Hi all,
Excuse my confusion regarding this.
So what we need is to sign the NBMs using our PGP keys, right?
I mean, use our PGP keys for release builds and using some other PGP
keys for development builds,.
Thanks,
Antonio
El 10/11/19 a las 14:16, Jaroslav Tulach escribió:
Can’t we
Can’t we change/enhance the way we do signing?
1. If there is an .asc file next to the .nbm one, then use it to verify the
NBM. Search https://www.apache.org/dist/netbeans/KEYS to get list of approved
keys. Display trusted, if .asc file is OK.
2. If the NBM comes from Maven central, but isn’t
On Fri, 8 Nov 2019, 10:35 Geertjan Wielenga, wrote:
> How is the signing done for Apache NetBeans during releases and why can't
> that be used for the patch too?
>
Different kinds of signing. The releases and the updates will be signed as
ASF requires with an external .asc file. But the nbms in
How is the signing done for Apache NetBeans during releases and why can't
that be used for the patch too? Sorry, ignorant on this point and need to
understand this aspect to be able to participate in the discussion,
alternatively those who are familiar with this should take the lead and do
what is
On Thu, 7 Nov 2019 at 17:05, Korney Czukowski wrote:
> Although even with almost
> everything in place, there's still this issue with nbm signing, so
> practically the Update Center cannot be used for now, right (else you
> would have already used it)? If this is the case, then a (trusted)
>
Then I must have misunderstood your earlier comment about issues due to
changes in the build system, my apologies. Although even with almost
everything in place, there's still this issue with nbm signing, so
practically the Update Center cannot be used for now, right (else you
would have
On Thu, 7 Nov 2019 at 16:14, Korney Czukowski wrote:
> If the Update Center is out of the question for now,
it isn't! That bit is not the problem. The only problem to
delivery at the moment is signing the nbm with a certificate that's
trusted by the IDE.
> Of course, both options should be
If the Update Center is out of the question for now, maybe it would be
feasible to create an offline update installer consisting only of a
couple of nbms that need to be updated, that would update an existing
NetBeans installation? Then it should be possible to vote for just for
this very
On Thu, 7 Nov 2019 at 10:43, Geertjan Wielenga wrote:
> Can someone -- preferably Eric, Neil, Laszlo, Jan, or Matthias, suggest a
> way forward to get an update out, i.e., we could even call it 11.2.1,
> maybe, if we can't figure out how to release the two modules (what would be
> the problem
;
>> -Message d'origine-----
>> De : Neil C Smith
>> Envoyé : mardi 29 octobre 2019 18:42
>> À : dev
>> Objet : Re: [DISCUSS] Handling release updates
>>
>> On Tue, 29 Oct 2019 at 15:53, Eric Barboni wrote:
>> > You cannot do a RELEASE112.1 in
hen vote with sources + the limited artefacts RELEASE112-update1 to be
> able to release them in central
>
> Best Regards
> Eric
>
>
>
>
> -Message d'origine-
> De : Neil C Smith
> Envoyé : mardi 29 octobre 2019 18:42
> À : dev
> Objet : Re: [DISCUS
-update1 to be able
to release them in central
Best Regards
Eric
-Message d'origine-
De : Neil C Smith
Envoyé : mardi 29 octobre 2019 18:42
À : dev
Objet : Re: [DISCUSS] Handling release updates
On Tue, 29 Oct 2019 at 15:53, Eric Barboni wrote:
> You cannot do a RELEASE11
On Tue, 29 Oct 2019 at 15:53, Eric Barboni wrote:
> You cannot do a RELEASE112.1 in the
> org.netbeans(api,modules,clusters,external) without rebuild the whole
> NetBeans stack because every pom will need the RELEASE112.1 version on
> dependencies nbm being a side artefacts.
> It's not
t possible to overwrite a released artefacts you cannot do a RELEASE112
again.
Hope It helps,
Best regards
Eric
-Message d'origine-
De : Neil C Smith
Envoyé : samedi 26 octobre 2019 20:20
À : dev
Objet : Re: [DISCUSS] Handling release updates
On Sat, 26 Oct 2019 at 05:17, Laszlo Kisha
Hi,
Am Montag, den 28.10.2019, 19:24 + schrieb Neil C Smith:
> On Mon, 28 Oct 2019 at 19:00, Matthias Bläsing
> wrote:
> > if I'm not mistaken, currently the NBMs we produce are not signed when
> > we release. This is what I suggest:
>
> No, they're not.
I just remembered, where I saw this
On Mon, 28 Oct 2019 at 19:00, Matthias Bläsing
wrote:
> if I'm not mistaken, currently the NBMs we produce are not signed when
> we release. This is what I suggest:
No, they're not.
> - all updates will be signed with that key, as it is trusted, it can be
> used to safely install updates
Hi,
Am Sonntag, den 27.10.2019, 12:18 +0100 schrieb Jan Lahoda:
> [How to handle updates]
> But I have no idea if we asked to an access there. (And if ASF would pay
> for each signed file, then singing several hundreds NBMs would not fly
> anyway, I think.) But we could at least use that for this
On Mon, 28 Oct 2019 at 18:16, Geertjan Wielenga wrote:
> How are we doing in this discussion, at least, what can we do to release
> the fix to the nb-javac which, without it, will otherwise cause refactoring
> to fail if nb-javac is installed?
