Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Ian Luo]

I vote with:
[v] +1 approve

Minor issues:

In the binary distributions, there's one script file named
'bin-distribution-check.sh' which should not be included.

Is the issue minor?
[v] Yes [] No [] Unsure
Could it possibly be fixed in the next release?
[v] Yes [] No [] Unsure

Details:

[v] Are release files in correct location?
[v] Do release files have the word incubating in their name?
[v] Are the digital signature and hashes correct?
[v] Does DISCLAIMER file exist?
[v] Do LICENSE and NOTICE files exists?
[v] Is the LICENSE and NOTICE text correct?
[v] Is the NOTICE year correct?
[v] Un-included software dependencies are not mentioned in LICENSE or
NOTICE?
[v] License information is not mentioned in NOTICE?

Is there any 3rd party code contained inside the release? If so:

[v] Does the software have a compatible license?
[v] Are all software licenses mentioned in LICENSE?
[v] Is the full text of the licenses (or pointers to it) in LICENSE?

Is any of this code Apache licensed? Do they have NOTICE files? If so:

[v] Have relevant parts of those NOTICE files been added to this NOTICE
file?
[v] Do all source files have ASF headers?
[v] Do the contents of the release match with what's tagged in version
control?
[x] Are there any unexpected binary files in the release?
[v] Can you compile from source? Are the instruction clear?

Regards,
-Ian.


On Tue, Mar 19, 2019 at 11:21 PM Minxuan Zhuang  wrote:

> the subject has been corrected, please continue voting.
> On Tue, Mar 19, 2019 at 10:51 PM Huxing Zhang  wrote:
>
> > Hi,
> >
> > Supposing the title is vote thread, it should be started with "[VOTE]:
> > Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]"
> >
> > On Tue, Mar 19, 2019 at 6:52 PM Minxuan Zhuang 
> > wrote:
> > >
> > > Hello Dubbo Community,
> > >
> > > This is a call for the vote to release Apache Dubbo  Admin(Incubating)
> > > version 0.2.0
> > >
> > > The release candidates(RC2):
> > > 0.2.0:
> > > *
> >
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> > > <
> >
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> > >*
> > >
> > > Git tag for this release:
> > > 0.2.0:  *
> > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > > *
> > >
> > > Hash for the release tag:
> > > 0.2.0: 4ba387f78d2ecdd11b0c034b7c0bbe86a176fc6a
> > >
> > > Release Notes:
> > > 0.2.0:
> > > *https://github.com/apache/incubator-dubbo-ops/releases/tag/0.
> > > 2.0*
> > >
> > > The artifacts have been signed with Key: DA2108479B0C1E71, which can be
> > > found in
> > > the keys file:
> > >
> > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > > *
> > >
> > > The vote will be open for at least 72 hours or until the necessary
> number
> > > of votes are reached.
> > >
> > > Please vote accordingly:
> > >
> > > [ ] +1 approve
> > > [ ] +0 no opinion
> > > [ ] -1 disapprove with the reason
> > >
> > > Thanks,
> > > The Apache Dubbo (Incubating) Team
> >
> >
> >
> > --
> > Best Regards！
> > Huxing
> >
>

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Minxuan Zhuang]

Hi，the script is used for checking the binary dependency licenses, so I put
it in the binary release

On Wed, Mar 20, 2019 at 11:14 AM Ian Luo  wrote:

> I vote with:
> [v] +1 approve
>
> Minor issues:
>
> In the binary distributions, there's one script file named
> 'bin-distribution-check.sh' which should not be included.
>
> Is the issue minor?
> [v] Yes [] No [] Unsure
> Could it possibly be fixed in the next release?
> [v] Yes [] No [] Unsure
>
> Details:
>
> [v] Are release files in correct location?
> [v] Do release files have the word incubating in their name?
> [v] Are the digital signature and hashes correct?
> [v] Does DISCLAIMER file exist?
> [v] Do LICENSE and NOTICE files exists?
> [v] Is the LICENSE and NOTICE text correct?
> [v] Is the NOTICE year correct?
> [v] Un-included software dependencies are not mentioned in LICENSE or
> NOTICE?
> [v] License information is not mentioned in NOTICE?
>
> Is there any 3rd party code contained inside the release? If so:
>
> [v] Does the software have a compatible license?
> [v] Are all software licenses mentioned in LICENSE?
> [v] Is the full text of the licenses (or pointers to it) in LICENSE?
>
> Is any of this code Apache licensed? Do they have NOTICE files? If so:
>
> [v] Have relevant parts of those NOTICE files been added to this NOTICE
> file?
> [v] Do all source files have ASF headers?
> [v] Do the contents of the release match with what's tagged in version
> control?
> [x] Are there any unexpected binary files in the release?
> [v] Can you compile from source? Are the instruction clear?
>
> Regards,
> -Ian.
>
>
> On Tue, Mar 19, 2019 at 11:21 PM Minxuan Zhuang 
> wrote:
>
> > the subject has been corrected, please continue voting.
> > On Tue, Mar 19, 2019 at 10:51 PM Huxing Zhang  wrote:
> >
> > > Hi,
> > >
> > > Supposing the title is vote thread, it should be started with "[VOTE]:
> > > Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]"
> > >
> > > On Tue, Mar 19, 2019 at 6:52 PM Minxuan Zhuang 
> > > wrote:
> > > >
> > > > Hello Dubbo Community,
> > > >
> > > > This is a call for the vote to release Apache Dubbo
> Admin(Incubating)
> > > > version 0.2.0
> > > >
> > > > The release candidates(RC2):
> > > > 0.2.0:
> > > > *
> > >
> >
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> > > > <
> > >
> >
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> > > >*
> > > >
> > > > Git tag for this release:
> > > > 0.2.0:  *
> > > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > > >  >*
> > > >
> > > > Hash for the release tag:
> > > > 0.2.0: 4ba387f78d2ecdd11b0c034b7c0bbe86a176fc6a
> > > >
> > > > Release Notes:
> > > > 0.2.0:
> > > > *https://github.com/apache/incubator-dubbo-ops/releases/tag/0.
> > > > 2.0*
> > > >
> > > > The artifacts have been signed with Key: DA2108479B0C1E71, which can
> be
> > > > found in
> > > > the keys file:
> > > >
> > > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > > > *
> > > >
> > > > The vote will be open for at least 72 hours or until the necessary
> > number
> > > > of votes are reached.
> > > >
> > > > Please vote accordingly:
> > > >
> > > > [ ] +1 approve
> > > > [ ] +0 no opinion
> > > > [ ] -1 disapprove with the reason
> > > >
> > > > Thanks,
> > > > The Apache Dubbo (Incubating) Team
> > >
> > >
> > >
> > > --
> > > Best Regards！
> > > Huxing
> > >
> >
>

