You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@commons.apache.org by Gary Gregory <ga...@gmail.com> on 2023/11/26 21:46:42 UTC
[VOTE] Release Apache Commons Logging 1.3.0 based on RC1
We have fixed a few bugs and added some enhancements since Apache
Commons Logging 1.2 was released, so I would like to release Apache
Commons Logging 1.3.0.
Apache Commons Logging 1.3.0 RC1 is available for review here:
https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1
(svn revision 65553)
The Git tag commons-logging-1.3.0-RC1 commit for this RC is
e0255a5845814802586b91c889ab3e9fc4bf9d68 which you can browse here:
https://gitbox.apache.org/repos/asf?p=commons-logging.git;a=commit;h=e0255a5845814802586b91c889ab3e9fc4bf9d68
You may checkout this tag using:
git clone https://gitbox.apache.org/repos/asf/commons-logging.git
--branch commons-logging-1.3.0-RC1 commons-logging-1.3.0-RC1
Maven artifacts are here:
https://repository.apache.org/content/repositories/orgapachecommons-1676/commons-logging/commons-logging/1.3.0/
These are the artifacts and their hashes:
#Release SHA-512s
#Sun Nov 26 16:38:45 EST 2023
commons-logging-1.3.0-adapters.jar=0b67e5fbca807b3d00ab5569cfac9fd14e268302ef514dee52eb1272762b35211d602045aefa71731108b900f6e0b7c78c3df39a989f3b86736e95a471b342c6
commons-logging-1.3.0-api.jar=d801af15997767abfbf0168651b19a55b8958e3b8c0106e054bdfd0098fdcb198c8dad0c123bd91448d0cb7b81851d4606319e43fed102c976b47143e481f371
commons-logging-1.3.0-bin.tar.gz=1fb9e4537fc59b75baf83b72a8e484604e6124ff7969b6f82955b29beeb5b86d9d115a494a6687e9a89a0b274f1ae9c226f289a7531334cc0451a3d4d5c2e3dc
commons-logging-1.3.0-bin.zip=43291b189957da5882eaf753792a041cd25f599b7fb6d960a16799ae450ae3cde59197fe4a664d59243a44c0cdd067eb9979ef2a225b762b0f56264a871c325c
commons-logging-1.3.0-bom.json=07580d9d52d4f93bf2a79e41388549a4f6f814cfcc5d6e05832036e480d0364e0bce212b79cc4e921d55587a00e0d1d1a1bcf8b3195fe9765e94f38294b60170
commons-logging-1.3.0-bom.xml=48a60112f79f6809a515a525837094b16e0ebff7daeeb561f20b639f18d47b3585f8e21595c469229caca9a0f2287649dbd8ce70105baa7d36bd621b68f42af7
commons-logging-1.3.0-javadoc.jar=73abbcf238b831d33fdb5c62406b6066183e3dce603535203b6fb0abc34c6aad9605eec2a5ca11981a2544b81447f8580f27a26f66e564f308c35152391c2cd7
commons-logging-1.3.0-sources.jar=ca39a42b2380c2c85800368546d8903b72e13f62bec665dd52db16f21dc214ecf81ff8a51f4739b5393b1d31326668e4ad5d0402eb4570728ad2a4321aeb6aa1
commons-logging-1.3.0-src.tar.gz=20cc40c7d7848da618801a86333f3984151d3089f806e5d7a1e92c83c1f90d330f1c7ded5d0ae70e48dd9de684f2e5da32de24fa2c406f6b419f77704c0e74f8
commons-logging-1.3.0-src.zip=516db2b8854846cf4c2bf5f4f3f4b7fc132183a7003eed0cff291f53f7f0a35d0dc4cc7eb362cd99ad5bf619620f16f7079e3015a7e01bda9e8802eca04a3fa3
commons-logging-1.3.0-test-sources.jar=159ec27c4343f926fe1cdc8977138b5200ef6f1284a3dddd361ae3cd19520d3e7b117e418272a4534b768859f1229e8ff7cd3555bed4f292c27e583a92fe9f2f
commons-logging-1.3.0-tests.jar=fb1d052e16ec83f9c6002a44ef79b84c08ad04b9ac3d378060e6adcf6d98860f4411c114837cca872427b1e5c663060a77f7157aabadf81fac1979ea34b44055
commons-logging_commons-logging-1.3.0.spdx.json=a416b9ae6d632f0638eb1c90184ecbe85bb91ce641b5ccea6ed64a144a6af80b20decaeb5d369aabb5e1cedd266d966fec5bc7517465414ab68036c526f9cb21
I have tested this with
mvn -V -Prelease -Ptest-deploy -P jacoco -P japicmp clean package site deploy
using:
Apache Maven 3.9.5 (57804ffe001d7215b5e7bcb531cf83df38f93546)
Maven home: /usr/local/Cellar/maven/3.9.5/libexec
Java version: 21.0.1, vendor: Homebrew, runtime:
/usr/local/Cellar/openjdk/21.0.1/libexec/openjdk.jdk/Contents/Home
Default locale: en_US, platform encoding: UTF-8
OS name: "mac os x", version: "14.1.1", arch: "x86_64", family: "mac"
Darwin **** 23.1.0 Darwin Kernel Version 23.1.0: Mon Oct 9 21:27:27
PDT 2023; root:xnu-10002.41.9~6/RELEASE_X86_64 x86_64
Details of changes since 1.2 are in the release notes:
https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/RELEASE-NOTES.txt
https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/changes-report.html
Site:
https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/index.html
(note some *relative* links are broken and the 1.3.0 directories
are not yet created - these will be OK once the site is deployed.)
