[jira] [Created] (FELIX-5099) JSESSIONID Cookie in HTTPS Session Without 'Secure' and ‘HttpOnly’ Attributes

2015-11-13 Thread Antonio Sanso (JIRA)
Antonio Sanso created FELIX-5099: Summary: JSESSIONID Cookie in HTTPS Session Without 'Secure' and ‘HttpOnly’ Attributes Key: FELIX-5099 URL: https://issues.apache.org/jira/browse/FELIX-5099 Project:

[jira] [Updated] (FELIX-5099) JSESSIONID Cookie in HTTPS Session Without 'Secure' and ‘HttpOnly’ Attributes

2015-11-13 Thread Antonio Sanso (JIRA)
[ https://issues.apache.org/jira/browse/FELIX-5099?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Antonio Sanso updated FELIX-5099: - Attachment: FELIX-5099-patch.txt attaching proposed patch > JSESSIONID Cookie in HTTPS Session Wi

[jira] [Created] (FELIX-5100) PackageAdmin WebConsole tab "Dependency Finder" always exposes the first maven dependency found in the bundle

2015-11-13 Thread Konrad Windszus (JIRA)
Konrad Windszus created FELIX-5100: -- Summary: PackageAdmin WebConsole tab "Dependency Finder" always exposes the first maven dependency found in the bundle Key: FELIX-5100 URL: https://issues.apache.org/jira/brow

Re: [RESULT] [VOTE] Release Apache Maven Bundle Plugin version 3.0.1

2015-11-13 Thread Pierre De Rop
I will try to do it, but before I have a question: it seems that there is a diff between the files currently committed in the Felix release repository and this new release candidate: Indeed, in the release repository, we currently have the following signatures files that are not present in this ne

Re: [RESULT] [VOTE] Release Apache Maven Bundle Plugin version 3.0.1

2015-11-13 Thread Stuart McCulloch
Those files are extraneous artifacts from old Maven releases (where everything got a checksum, even signature files) - this was fixed in https://issues.apache.org/jira/browse/MNG-5504 They aren’t exposed from the site download page, and don’t provide any extra security over the existing checksu

Re: [RESULT] [VOTE] Release Apache Maven Bundle Plugin version 3.0.1

2015-11-13 Thread Benson Margulies
The only things in the dist area should be the source release zip, it's detached signature file, and its md5 and sha1 files. On Fri, Nov 13, 2015 at 6:35 AM, Stuart McCulloch wrote: > Those files are extraneous artifacts from old Maven releases (where > everything got a checksum, even signature

Re: [RESULT] [VOTE] Release Apache Maven Bundle Plugin version 3.0.1

2015-11-13 Thread David Bosschaert
Really? I think the downloads http://felix.apache.org/downloads.cgi points to the dist area so for that it also has to contain the binaries? David On 13 November 2015 at 12:07, Benson Margulies wrote: > The only things in the dist area should be the source release zip, > it's detached signature

Re: [RESULT] [VOTE] Release Apache Maven Bundle Plugin version 3.0.1

2015-11-13 Thread Pierre De Rop
Thanks Stuart for confirming this. I just replaced the maven-bundle-plugin 3.0.0 by the new 3.0.1 release: [nxuser@nx0012 release_felix]$ svn commit -m "Uploaded the maven-bundle-plugin release 3.0.1 in the Felix release repository." . Deleting maven-bundle-plugin-3.0.0-javadoc.jar Deleting

Re: [RESULT] [VOTE] Release Apache Maven Bundle Plugin version 3.0.1

2015-11-13 Thread Benson Margulies
There is no requirement to publish 'convenience binaries' in the dist areas. For a maven plugin, they are not even convenient. They are not forbidden, just not required. On Fri, Nov 13, 2015 at 7:31 AM, David Bosschaert wrote: > Really? I think the downloads http://felix.apache.org/downloads.cgi

Re: [RESULT] [VOTE] Release Apache Maven Bundle Plugin version 3.0.1

2015-11-13 Thread David Bosschaert
True, for a maven plugin I don't see why anyone would ever download it manually from the dist area. Cheers, David On 13 November 2015 at 13:07, Benson Margulies wrote: > There is no requirement to publish 'convenience binaries' in the dist > areas. For a maven plugin, they are not even convenie

org.apache.jackrabbit.oak.plugins.index.solr.osgi.SolrServerProviderService has incorrect updated reference

2015-11-13 Thread Andrew Cottrell
org.apache.jackrabbit.oak.plugins.index.solr.osgi.SolrServerProviderService has an @Reference annotation that specifies updated="updateSolrServerConfigurationProvider", but there is no such method. There is a method named "updatedSolrServerConfigurationProvider".

org.apache.jackrabbit.oak.plugins.index.solr.osgi.SolrQueryIndexProviderService.nodeAggregator should be volatile

2015-11-13 Thread Andrew Cottrell
org.apache.jackrabbit.oak.plugins.index.solr.osgi.SolrQueryIndexProviderService.nodeAggregator should be volatile as it has ReferencePolicy.DYNAMIC