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Huxing Zhang]

Hi,

I vote with: +1 release the software

I also checked LICENSE and NOTICE file in the binary distribution with
bin-distribution-check.sh and all look good.

 Are release files in correct location? Yes
 Do release files have the word incubating in their name? Yes
 Are the digital signature and hashes correct? Yes
 Does DISCLAIMER file exist? Yes
 Do LICENSE and NOTICE files exists? Yes
 Is the LICENSE and NOTICE text correct? Yes
 Is the NOTICE year correct? Yes
 Un-included software dependencies are not mentioned in LICENSE or NOTICE? Yes
 License information is not mentioned in NOTICE? Yes
Is there any 3rd party code contained inside the release? If so:

 Does the software have a compatible license? Yes
 Are all software licenses mentioned in LICENSE? Yes
 Is the full text of the licenses (or pointers to it) in LICENSE? Yes
Is any of this code Apache licensed? Do they have NOTICE files? If so:
 Have relevant parts of those NOTICE files been added to this NOTICE file?

 Do all source files have ASF headers? Yes
 Do the contents of the release match with what's tagged in version
control? Yes

The following files are only in GitHub but not in src release, which
looks good to me.

Only in incubator-dubbo-admin: .git
Only in incubator-dubbo-admin: .gitignore
Only in incubator-dubbo-admin: .mvn
Only in incubator-dubbo-admin/dubbo-admin-distribution/src: LICENSE
Only in incubator-dubbo-admin/dubbo-admin-distribution/src: NOTICE
Only in incubator-dubbo-admin/dubbo-admin-distribution/src:
bin-distribution-check.sh
Only in incubator-dubbo-admin/dubbo-admin-distribution/src: licenses
Only in incubator-dubbo-admin/dubbo-admin-ui: .gitignore
Only in incubator-dubbo-admin/dubbo-admin-ui/src: .gitrepo
Only in incubator-dubbo-admin/dubbo-admin-ui/src/assets: .gitkeep
Only in incubator-dubbo-admin/dubbo-admin-ui/static: .gitkeep
Only in incubator-dubbo-admin: mvnw
Only in incubator-dubbo-admin: mvnw.cmd

 Are there any unexpected binary files in the release? No
 Can you compile from source? Are the instruction clear? Yes

On Tue, Mar 19, 2019 at 11:21 PM Minxuan Zhuang  wrote:
>
> the subject has been corrected, please continue voting.
> On Tue, Mar 19, 2019 at 10:51 PM Huxing Zhang  wrote:
>
> > Hi,
> >
> > Supposing the title is vote thread, it should be started with "[VOTE]:
> > Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]"
> >
> > On Tue, Mar 19, 2019 at 6:52 PM Minxuan Zhuang 
> > wrote:
> > >
> > > Hello Dubbo Community,
> > >
> > > This is a call for the vote to release Apache Dubbo  Admin(Incubating)
> > > version 0.2.0
> > >
> > > The release candidates(RC2):
> > > 0.2.0:
> > > *
> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> > > <
> > https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
> > >*
> > >
> > > Git tag for this release:
> > > 0.2.0:  *
> > https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
> > > *
> > >
> > > Hash for the release tag:
> > > 0.2.0: 4ba387f78d2ecdd11b0c034b7c0bbe86a176fc6a
> > >
> > > Release Notes:
> > > 0.2.0:
> > > *https://github.com/apache/incubator-dubbo-ops/releases/tag/0.
> > > 2.0*
> > >
> > > The artifacts have been signed with Key: DA2108479B0C1E71, which can be
> > > found in
> > > the keys file:
> > >
> > > *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
> > > *
> > >
> > > The vote will be open for at least 72 hours or until the necessary number
> > > of votes are reached.
> > >
> > > Please vote accordingly:
> > >
> > > [ ] +1 approve
> > > [ ] +0 no opinion
> > > [ ] -1 disapprove with the reason
> > >
> > > Thanks,
> > > The Apache Dubbo (Incubating) Team
> >
> >
> >
> > --
> > Best Regards！
> > Huxing
> >



-- 
Best Regards！
Huxing

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Justin Mclean]

Hi,

-1 (binding) as this release seems to includes a GPL (a category X) dependancy. 
[3]

After compiling I also noticed it pulls down material that is under copyright 
and I don’t believe we have permission to distribute [1][2]

Re copyright of that text:
"In Praise of Idleness and Other Essays (1932) – Copyrighted in the United 
States until 2027 due to Renewal R320904"

Only dumb luck I found that btw (I was checking for GPL licensed stuff). I 
assume this is a 3rd party file in now of the download node modules.