JApiCmp Report (compared to 1.2):
https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/japicmp.html
Note that this report contains false-positives regarding generics:
Generics are erased at compile-time, so can't be binary incompatible.
RAT Report:
https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/rat-report.html
KEYS:
https://downloads.apache.org/commons/KEYS
Please review the release candidate and vote.
This vote will close no sooner than 72 hours from now.
[ ] +1 Release these artifacts
[ ] +0 OK, but...
[ ] -0 OK, but really should fix...
[ ] -1 I oppose this release because...
Thank you,
Gary Gregory,
Release Manager (using key 86fdc7e2a11262cb)
For following is intended as a helper and refresher for reviewers.
Validating a release candidate
==============================
These guidelines are NOT complete.
Requirements: Git, Java, Maven.
You can validate a release from a release candidate (RC) tag as follows.
1a) Clone and checkout the RC tag
git clone https://gitbox.apache.org/repos/asf/commons-logging.git
--branch commons-logging-1.3.0-RC1 commons-logging-1.3.0-RC1
cd commons-logging-1.3.0-RC1
1b) Download and unpack the source archive from:
https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/source
2) Check Apache licenses
This step is not required if the site includes a RAT report page which
you then must check.
mvn apache-rat:check
3) Check binary compatibility
Older components still use Apache Clirr:
This step is not required if the site includes a Clirr report page
which you then must check.
mvn clirr:check
Newer components use JApiCmp with the japicmp Maven Profile:
This step is not required if the site includes a JApiCmp report page
which you then must check.
mvn install -DskipTests -P japicmp japicmp:cmp
4) Build the package
mvn -V clean package
You can record the Maven and Java version produced by -V in your VOTE reply.
To gather OS information from a command line:
Windows: ver
Linux: uname -a
5) Build the site for a single module project
Note: Some plugins require the components to be installed instead of packaged.
mvn site
Check the site reports in:
- Windows: target\site\index.html
- Linux: target/site/index.html
-the end-
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
[RESULT][VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by Gary Gregory <ga...@gmail.com>.
This RC vote passes with the following +1 votes:
- Piotr P. Karwasz non-binding
- Rob Tompkins binding
- Bruno P. Kinoshita binding
- Gary Gregory binding
Gary
On Thu, Nov 30, 2023 at 6:24 AM Gary Gregory <ga...@gmail.com> wrote:
>
> My +1
>
> Gary
>
>
> On Wed, Nov 29, 2023, 12:37 PM Bruno P. Kinoshita <ki...@apache.org> wrote:
>>
>> +1
>>
>> Tested on
>>
>> Apache Maven 3.8.5 (3599d3414f046de2324203b78ddcf9b5e4388aa0)
>> Maven home: /opt/apache-maven-3.8.5
>> Java version: 17.0.9, vendor: Private Build, runtime: /usr/lib/jvm/java-17-openjdk-amd64
>> Default locale: en_US, platform encoding: UTF-8
>> OS name: "linux", version: "5.15.0-89-generic", arch: "amd64", family: "unix"
>>
>> Thank you!
>>
>> Bruno
>>
>> On 2023/11/26 21:46:42 Gary Gregory wrote:
>> > We have fixed a few bugs and added some enhancements since Apache
>> > Commons Logging 1.2 was released, so I would like to release Apache
>> > Commons Logging 1.3.0.
