Howdy,
Thanks Herve, but Karl was talking about SHA512 checksums, albeit unclear
is it bin or src...
And the signature probably changed probably due TS
(as what was signed and by whom was signed was byte-wise same, only when
was signed differs)
T
On Wed, Oct 4, 2023 at 8:10 AM Hervé Boutemy wrote:
> I updated my svn and ran:
>
> for f in *
> do
> rm $f
> wget
> https://repository.apache.org/content/repositories/maven-1996/org/apache/maven/apache-maven/3.9.5/$f
> done
>
> both in source and binaries: this resulted in .asc change in source only,
> everything else was ok
>
> I committed the update
>
> now we have:
> ❯ svn log
>
> r64327 | hboutemy | 2023-10-03 23:37:28 +0200 (Tue, 03 Oct 2023) | 1 line
>
> update signature with new staging content
>
> r64300 | cstamas | 2023-10-02 20:06:52 +0200 (Mon, 02 Oct 2023) | 2 lines
>
> Updated Maven 3.9.5 bin bundles
>
>
> r64283 | cstamas | 2023-10-01 20:44:52 +0200 (Sun, 01 Oct 2023) | 3 lines
>
> Apache Maven 3.9.5
>
> Regards,
>
> Hervé
>
> Le mardi 3 octobre 2023, 23:23:06 CEST Tamás Cservenák a écrit :
> > Karl,
> >
> > Are you sure your SVN checkout is up to date?
> > As I did change archives along with signatures and checksums, and they
> > should be OK
> >
> > This is the commit email of my change:
> > https://lists.apache.org/thread/7wn1sgd7hbcndtgypvjz4qzx0d2brobx
> >
> > Can someone else verify this?
> >
> > Thanks
> > T
> >
> > On Tue, Oct 3, 2023 at 1:05 PM Karl Heinz Marbaise
> >
> > wrote:
> > > Hi,
> > >
> > > the permissions in the .tar.gz archive are Ok now.
> > >
> > > Please update the SHA512 because it's the previous one..(I've checked
> > > the .tar.gz) but I assume that the SHA512 for the -bin.zip has changed
> > > also)...
> > >
> > > https://dist.apache.org/repos/dist/dev/maven/maven-3/3.9.5/binaries/
> > >
> > > Kind regards
> > > Karl Heinz Marbaise
> > >
> > > On 02.10.23 11:10, Tamás Cservenák wrote:
> > > > Bah,
> > > >
> > > > This is the same problem as before... but originally it happened on
> my
> > > > desktop. This time the release was done from my laptop :(
> > > >
> > > > I believe the fix is the same as before: I should rebuild from the
> tag,
> > > > after I fixed my local repository, as source bundles we vote on are
> > > > unchanged...
> > > >
> > > > T
> > > >
> > > >
> > > > On Mon, Oct 2, 2023 at 9:14 AM Herve Boutemy
> > >
> > > wrote:
> > > >> thinking twice, I need to change to -1: this may impact users that
> > >
> > > expect
> > >
> > > >> to use the group permissions to use Maven binaries
> > > >>
> > > >> sorry
> > > >> I don't know what tests you are doing with permissions on your
> > > >> environment, but these tests leak releases :(
> > > >>
> > > >> Regards,
> > > >>
> > > >> Hervé
> > > >>
> > > >> On 2023/10/02 07:11:02 Herve Boutemy wrote:
> > > >>> +1
> > > >>>
> > > >>> but Reproducible not fully ok: reference build done with JDK 17 on
> > > >>> *nix
> > > >>
> > > >> and umask 022
> > > >>
> > > >>> apache-maven-3.9.5-bin.zip and .tar.gz suffer from weird umask
> (go-r)
> > >
> > > on
> > >
> > > >> wagon jars:
> > > >>> $ diffoscope
> > > >>
> > > >> target/reference/org.apache.maven/apache-maven-3.9.5-bin.zip
> > > >> apache-maven/target/apache-maven-3.9.5-bin.zip
> > > >>
> > > >>> --- target/reference/org.apache.maven/apache-maven-3.9.5-bin.zip
> > > >>> +++ apache-maven/target/apache-maven-3.9.5-bin.zip
> > > >>> │┄ Archive contents identical but files differ, possibly due to
> > > >>
> > > >> different compression levels. Falling back to binary comparison.
> > > >>
> > > >>> ├── zipinfo {}
> > > >>> │ @@ -81,21 +81,21 @@
> > > >>> │ -rw-r--r-- 2.0 unx74345 b- defN 23-Oct-01 18:38
> > > >>
> > > >> apache-maven-3.9.5/lib/maven-resolver-provider-3.9.5.jar
> > > >>
> > > >>> │ -rw-r--r-- 2.0 unx 317619 b- defN 23-Oct-01 18:38
> > > >>
> > > >> apache-maven-3.9.5/lib/maven-resolver-impl-1.9.16.jar
> > > >>
> > > >>> │ -rw-r--r-- 2.0 unx37757 b- defN 23-Oct-01 18:38
> > > >>
> > > >> apache-maven-3.9.5/lib/maven-resolver-named-locks-1.9.16.jar
> > > >>
> > > >>> │ -rw-r--r-- 2.0 unx51503 b- defN 23-Oct-01 18:38
> > > >>
> > > >> apache-maven-3.9.5/lib/maven-resolver-spi-1.9.16.jar
> > > >>
> > > >>> │ -rw-r--r-- 2.0 unx 379348 b- defN 23-Oct-01 18:38
> > > >>
> > > >> apache-maven-3.9.5/lib/org.eclipse.sisu.inject-0.3.5.jar
> > > >>
> > > >>> │ -rw-r--r-- 2.0 unx 4225 b- defN 23-Oct-01 18:38
> > > >>
> > > >> apache-maven-3.9.5/lib/plexus-component-annotations-2.1.0.jar
> > > >>
> > > >>> │ -rw-r--r-- 2.0 unx 289577 b- defN 23-Oct-01 18:38
> > > >>
> > > >> apache-maven-3.9.5/lib/maven-compat-3.9.5.jar
> > > >>
> > > >>> │ --rw--- 2.0 unx55101 b- defN 23-Oct-01 18:38
> > > >>
> > > >> apache-maven-3.9.5/lib/wagon-provider-api-3.5.3.ja