Everything else is good.

I checked:
- incubating in name
- signatures and hash correct
- DISCLAIMER exists
- LICENSE and NOTICE file
- Not all source files have ASF headers.
- no unexpected binary files
- can compile from source

Thanks,
Justin

1. ./dubbo-admin-ui/node_modules/wordwrap/test/idleness.txt
2 ./dubbo-admin-ui/node_modules/cliui/node_modules/wordwrap/test/idleness.txt
3. ./dubbo-admin-ui/node_modules/node-notifier/vendor/snoreToast/LICENSE

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Jun Liu]

+1 to release

I checked:
* both source and binary signatures are good
* both have incubating in name
* DISCLAIMER, LICENSE and NOTICE exists
* All UTs can pass on my Mac OSX with JDK 1.8
* I deployed the Admin locally and checked some pages opening them in browser, 
work fine.

Jun

> On Mar 19, 2019, at 11:21 PM, Minxuan Zhuang  wrote:
> 
> the subject has been corrected, please continue voting.
> On Tue, Mar 19, 2019 at 10:51 PM Huxing Zhang  wrote:
> 
>> Hi,
>> 
>> Supposing the title is vote thread, it should be started with "[VOTE]:
>> Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]"
>> 
>> On Tue, Mar 19, 2019 at 6:52 PM Minxuan Zhuang 
>> wrote:
>>> 
>>> Hello Dubbo Community,
>>> 
>>> This is a call for the vote to release Apache Dubbo  Admin(Incubating)
>>> version 0.2.0
>>> 
>>> The release candidates(RC2):
>>> 0.2.0:
>>> *
>> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
>>> <
>> https://dist.apache.org/repos/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/
>>> *
>>> 
>>> Git tag for this release:
>>> 0.2.0:  *
>> https://github.com/apache/incubator-dubbo-admin/releases/tag/0.2.0
>>> *
>>> 
>>> Hash for the release tag:
>>> 0.2.0: 4ba387f78d2ecdd11b0c034b7c0bbe86a176fc6a
>>> 
>>> Release Notes:
>>> 0.2.0:
>>> *https://github.com/apache/incubator-dubbo-ops/releases/tag/0.
>>> 2.0*
>>> 
>>> The artifacts have been signed with Key: DA2108479B0C1E71, which can be
>>> found in
>>> the keys file:
>>> 
>>> *https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
>>> *
>>> 
>>> The vote will be open for at least 72 hours or until the necessary number
>>> of votes are reached.
>>> 
>>> Please vote accordingly:
>>> 
>>> [ ] +1 approve
>>> [ ] +0 no opinion
>>> [ ] -1 disapprove with the reason
>>> 
>>> Thanks,
>>> The Apache Dubbo (Incubating) Team
>> 
>> 
>> 
>> --
>> Best Regards！
>> Huxing
>> 

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Justin Mclean]

Hi,

Also this in [1] is not a good idea. The date needs to the the date of release 
not the current date.
" Copyright ©{{ new 
Date().getFullYear() }} The Apache Software Foundation.”

I believe this has come up before on this list?

Thanks,
Justin

1. ./dubbo-admin-ui/src/components/public/Footers.vue

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Huxing Zhang]

Hi Justin,

On Thu, Mar 21, 2019 at 11:02 AM Justin Mclean  wrote:
>
> Hi,
>
> -1 (binding) as this release seems to includes a GPL (a category X) 
> dependancy. [3]
>
> After compiling I also noticed it pulls down material that is under copyright 
> and I don’t believe we have permission to distribute [1][2]
>
> Re copyright of that text:
> "In Praise of Idleness and Other Essays (1932) – Copyrighted in the United 
> States until 2027 due to Renewal R320904"
>
> Only dumb luck I found that btw (I was checking for GPL licensed stuff). I 
> assume this is a 3rd party file in now of the download node modules.
>
> Everything else is good.
>
> I checked:
> - incubating in name
> - signatures and hash correct
> - DISCLAIMER exists
> - LICENSE and NOTICE file
> - Not all source files have ASF headers.
> - no unexpected binary files
> - can compile from source
>
> Thanks,
> Justin
>

These dependencies are all development time dependencies, which can be
found in "devDependencies" section of package.json file.
According to [1], the devDependencies won't go into production.
wordwrap and cliui are transitive dev dependencies, which is used by
popular libraries like webpack and eslint. If that is the case, I
doubt a lot of the front end projects will be affect.
IMO, the devDependencies are just dependencies that help to build the
distribution, and downstream users won't be able to consume them.

For node-notifier, which is also a dev dependency, I am not sure how
it is used in dubbo-admin. But I tried to remove it and build it,
everything looks good. I think it can be removed.