>> >
>> > Apache Commons Logging 1.3.0 RC1 is available for review here:
>> > https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1
>> > (svn revision 65553)
>> >
>> > The Git tag commons-logging-1.3.0-RC1 commit for this RC is
>> > e0255a5845814802586b91c889ab3e9fc4bf9d68 which you can browse here:
>> > https://gitbox.apache.org/repos/asf?p=commons-logging.git;a=commit;h=e0255a5845814802586b91c889ab3e9fc4bf9d68
>> > You may checkout this tag using:
>> > git clone https://gitbox.apache.org/repos/asf/commons-logging.git
>> > --branch commons-logging-1.3.0-RC1 commons-logging-1.3.0-RC1
>> >
>> > Maven artifacts are here:
>> > https://repository.apache.org/content/repositories/orgapachecommons-1676/commons-logging/commons-logging/1.3.0/
>> >
>> > These are the artifacts and their hashes:
>> >
>> > #Release SHA-512s
>> > #Sun Nov 26 16:38:45 EST 2023
>> > commons-logging-1.3.0-adapters.jar=0b67e5fbca807b3d00ab5569cfac9fd14e268302ef514dee52eb1272762b35211d602045aefa71731108b900f6e0b7c78c3df39a989f3b86736e95a471b342c6
>> > commons-logging-1.3.0-api.jar=d801af15997767abfbf0168651b19a55b8958e3b8c0106e054bdfd0098fdcb198c8dad0c123bd91448d0cb7b81851d4606319e43fed102c976b47143e481f371
>> > commons-logging-1.3.0-bin.tar.gz=1fb9e4537fc59b75baf83b72a8e484604e6124ff7969b6f82955b29beeb5b86d9d115a494a6687e9a89a0b274f1ae9c226f289a7531334cc0451a3d4d5c2e3dc
>> > commons-logging-1.3.0-bin.zip=43291b189957da5882eaf753792a041cd25f599b7fb6d960a16799ae450ae3cde59197fe4a664d59243a44c0cdd067eb9979ef2a225b762b0f56264a871c325c
>> > commons-logging-1.3.0-bom.json=07580d9d52d4f93bf2a79e41388549a4f6f814cfcc5d6e05832036e480d0364e0bce212b79cc4e921d55587a00e0d1d1a1bcf8b3195fe9765e94f38294b60170
>> > commons-logging-1.3.0-bom.xml=48a60112f79f6809a515a525837094b16e0ebff7daeeb561f20b639f18d47b3585f8e21595c469229caca9a0f2287649dbd8ce70105baa7d36bd621b68f42af7
>> > commons-logging-1.3.0-javadoc.jar=73abbcf238b831d33fdb5c62406b6066183e3dce603535203b6fb0abc34c6aad9605eec2a5ca11981a2544b81447f8580f27a26f66e564f308c35152391c2cd7
>> > commons-logging-1.3.0-sources.jar=ca39a42b2380c2c85800368546d8903b72e13f62bec665dd52db16f21dc214ecf81ff8a51f4739b5393b1d31326668e4ad5d0402eb4570728ad2a4321aeb6aa1
>> > commons-logging-1.3.0-src.tar.gz=20cc40c7d7848da618801a86333f3984151d3089f806e5d7a1e92c83c1f90d330f1c7ded5d0ae70e48dd9de684f2e5da32de24fa2c406f6b419f77704c0e74f8
>> > commons-logging-1.3.0-src.zip=516db2b8854846cf4c2bf5f4f3f4b7fc132183a7003eed0cff291f53f7f0a35d0dc4cc7eb362cd99ad5bf619620f16f7079e3015a7e01bda9e8802eca04a3fa3
>> > commons-logging-1.3.0-test-sources.jar=159ec27c4343f926fe1cdc8977138b5200ef6f1284a3dddd361ae3cd19520d3e7b117e418272a4534b768859f1229e8ff7cd3555bed4f292c27e583a92fe9f2f
>> > commons-logging-1.3.0-tests.jar=fb1d052e16ec83f9c6002a44ef79b84c08ad04b9ac3d378060e6adcf6d98860f4411c114837cca872427b1e5c663060a77f7157aabadf81fac1979ea34b44055
>> > commons-logging_commons-logging-1.3.0.spdx.json=a416b9ae6d632f0638eb1c90184ecbe85bb91ce641b5ccea6ed64a144a6af80b20decaeb5d369aabb5e1cedd266d966fec5bc7517465414ab68036c526f9cb21
>> >
>> > I have tested this with
>> >
>> > mvn -V -Prelease -Ptest-deploy -P jacoco -P japicmp clean package site deploy
>> >
>> > using:
>> >
>> > Apache Maven 3.9.5 (57804ffe001d7215b5e7bcb531cf83df38f93546)
>> > Maven home: /usr/local/Cellar/maven/3.9.5/libexec
>> > Java version: 21.0.1, vendor: Homebrew, runtime:
>> > /usr/local/Cellar/openjdk/21.0.1/libexec/openjdk.jdk/Contents/Home
>> > Default locale: en_US, platform encoding: UTF-8
>> > OS name: "mac os x", version: "14.1.1", arch: "x86_64", family: "mac"
>> >
>> > Darwin **** 23.1.0 Darwin Kernel Version 23.1.0: Mon Oct 9 21:27:27