We need it merged to master. We ideally need a
Hi all,
How are we doing in this discussion, at least, what can we do to release
the fix to the nb-javac which, without it, will otherwise cause refactoring
to fail if nb-javac is installed?
Gj
On Sun, Oct 27, 2019 at 12:19 PM Jan Lahoda wrote:
> On Fri, Oct 25, 2019 at 1:04 PM Neil C Smith
On Fri, Oct 25, 2019 at 1:04 PM Neil C Smith wrote:
> On Thu, 24 Oct 2019 at 21:17, Jan Lahoda wrote:
> >> Still unsure about how we handle catalog and signing issues though.
> >> Am I right in thinking with current situation people will see a
> >> warning on update? Definitely see this
On Sat, 26 Oct 2019 at 05:17, Laszlo Kishalmi wrote:
> You put tremendous effort in the new pipeline to work
Credit where credit is due, the bulk of that effort was Eric. Now
thinking about it, one reason for the new build system is Maven
artefacts. Which, include the NBMs as is as far as I
On 10/25/19 8:55 AM, Neil C Smith wrote:
On Fri, 25 Oct 2019 at 16:02, Laszlo Kishalmi wrote:
So anyone can step up coordinate and do a patch release of some modules
if the community approves that. When we are releasing the whole IDE the
RM has one orientation: the whole IDE.
I'm -1 to
On Fri, 25 Oct 2019 at 16:02, Laszlo Kishalmi wrote:
> So anyone can step up coordinate and do a patch release of some modules
> if the community approves that. When we are releasing the whole IDE the
> RM has one orientation: the whole IDE.
I'm -1 to voting on patch sources vs a whole IDE patch
.
Regards
Eric
-Message d'origine-
De : Laszlo Kishalmi
Envoyé : vendredi 25 octobre 2019 14:52
À : dev@netbeans.apache.org
Objet : Re: [DISCUSS] Handling release updates
Well, the Gradle patch has been made in the following way:
1. The result of the release build has been further
Well, the Gradle patch has been made in the following way:
1. The result of the release build has been further processed,
extracting the source files for the changed modules and the necessary
files like NOTICE and licenses.
2. So the output of the patch build was a small source zip and the
On Thu, 24 Oct 2019 at 21:17, Jan Lahoda wrote:
>> Still unsure about how we handle catalog and signing issues though.
>> Am I right in thinking with current situation people will see a
>> warning on update? Definitely see this already when re-enabling
>> nb-javac.
>
> That is one of the things
On Thu, Oct 24, 2019 at 11:07 AM Neil C Smith wrote:
> On Thu, 24 Oct 2019 at 09:48, Jan Lahoda wrote:
> > Releasing the full source does sound easier for processes, so if
> reviewers are ok with that, sounds good to me. Should be possible to only
> upload specific NBMs. I guess the question is
On Thu, 24 Oct 2019 at 09:48, Jan Lahoda wrote:
> Releasing the full source does sound easier for processes, so if reviewers
> are ok with that, sounds good to me. Should be possible to only upload
> specific NBMs. I guess the question is when we do the update, given the
> refactoring is
Releasing the full source does sound easier for processes, so if reviewers are
ok with that, sounds good to me. Should be possible to only upload specific
NBMs. I guess the question is when we do the update, given the refactoring is
broken for 9+.
Jan
23. října 2019 15:03:03 SELČ, Neil C
On Wed, 23 Oct 2019 at 14:40, Eric Barboni wrote:
>
> What are the distribution nbms ? I see nbms in dist but they have all an
> asc file associated.
Yes, those. They have .asc files. But that's not the same as NBM /
JAR signing. eg. link Reema shared when this was last discussed -
What are the distribution nbms ? I see nbms in dist but they have all an asc
file associated.
Regards
Eric
-Message d'origine-
De : Neil C Smith
Envoyé : mercredi 23 octobre 2019 13:19
À : dev
Objet : Re: [DISCUSS] Handling release updates
On Tue, 22 Oct 2019 at 11:13, Neil C
On Wed, 23 Oct 2019 at 13:55, Geertjan Wielenga wrote:
>
> Agree completely. I suggest you put your proposal in a lazy consensus
> thread.
It's a best a half-baked proposal! :-) I was hoping for some input
and discussion first to clarify what we need and how best to achieve.
Best wishes,
Neil
Agree completely. I suggest you put your proposal in a lazy consensus
thread.
Gj
On Wed, Oct 23, 2019 at 2:52 PM Neil C Smith wrote:
> On Wed, 23 Oct 2019 at 13:47, Geertjan Wielenga
> wrote:
> > Will we really need to go through a vote process for this change?
>
> IMO, yes - it's still a
The question is though, just for clarity, whether we really do need to vote
at all if (when) we provide a patch soon after the 11.2 release for a fix
to nb-javac, which will mean that only this specific file will need to
change:
On Tue, 22 Oct 2019 at 11:13, Neil C Smith wrote:
> I'm wondering whether if we do ship updates, we trigger a new
> milestone in the release branch, and have a vote on full sources, as
> per normal. Alongside that we nominate specific module convenience
> binaries (nbms) to be added to the
Hi All,
A few recent emails make me think that there's at least the
possibility we'll want to consider some cherry-picked module updates
for 11.2 over the next month or so, assuming the release goes through
OK.
At present I think we've only done this once for 11.0 with the gradle
patch update?
36 matches
Mail list logo