> 1. ./dubbo-admin-ui/node_modules/wordwrap/test/idleness.txt

➜  dubbo-admin-ui npm ls wordwrap
dubbo-admin-ui@1.0.0
/Users/xxx/work/apache-dubbo/svn-release/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/apache-dubbo-admin-incubating-0.2.0-src/dubbo-admin-ui
├─┬ eslint@3.19.0
│ └─┬ optionator@0.8.2
│   └── wordwrap@1.0.0
└─┬ webpack@3.12.0
  └─┬ uglifyjs-webpack-plugin@0.4.6
└─┬ uglify-js@2.8.29
  └─┬ yargs@3.10.0
└─┬ cliui@2.1.0
  └── wordwrap@0.0.2


> 2 ./dubbo-admin-ui/node_modules/cliui/node_modules/wordwrap/test/idleness.txt

➜  dubbo-admin-ui npm ls cliui
dubbo-admin-ui@1.0.0
/Users/xxx/work/apache-dubbo/svn-release/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/apache-dubbo-admin-incubating-0.2.0-src/dubbo-admin-ui
├─┬ webpack@3.12.0
│ ├─┬ uglifyjs-webpack-plugin@0.4.6
│ │ └─┬ uglify-js@2.8.29
│ │   └─┬ yargs@3.10.0
│ │ └── cliui@2.1.0
│ └─┬ yargs@8.0.2
│   └── cliui@3.2.0
└─┬ webpack-dev-server@2.11.3
  └─┬ yargs@6.6.0
└── cliui@3.2.0


> 3. ./dubbo-admin-ui/node_modules/node-notifier/vendor/snoreToast/LICENSE

dubbo-admin-ui@1.0.0
/Users/xxx/work/apache-dubbo/svn-release/dist/dev/incubator/dubbo/dubbo-admin/0.2.0/apache-dubbo-admin-incubating-0.2.0-src/dubbo-admin-ui
└── node-notifier@5.4.0



[1] 
https://docs.npmjs.com/specifying-dependencies-and-devdependencies-in-a-package-json-file
-- 
Best Regards！
Huxing

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Huxing Zhang]

Hi,


On Thu, Mar 21, 2019 at 11:29 AM Justin Mclean  wrote:
>
> Hi,
>
> Also this in [1] is not a good idea. The date needs to the the date of 
> release not the current date.
> " Copyright ©{{ new 
> Date().getFullYear() }} The Apache Software 
> Foundation.”

Agree, it should be static number Copyright 2018-2019 The Apache
Software Foundation.

>
> I believe this has come up before on this list?

Yes, there was a discussion about the copyright in the official website.

>
> Thanks,
> Justin
>
> 1. ./dubbo-admin-ui/src/components/public/Footers.vue



-- 
Best Regards！
Huxing

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Justin Mclean]

Hi,

> These dependencies are all development time dependencies, which can be
> found in "devDependencies" section of package.json file.

Anyone who compiles the source will get these and be unaware of them, that 
seems a little problamatic to me.

> For node-notifier, which is also a dev dependency, I am not sure how
> it is used in dubbo-admin. But I tried to remove it and build it,
> everything looks good. I think it can be removed.

That would be best I think.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Justin Mclean]

Hi,

Having a closer look I see that “npm ls” shows a dependancy on 
echarts@4.2.1-rc1. This is unreleased code [1]. Is this correct?

Thanks,
Justin

1. https://github.com/apache/incubator-echarts/releases/tag/4.2.1-rc1

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Huxing Zhang]

Hi,

On Thu, Mar 21, 2019 at 1:45 PM Justin Mclean  wrote:
>
> Hi,
>
> > These dependencies are all development time dependencies, which can be
> > found in "devDependencies" section of package.json file.
>
> Anyone who compiles the source will get these and be unaware of them, that 
> seems a little problamatic to me.

wordwrap is a transitive dependency of eslint, which I believe almost
all the node.js projects will use.
I also check the latest version of eslint, the dependency to wordwrap
still exist.
If that is the case, I doubt that there are lots of ASF projects could
not make releases.




>
> > For node-notifier, which is also a dev dependency, I am not sure how
> > it is used in dubbo-admin. But I tried to remove it and build it,
> > everything looks good. I think it can be removed.
>
> That would be best I think.
>
> Thanks,
> Justin



--
Best Regards！
Huxing

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Minxuan Zhuang]

Hi Justin
I run "npm ls | grep echarts" on tag 0.2.0, but gets no result. dubbo
admin use echarts 4.0.4 to support metrics on develop branch, but the
feature is not in the release

On Thu, Mar 21, 2019 at 2:11 PM Huxing Zhang  wrote:

> Hi,
>
> On Thu, Mar 21, 2019 at 1:45 PM Justin Mclean  wrote:
> >
> > Hi,
> >
> > > These dependencies are all development time dependencies, which can be
> > > found in "devDependencies" section of package.json file.
> >
> > Anyone who compiles the source will get these and be unaware of them,
> that seems a little problamatic to me.
>
> wordwrap is a transitive dependency of eslint, which I believe almost
> all the node.js projects will use.
> I also check the latest version of eslint, the dependency to wordwrap
> still exist.
> If that is the case, I doubt that there are lots of ASF projects could
> not make releases.
>
>
>
>
> >
> > > For node-notifier, which is also a dev dependency, I am not sure how
> > > it is used in dubbo-admin. But I tried to remove it and build it,
> > > everything looks good. I think it can be removed.
> >
> > That would be best I think.
> >
> > Thanks,
> > Justin
>
>
>
> --
> Best Regards！
> Huxing
>

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Justin Mclean]

Hi,

>I run "npm ls | grep echarts" on tag 0.2.0, but gets no result. dubbo
> admin use echarts 4.0.4 to support metrics on develop branch, but the
> feature is not in the release

I’m looking at the source release not the tag. It shows on the very first line. 
Perhaps I might be picking up the wrong version?

justinmclean$ npm ls
├─┬ echarts@4.2.1-rc.1

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Justin Mclean]

Hi,

> If that is the case, I doubt that there are lots of ASF projects could
> not make releases.