>> > PDT 2023; root:xnu-10002.41.9~6/RELEASE_X86_64 x86_64
>> >
>> > Details of changes since 1.2 are in the release notes:
>> > https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/RELEASE-NOTES.txt
>> > https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/changes-report.html
>> >
>> > Site:
>> > https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/index.html
>> > (note some *relative* links are broken and the 1.3.0 directories
>> > are not yet created - these will be OK once the site is deployed.)
>> >
>> > JApiCmp Report (compared to 1.2):
>> > https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/japicmp.html
>> > Note that this report contains false-positives regarding generics:
>> > Generics are erased at compile-time, so can't be binary incompatible.
>> >
>> > RAT Report:
>> > https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/rat-report.html
>> >
>> > KEYS:
>> > https://downloads.apache.org/commons/KEYS
>> >
>> > Please review the release candidate and vote.
>> > This vote will close no sooner than 72 hours from now.
>> >
>> > [ ] +1 Release these artifacts
>> > [ ] +0 OK, but...
>> > [ ] -0 OK, but really should fix...
>> > [ ] -1 I oppose this release because...
>> >
>> > Thank you,
>> >
>> > Gary Gregory,
>> > Release Manager (using key 86fdc7e2a11262cb)
>> >
>> > For following is intended as a helper and refresher for reviewers.
>> >
>> > Validating a release candidate
>> > ==============================
>> >
>> > These guidelines are NOT complete.
>> >
>> > Requirements: Git, Java, Maven.
>> >
>> > You can validate a release from a release candidate (RC) tag as follows.
>> >
>> > 1a) Clone and checkout the RC tag
>> >
>> > git clone https://gitbox.apache.org/repos/asf/commons-logging.git
>> > --branch commons-logging-1.3.0-RC1 commons-logging-1.3.0-RC1
>> > cd commons-logging-1.3.0-RC1
>> >
>> > 1b) Download and unpack the source archive from:
>> >
>> > https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/source
>> >
>> > 2) Check Apache licenses
>> >
>> > This step is not required if the site includes a RAT report page which
>> > you then must check.
>> >
>> > mvn apache-rat:check
>> >
>> > 3) Check binary compatibility
>> >
>> > Older components still use Apache Clirr:
>> >
>> > This step is not required if the site includes a Clirr report page
>> > which you then must check.
>> >
>> > mvn clirr:check
>> >
>> > Newer components use JApiCmp with the japicmp Maven Profile:
>> >
>> > This step is not required if the site includes a JApiCmp report page
>> > which you then must check.
>> >
>> > mvn install -DskipTests -P japicmp japicmp:cmp
>> >
>> > 4) Build the package
>> >
>> > mvn -V clean package
>> >
>> > You can record the Maven and Java version produced by -V in your VOTE reply.
>> > To gather OS information from a command line:
>> > Windows: ver
>> > Linux: uname -a
>> >
>> > 5) Build the site for a single module project
>> >
>> > Note: Some plugins require the components to be installed instead of packaged.
>> >
>> > mvn site
>> > Check the site reports in:
>> > - Windows: target\site\index.html
>> > - Linux: target/site/index.html
>> >
>> > -the end-
>> >
>> > ---------------------------------------------------------------------
>> > To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
>> > For additional commands, e-mail: dev-help@commons.apache.org
>> >
>> >
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
>> For additional commands, e-mail: dev-help@commons.apache.org
>>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by Gary Gregory <ga...@gmail.com>.
