uithof WISK-412  _/ _
   Faculty of Science, Utrecht University T +31 30 253 4106 / _/
   Budapestlaan 6, 3584CD Utrecht, NL F +31 30 253 4553 _/ _/
   http://people.cs.uu.nl/henkp/  M penn...@uu.nl _/
  
  
  
  
 



Re: [accumulo] your /dist/ artifacts - 1 BAD signature

2014-09-25 Thread Corey Nolet
I see what happened. I was expecting the mvn:release plugin to push the
prepare for next development iteration which it did not. I just pushed it
up and created the tag. I'll work on the release notes in a bit.

On Thu, Sep 25, 2014 at 3:33 PM, Christopher ctubb...@apache.org wrote:

 [note: thread moved to dev@]

 Okay, I just confirmed that the current files in dist are the same ones in
 Maven Central are the same ones that we voted on. So, that issue is
 resolved. I double checked and saw that the gpg-signed tag hasn't been
 created for 1.6.1 (git tag -s 1.6.1 origin/1.6.1-rc1). I guess technically
 anybody could do this, and merge it (along with the version bump to
 1.6.2-SNAPSHOT commit) to 1.6.2-SNAPSHOT branch (and forward, with -sours),
 if Corey doesn't have time/gets busy.


 --
 Christopher L Tubbs II
 http://gravatar.com/ctubbsii

 On Thu, Sep 25, 2014 at 2:21 PM, Corey Nolet cjno...@gmail.com wrote:

  There's still a few things I need to do before announcing the release to
  the user list. Merging the rc into the next version branch was one of
 them
  and creating the official release tag was another. I'll do these tonight
 as
  well as writing up the release notes for the site.
 
 
  On Thu, Sep 25, 2014 at 1:59 PM, Christopher ctubb...@apache.org
 wrote:
 
   Also, we can move this list to dev@. There's no reason for it to be
   private@
   .
  
  
   --
   Christopher L Tubbs II
   http://gravatar.com/ctubbsii
  
   On Thu, Sep 25, 2014 at 1:59 PM, Christopher ctubb...@apache.org
  wrote:
  
There's one more problem that Keith and I found... it doesn't look
 like
the rc1 branch got merged to 1.6.2-SNAPSHOT. I don't know if some
 other
branch got accidentally merged instead.
   
   
--
Christopher L Tubbs II
http://gravatar.com/ctubbsii
   
On Thu, Sep 25, 2014 at 1:40 PM, Josh Elser josh.el...@gmail.com
   wrote:
   
Things look good to me now. I checked the artifacts on dist/ against
   what
I have from evaluating the RC and they appear to match.
   
Anything else we need to do here?
   
   
Christopher wrote:
   
I was able to confirm the signature is bad. When I checked the RC,
  the
signature was good, so I'm guessing the wrong one just got
 uploaded.
  I
don't have a copy of the RC that I had previously downloaded, but I
  was
able to grab a copy of what was deployed to Maven central and fix
 the
dist
sigs/checksums from that.
   
Now, it's possible that the wrong artifacts were uploaded to Maven
central
(perhaps the wrong staging repo was promoted?) I can't know that
 for
sure,
until I can get to work and check my last download from the RC vote
  and
compare with what's in Maven central now. If that is the case, then
  we
need
to determine precisely what is different from this upload and what
  was
voted on and see if we need to immediately re-release as 1.6.2 to
 fix
   the
problems.
   
   
--
Christopher L Tubbs II
http://gravatar.com/ctubbsii
   
On Thu, Sep 25, 2014 at 3:12 AM, Henk Penninghe...@apache.org
   wrote:
   
 Hi PMC accumulo,
   
   I watch 'www.apache.org/dist/', and I noticed that :
   
   -- you have 1 BAD pgp signature
   
accumulo/1.6.1/accumulo-1.6.1-src.tar.gz.asc
   
   Please fix this problem soon ; for details, see
   
   
   http://people.apache.org/~henkp/checker/sig.html#project-accumulo
 http://people.apache.org/~henkp/checker/md5.html
   
   For information on how to fix problems, see the faq :
   
 http://people.apache.org/~henkp/checker/faq.html
   
   Thanks a lot, regards,
   
   Henk Penning -- apache.org infrastructure
   
   PS. The contents of this message is generated,
   but the mail itself is sent by hand.
   PS. Please cc me on all relevant emails.
   
-   _
Henk P. Penning, ICT-beta  R Uithof WISK-412  _/ _
Faculty of Science, Utrecht University T +31 30 253 4106 / _/
Budapestlaan 6, 3584CD Utrecht, NL F +31 30 253 4553 _/ _/
http://people.cs.uu.nl/henkp/  M penn...@uu.nl _/