There are very few Apache projects that use npm as their primary build tool.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Justin Mclean]

Hi,

This is probably against copyright law, and IMO just because others ignore it 
doesn’t mean we should.

There probably a couple of courses of action:
- Ask the maintainer of that npm module to replace that file with something 
that's permissible to use.
- Ask on legal discuss for advice, they may have a better idea than me on what 
to do in this situation.

And lastly my -1 is not a veto, you only need 3 +1 and more +1s than -1s to 
release, but I would consider making a release carefully.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Huxing Zhang]

Hi,

On Thu, Mar 21, 2019 at 3:43 PM Justin Mclean  wrote:
>
> Hi,
>
> > If that is the case, I doubt that there are lots of ASF projects could
> > not make releases.
>
> There are very few Apache projects that use npm as their primary build tool.

I did a search in Github [1], it looks quite a lot, some of them made
releases. How to deal with these releases?
I think this might need some broader discussion.

[1] 
https://github.com/search?l=JSON&p=2&q=org%3Aapache+%5C%22eslint%5C%22&type=Code

>
> Thanks,
> Justin



-- 
Best Regards！
Huxing

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Justin Mclean]

Hi,

> I did a search in Github [1], it looks quite a lot, some of them made
> releases. How to deal with these releases?

AFAIK Most of these would not be the primary release / offical release.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Huxing Zhang]

Hi,

On Thu, Mar 21, 2019 at 3:41 PM Justin Mclean  wrote:
>
> Hi,
>
> >I run "npm ls | grep echarts" on tag 0.2.0, but gets no result. dubbo
> > admin use echarts 4.0.4 to support metrics on develop branch, but the
> > feature is not in the release
>
> I’m looking at the source release not the tag. It shows on the very first 
> line. Perhaps I might be picking up the wrong version?

I also did't find the echarts dependency in this release candidate. It
is introduced in this commit[1] just 6 hours ago, it is impossible to
be included in the release candidate.
Moreover, the echart dependency is not a npm dependency but a javascript link.

[1] 
https://github.com/apache/incubator-dubbo-admin/commit/1faaec0b747604897c4a9af6c67222744231ecd7

>
> justinmclean$ npm ls
> ├─┬ echarts@4.2.1-rc.1
>
> Thanks,
> Justin



-- 
Best Regards！
Huxing

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Huxing Zhang]

Hi,


On Thu, Mar 21, 2019 at 3:55 PM Justin Mclean  wrote:
>
> Hi,
>
> This is probably against copyright law, and IMO just because others ignore it 
> doesn’t mean we should.
>
> There probably a couple of courses of action:
> - Ask the maintainer of that npm module to replace that file with something 
> that's permissible to use.
> - Ask on legal discuss for advice, they may have a better idea than me on 
> what to do in this situation.

How about removing the file as soon as the npm install is finished?

>
> And lastly my -1 is not a veto, you only need 3 +1 and more +1s than -1s to 
> release, but I would consider making a release carefully.
>
> Thanks,
> Justin



-- 
Best Regards！
Huxing

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Justin Mclean]

Hi,

> I also did't find the echarts dependency in this release candidate. It
> is introduced in this commit[1] just 6 hours ago, it is impossible to
> be included in the release candidate.

npm ls just list what installed, which may not be helpful, what the best way to 
work out what version the release depends on?

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Huxing Zhang]

Hi,


On Thu, Mar 21, 2019 at 5:35 PM Justin Mclean  wrote:
>
> Hi,
>
> > I also did't find the echarts dependency in this release candidate. It
> > is introduced in this commit[1] just 6 hours ago, it is impossible to
> > be included in the release candidate.
>
> npm ls just list what installed, which may not be helpful, what the best way 
> to work out what version the release depends on?

Not quite familiar with front end, what I normally do is to delete the
node_modules directory and type "npm install" again, this command
should only install what is listed in the package.json.

>
> Thanks,
> Justin
>
>
>
>


-- 
Best Regards！
Huxing

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Huxing Zhang]

Hi,

On Thu, Mar 21, 2019 at 4:34 PM Huxing Zhang  wrote:
>
> Hi,
>
>
> On Thu, Mar 21, 2019 at 3:55 PM Justin Mclean  
> wrote:
> >
> > Hi,
> >
> > This is probably against copyright law, and IMO just because others ignore 
> > it doesn’t mean we should.
> >
> > There probably a couple of courses of action:
> > - Ask the maintainer of that npm module to replace that file with something 
> > that's permissible to use.

I filed an issue here:
https://github.com/substack/node-wordwrap/issues/21, given that the
commit ceased since 2015, I don't think there will be a quick reply.

> > - Ask on legal discuss for advice, they may have a better idea than me on 
> > what to do in this situation.

I wrote a email to legal discuss, let's see how they will reply.

>
> How about removing the file as soon as the npm install is finished?
>
> >
> > And lastly my -1 is not a veto, you only need 3 +1 and more +1s than -1s to 
> > release, but I would consider making a release carefully.
> >
> > Thanks,
> > Justin
>
>
>
> --
> Best Regards！
> Huxing



-- 
Best Regards！
Huxing

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Ian Luo]

I also reported the issue in eslint [1] community and in webpack [2]
community. Considering these two tools are widely adopted for javascript
development, they may take this seriously. But from our side, I guess
there's nothing more we could do for now but wait for the responses from
them and what legal team says.