My +1
Gary
On Wed, Nov 29, 2023, 12:37 PM Bruno P. Kinoshita <ki...@apache.org> wrote:
> +1
>
> Tested on
>
> Apache Maven 3.8.5 (3599d3414f046de2324203b78ddcf9b5e4388aa0)
> Maven home: /opt/apache-maven-3.8.5
> Java version: 17.0.9, vendor: Private Build, runtime:
> /usr/lib/jvm/java-17-openjdk-amd64
> Default locale: en_US, platform encoding: UTF-8
> OS name: "linux", version: "5.15.0-89-generic", arch: "amd64", family:
> "unix"
>
> Thank you!
>
> Bruno
>
> On 2023/11/26 21:46:42 Gary Gregory wrote:
> > We have fixed a few bugs and added some enhancements since Apache
> > Commons Logging 1.2 was released, so I would like to release Apache
> > Commons Logging 1.3.0.
> >
> > Apache Commons Logging 1.3.0 RC1 is available for review here:
> > https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1
> > (svn revision 65553)
> >
> > The Git tag commons-logging-1.3.0-RC1 commit for this RC is
> > e0255a5845814802586b91c889ab3e9fc4bf9d68 which you can browse here:
> >
> https://gitbox.apache.org/repos/asf?p=commons-logging.git;a=commit;h=e0255a5845814802586b91c889ab3e9fc4bf9d68
> > You may checkout this tag using:
> > git clone https://gitbox.apache.org/repos/asf/commons-logging.git
> > --branch commons-logging-1.3.0-RC1 commons-logging-1.3.0-RC1
> >
> > Maven artifacts are here:
> >
> https://repository.apache.org/content/repositories/orgapachecommons-1676/commons-logging/commons-logging/1.3.0/
> >
> > These are the artifacts and their hashes:
> >
> > #Release SHA-512s
> > #Sun Nov 26 16:38:45 EST 2023
> >
> commons-logging-1.3.0-adapters.jar=0b67e5fbca807b3d00ab5569cfac9fd14e268302ef514dee52eb1272762b35211d602045aefa71731108b900f6e0b7c78c3df39a989f3b86736e95a471b342c6
> >
> commons-logging-1.3.0-api.jar=d801af15997767abfbf0168651b19a55b8958e3b8c0106e054bdfd0098fdcb198c8dad0c123bd91448d0cb7b81851d4606319e43fed102c976b47143e481f371
> >
> commons-logging-1.3.0-bin.tar.gz=1fb9e4537fc59b75baf83b72a8e484604e6124ff7969b6f82955b29beeb5b86d9d115a494a6687e9a89a0b274f1ae9c226f289a7531334cc0451a3d4d5c2e3dc
> >
> commons-logging-1.3.0-bin.zip=43291b189957da5882eaf753792a041cd25f599b7fb6d960a16799ae450ae3cde59197fe4a664d59243a44c0cdd067eb9979ef2a225b762b0f56264a871c325c
> >
> commons-logging-1.3.0-bom.json=07580d9d52d4f93bf2a79e41388549a4f6f814cfcc5d6e05832036e480d0364e0bce212b79cc4e921d55587a00e0d1d1a1bcf8b3195fe9765e94f38294b60170
> >
> commons-logging-1.3.0-bom.xml=48a60112f79f6809a515a525837094b16e0ebff7daeeb561f20b639f18d47b3585f8e21595c469229caca9a0f2287649dbd8ce70105baa7d36bd621b68f42af7
> >
> commons-logging-1.3.0-javadoc.jar=73abbcf238b831d33fdb5c62406b6066183e3dce603535203b6fb0abc34c6aad9605eec2a5ca11981a2544b81447f8580f27a26f66e564f308c35152391c2cd7
> >
> commons-logging-1.3.0-sources.jar=ca39a42b2380c2c85800368546d8903b72e13f62bec665dd52db16f21dc214ecf81ff8a51f4739b5393b1d31326668e4ad5d0402eb4570728ad2a4321aeb6aa1
> >
> commons-logging-1.3.0-src.tar.gz=20cc40c7d7848da618801a86333f3984151d3089f806e5d7a1e92c83c1f90d330f1c7ded5d0ae70e48dd9de684f2e5da32de24fa2c406f6b419f77704c0e74f8
> >
> commons-logging-1.3.0-src.zip=516db2b8854846cf4c2bf5f4f3f4b7fc132183a7003eed0cff291f53f7f0a35d0dc4cc7eb362cd99ad5bf619620f16f7079e3015a7e01bda9e8802eca04a3fa3
> >
> commons-logging-1.3.0-test-sources.jar=159ec27c4343f926fe1cdc8977138b5200ef6f1284a3dddd361ae3cd19520d3e7b117e418272a4534b768859f1229e8ff7cd3555bed4f292c27e583a92fe9f2f
> >
> commons-logging-1.3.0-tests.jar=fb1d052e16ec83f9c6002a44ef79b84c08ad04b9ac3d378060e6adcf6d98860f4411c114837cca872427b1e5c663060a77f7157aabadf81fac1979ea34b44055