Regards,
-Ian.

1. https://github.com/eslint/eslint/issues/11536
2. https://github.com/webpack/webpack/issues/8936


On Thu, Mar 21, 2019 at 5:55 PM Huxing Zhang  wrote:

> Hi,
>
> On Thu, Mar 21, 2019 at 4:34 PM Huxing Zhang  wrote:
> >
> > Hi,
> >
> >
> > On Thu, Mar 21, 2019 at 3:55 PM Justin Mclean 
> wrote:
> > >
> > > Hi,
> > >
> > > This is probably against copyright law, and IMO just because others
> ignore it doesn’t mean we should.
> > >
> > > There probably a couple of courses of action:
> > > - Ask the maintainer of that npm module to replace that file with
> something that's permissible to use.
>
> I filed an issue here:
> https://github.com/substack/node-wordwrap/issues/21, given that the
> commit ceased since 2015, I don't think there will be a quick reply.
>
> > > - Ask on legal discuss for advice, they may have a better idea than me
> on what to do in this situation.
>
> I wrote a email to legal discuss, let's see how they will reply.
>
> >
> > How about removing the file as soon as the npm install is finished?
> >
> > >
> > > And lastly my -1 is not a veto, you only need 3 +1 and more +1s than
> -1s to release, but I would consider making a release carefully.
> > >
> > > Thanks,
> > > Justin
> >
> >
> >
> > --
> > Best Regards！
> > Huxing
>
>
>
> --
> Best Regards！
> Huxing
>

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Huxing Zhang]

Hi,

Feedback from webpack community suggest to upgrade to 4.0, which no
longer depend on wordwrap.
For the eslint dependency I think a work around should remove it
temporally  and add it back once the issue has been fixed.

How do you think?

On Thu, Mar 21, 2019 at 7:23 PM Ian Luo  wrote:
>
> I also reported the issue in eslint [1] community and in webpack [2]
> community. Considering these two tools are widely adopted for javascript
> development, they may take this seriously. But from our side, I guess
> there's nothing more we could do for now but wait for the responses from
> them and what legal team says.
>
> Regards,
> -Ian.
>
> 1. https://github.com/eslint/eslint/issues/11536
> 2. https://github.com/webpack/webpack/issues/8936
>
>
> On Thu, Mar 21, 2019 at 5:55 PM Huxing Zhang  wrote:
>
> > Hi,
> >
> > On Thu, Mar 21, 2019 at 4:34 PM Huxing Zhang  wrote:
> > >
> > > Hi,
> > >
> > >
> > > On Thu, Mar 21, 2019 at 3:55 PM Justin Mclean 
> > wrote:
> > > >
> > > > Hi,
> > > >
> > > > This is probably against copyright law, and IMO just because others
> > ignore it doesn’t mean we should.
> > > >
> > > > There probably a couple of courses of action:
> > > > - Ask the maintainer of that npm module to replace that file with
> > something that's permissible to use.
> >
> > I filed an issue here:
> > https://github.com/substack/node-wordwrap/issues/21, given that the
> > commit ceased since 2015, I don't think there will be a quick reply.
> >
> > > > - Ask on legal discuss for advice, they may have a better idea than me
> > on what to do in this situation.
> >
> > I wrote a email to legal discuss, let's see how they will reply.
> >
> > >
> > > How about removing the file as soon as the npm install is finished?
> > >
> > > >
> > > > And lastly my -1 is not a veto, you only need 3 +1 and more +1s than
> > -1s to release, but I would consider making a release carefully.
> > > >
> > > > Thanks,
> > > > Justin
> > >
> > >
> > >
> > > --
> > > Best Regards！
> > > Huxing
> >
> >
> >
> > --
> > Best Regards！
> > Huxing
> >



-- 
Best Regards！
Huxing

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Ian Luo]

It's not yet, sorry about that :-D

-Ian.

On Wed, Mar 27, 2019 at 10:24 AM Ian Luo  wrote:

> ps, just noticed that the pull request [1] has been merged.
>
>
> 1. https://github.com/substack/node-wordwrap/pull/22
>
> On Wed, Mar 27, 2019 at 10:22 AM Ian Luo  wrote:
>
>> We certainly could try to upgrade webpack to the latest version, but
>> eslint is another issue, it depends on wordwrap too, see more from this
>> issue [1].
>>
>> Thanks,
>> -Ian.
>>
>> 1. https://github.com/eslint/eslint/issues/11536
>>
>> On Wed, Mar 27, 2019 at 12:06 AM Huxing Zhang  wrote:
>>
>>> Hi,
>>>
>>> Feedback from webpack community suggest to upgrade to 4.0, which no
>>> longer depend on wordwrap.
>>> For the eslint dependency I think a work around should remove it
>>> temporally  and add it back once the issue has been fixed.
>>>
>>> How do you think?
>>>
>>> On Thu, Mar 21, 2019 at 7:23 PM Ian Luo  wrote:
>>> >
>>> > I also reported the issue in eslint [1] community and in webpack [2]
>>> > community. Considering these two tools are widely adopted for
>>> javascript
>>> > development, they may take this seriously. But from our side, I guess
>>> > there's nothing more we could do for now but wait for the responses
>>> from
>>> > them and what legal team says.
>>> >
>>> > Regards,
>>> > -Ian.
>>> >
>>> > 1. https://github.com/eslint/eslint/issues/11536
>>> > 2. https://github.com/webpack/webpack/issues/8936
>>> >
>>> >
>>> > On Thu, Mar 21, 2019 at 5:55 PM Huxing Zhang 
>>> wrote:
>>> >
>>> > > Hi,
>>> > >
>>> > > On Thu, Mar 21, 2019 at 4:34 PM Huxing Zhang 
>>> wrote:
>>> > > >
>>> > > > Hi,
>>> > > >
>>> > > >
>>> > > > On Thu, Mar 21, 2019 at 3:55 PM Justin Mclean <
>>> jus...@classsoftware.com>
>>> > > wrote:
>>> > > > >
>>> > > > > Hi,
>>> > > > >
>>> > > > > This is probably against copyright law, and IMO just because
>>> others
>>> > > ignore it doesn’t mean we should.
>>> > > > >
>>> > > > > There probably a couple of courses of action:
>>> > > > > - Ask the maintainer of that npm module to replace that file with
>>> > > something that's permissible to use.
>>> > >
>>> > > I filed an issue here:
>>> > > https://github.com/substack/node-wordwrap/issues/21, given that the
>>> > > commit ceased since 2015, I don't think there will be a quick reply.
>>> > >
>>> > > > > - Ask on legal discuss for advice, they may have a better idea
>>> than me
>>> > > on what to do in this situation.
>>> > >
>>> > > I wrote a email to legal discuss, let's see how they will reply.
>>> > >
>>> > > >
>>> > > > How about removing the file as soon as the npm install is finished?
>>> > > >
>>> > > > >
>>> > > > > And lastly my -1 is not a veto, you only need 3 +1 and more +1s
>>> than
>>> > > -1s to release, but I would consider making a release carefully.
>>> > > > >
>>> > > > > Thanks,
>>> > > > > Justin
>>> > > >
>>> > > >
>>> > > >
>>> > > > --
>>> > > > Best Regards！
>>> > > > Huxing
>>> > >
>>> > >
>>> > >
>>> > > --
>>> > > Best Regards！
>>> > > Huxing
>>> > >
>>>
>>>
>>>
>>> --
>>> Best Regards！
>>> Huxing
>>>
>>

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Ian Luo]

We certainly could try to upgrade webpack to the latest version, but eslint
is another issue, it depends on wordwrap too, see more from this issue [1].

Thanks,
-Ian.

1. https://github.com/eslint/eslint/issues/11536

On Wed, Mar 27, 2019 at 12:06 AM Huxing Zhang  wrote:

> Hi,
>
> Feedback from webpack community suggest to upgrade to 4.0, which no
> longer depend on wordwrap.
> For the eslint dependency I think a work around should remove it
> temporally  and add it back once the issue has been fixed.
>
> How do you think?
>
> On Thu, Mar 21, 2019 at 7:23 PM Ian Luo  wrote:
> >
> > I also reported the issue in eslint [1] community and in webpack [2]
> > community. Considering these two tools are widely adopted for javascript
> > development, they may take this seriously. But from our side, I guess
> > there's nothing more we could do for now but wait for the responses from
> > them and what legal team says.
> >
> > Regards,
> > -Ian.
> >
> > 1. https://github.com/eslint/eslint/issues/11536
> > 2. https://github.com/webpack/webpack/issues/8936
> >
> >
> > On Thu, Mar 21, 2019 at 5:55 PM Huxing Zhang  wrote:
> >
> > > Hi,
> > >
> > > On Thu, Mar 21, 2019 at 4:34 PM Huxing Zhang 
> wrote:
> > > >
> > > > Hi,
> > > >
> > > >
> > > > On Thu, Mar 21, 2019 at 3:55 PM Justin Mclean <
> jus...@classsoftware.com>
> > > wrote:
> > > > >
> > > > > Hi,
> > > > >
> > > > > This is probably against copyright law, and IMO just because others
> > > ignore it doesn’t mean we should.
> > > > >
> > > > > There probably a couple of courses of action:
> > > > > - Ask the maintainer of that npm module to replace that file with
> > > something that's permissible to use.
> > >
> > > I filed an issue here:
> > > https://github.com/substack/node-wordwrap/issues/21, given that the
> > > commit ceased since 2015, I don't think there will be a quick reply.
> > >
> > > > > - Ask on legal discuss for advice, they may have a better idea
> than me
> > > on what to do in this situation.
> > >
> > > I wrote a email to legal discuss, let's see how they will reply.
> > >
> > > >
> > > > How about removing the file as soon as the npm install is finished?
> > > >
> > > > >
> > > > > And lastly my -1 is not a veto, you only need 3 +1 and more +1s
> than
> > > -1s to release, but I would consider making a release carefully.
> > > > >
> > > > > Thanks,
> > > > > Justin
> > > >
> > > >
> > > >
> > > > --
> > > > Best Regards！
> > > > Huxing
> > >
> > >
> > >
> > > --
> > > Best Regards！
> > > Huxing
> > >
>
>
>
> --
> Best Regards！
> Huxing
>

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Ian Luo]

ps, just noticed that the pull request [1] has been merged.


1. https://github.com/substack/node-wordwrap/pull/22

On Wed, Mar 27, 2019 at 10:22 AM Ian Luo  wrote:

> We certainly could try to upgrade webpack to the latest version, but
> eslint is another issue, it depends on wordwrap too, see more from this
> issue [1].
>
> Thanks,
> -Ian.
>
> 1. https://github.com/eslint/eslint/issues/11536
>
> On Wed, Mar 27, 2019 at 12:06 AM Huxing Zhang  wrote:
>
>> Hi,
>>
>> Feedback from webpack community suggest to upgrade to 4.0, which no
>> longer depend on wordwrap.
>> For the eslint dependency I think a work around should remove it
>> temporally  and add it back once the issue has been fixed.
>>
>> How do you think?
>>
>> On Thu, Mar 21, 2019 at 7:23 PM Ian Luo  wrote:
>> >
>> > I also reported the issue in eslint [1] community and in webpack [2]
>> > community. Considering these two tools are widely adopted for javascript
>> > development, they may take this seriously. But from our side, I guess
>> > there's nothing more we could do for now but wait for the responses from
>> > them and what legal team says.
>> >
>> > Regards,
>> > -Ian.
>> >
>> > 1. https://github.com/eslint/eslint/issues/11536
>> > 2. https://github.com/webpack/webpack/issues/8936
>> >
>> >
>> > On Thu, Mar 21, 2019 at 5:55 PM Huxing Zhang  wrote:
>> >
>> > > Hi,
>> > >
>> > > On Thu, Mar 21, 2019 at 4:34 PM Huxing Zhang 
>> wrote:
>> > > >
>> > > > Hi,
>> > > >
>> > > >
>> > > > On Thu, Mar 21, 2019 at 3:55 PM Justin Mclean <
>> jus...@classsoftware.com>
>> > > wrote:
>> > > > >
>> > > > > Hi,
>> > > > >
>> > > > > This is probably against copyright law, and IMO just because
>> others
>> > > ignore it doesn’t mean we should.
>> > > > >
>> > > > > There probably a couple of courses of action:
>> > > > > - Ask the maintainer of that npm module to replace that file with
>> > > something that's permissible to use.
>> > >
>> > > I filed an issue here:
>> > > https://github.com/substack/node-wordwrap/issues/21, given that the
>> > > commit ceased since 2015, I don't think there will be a quick reply.
>> > >
>> > > > > - Ask on legal discuss for advice, they may have a better idea
>> than me
>> > > on what to do in this situation.
>> > >
>> > > I wrote a email to legal discuss, let's see how they will reply.
>> > >
>> > > >
>> > > > How about removing the file as soon as the npm install is finished?
>> > > >
>> > > > >
>> > > > > And lastly my -1 is not a veto, you only need 3 +1 and more +1s
>> than
>> > > -1s to release, but I would consider making a release carefully.
>> > > > >
>> > > > > Thanks,
>> > > > > Justin
>> > > >
>> > > >
>> > > >
>> > > > --
>> > > > Best Regards！
>> > > > Huxing
>> > >
>> > >
>> > >
>> > > --
>> > > Best Regards！
>> > > Huxing
>> > >
>>
>>
>>
>> --
>> Best Regards！
>> Huxing
>>
>

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Huxing Zhang]

Hi,


On Thu, Mar 21, 2019 at 1:45 PM Justin Mclean  wrote:
>
> Hi,
>
> > These dependencies are all development time dependencies, which can be
> > found in "devDependencies" section of package.json file.
>
> Anyone who compiles the source will get these and be unaware of them, that 
> seems a little problamatic to me.
>
> > For node-notifier, which is also a dev dependency, I am not sure how
> > it is used in dubbo-admin. But I tried to remove it and build it,
> > everything looks good. I think it can be removed.
>
> That would be best I think.

To avoid things like this to happen again, I think we need to add some
check when voting for the release.

I tried to do the following:

$ cd dubbo-admin-ui/node_module
$ grep -rin --include=**/*LICENSE "GPL" .
./node-forge/LICENSE:2:GNU General Public License (GPL) Version 2.
./node-forge/LICENSE:8:If the GPL suits your project better you are
also free to use Forge under

It shows the node-forge module has contains GPL license, but looking
into the license file, it is actually dual licensed with GPL (Category
X) and BSD-3 clause (Category A). So I think it is fine.
We may add more keywords mentioned in the Category X list.

>
> Thanks,
> Justin



-- 
Best Regards！
Huxing

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Justin Mclean]

Hi,

> It shows the node-forge module has contains GPL license, but looking
> into the license file, it is actually dual licensed with GPL (Category
> X) and BSD-3 clause (Category A). So I think it is fine.

Yep that is fine, for anything dual licensed you can take the most permissive 
license.

Thanks,
Justin

Re: [VOTE]: Release Apache Dubbo Admin(Incubating) 0.2.0 [RC2]

[Minxuan Zhuang]

Hi:
I've fixed the issue listed above:
1. Upgrade to webpack4 to avoid wordwrap dependency.
2. Remove eslint since the latest version includes wordwrap.
3. Remove node-notifier to avoid the GPL (a category X) dependancy.

I'll start a new vote to release Dubbo Admin 0.2.0, Thanks.

On Wed, Mar 27, 2019 at 5:08 PM Justin Mclean 
wrote:

> Hi,
>
> > It shows the node-forge module has contains GPL license, but looking
> > into the license file, it is actually dual licensed with GPL (Category
> > X) and BSD-3 clause (Category A). So I think it is fine.
>
> Yep that is fine, for anything dual licensed you can take the most
> permissive license.
>
> Thanks,
> Justin