> >
> commons-logging_commons-logging-1.3.0.spdx.json=a416b9ae6d632f0638eb1c90184ecbe85bb91ce641b5ccea6ed64a144a6af80b20decaeb5d369aabb5e1cedd266d966fec5bc7517465414ab68036c526f9cb21
> >
> > I have tested this with
> >
> > mvn -V -Prelease -Ptest-deploy -P jacoco -P japicmp clean package site
> deploy
> >
> > using:
> >
> > Apache Maven 3.9.5 (57804ffe001d7215b5e7bcb531cf83df38f93546)
> > Maven home: /usr/local/Cellar/maven/3.9.5/libexec
> > Java version: 21.0.1, vendor: Homebrew, runtime:
> > /usr/local/Cellar/openjdk/21.0.1/libexec/openjdk.jdk/Contents/Home
> > Default locale: en_US, platform encoding: UTF-8
> > OS name: "mac os x", version: "14.1.1", arch: "x86_64", family: "mac"
> >
> > Darwin **** 23.1.0 Darwin Kernel Version 23.1.0: Mon Oct 9 21:27:27
> > PDT 2023; root:xnu-10002.41.9~6/RELEASE_X86_64 x86_64
> >
> > Details of changes since 1.2 are in the release notes:
> >
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/RELEASE-NOTES.txt
> >
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/changes-report.html
> >
> > Site:
> >
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/index.html
> > (note some *relative* links are broken and the 1.3.0 directories
> > are not yet created - these will be OK once the site is deployed.)
> >
> > JApiCmp Report (compared to 1.2):
> >
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/japicmp.html
> > Note that this report contains false-positives regarding generics:
> > Generics are erased at compile-time, so can't be binary incompatible.
> >
> > RAT Report:
> >
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/rat-report.html
> >
> > KEYS:
> > https://downloads.apache.org/commons/KEYS
> >
> > Please review the release candidate and vote.
> > This vote will close no sooner than 72 hours from now.
> >
> > [ ] +1 Release these artifacts
> > [ ] +0 OK, but...
> > [ ] -0 OK, but really should fix...
> > [ ] -1 I oppose this release because...
> >
> > Thank you,
> >
> > Gary Gregory,
> > Release Manager (using key 86fdc7e2a11262cb)
> >
> > For following is intended as a helper and refresher for reviewers.
> >
> > Validating a release candidate
> > ==============================
> >
> > These guidelines are NOT complete.
> >
> > Requirements: Git, Java, Maven.
> >
> > You can validate a release from a release candidate (RC) tag as follows.
> >
> > 1a) Clone and checkout the RC tag
> >
> > git clone https://gitbox.apache.org/repos/asf/commons-logging.git
> > --branch commons-logging-1.3.0-RC1 commons-logging-1.3.0-RC1
> > cd commons-logging-1.3.0-RC1
> >
> > 1b) Download and unpack the source archive from:
> >
> > https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/source
> >
> > 2) Check Apache licenses
> >
> > This step is not required if the site includes a RAT report page which
> > you then must check.
> >
> > mvn apache-rat:check
> >
> > 3) Check binary compatibility
> >
> > Older components still use Apache Clirr:
> >
> > This step is not required if the site includes a Clirr report page
> > which you then must check.
> >
> > mvn clirr:check
> >
> > Newer components use JApiCmp with the japicmp Maven Profile:
> >
> > This step is not required if the site includes a JApiCmp report page
> > which you then must check.
> >
> > mvn install -DskipTests -P japicmp japicmp:cmp
> >
> > 4) Build the package
> >
> > mvn -V clean package
> >
> > You can record the Maven and Java version produced by -V in your VOTE
> reply.
> > To gather OS information from a command line:
> > Windows: ver
> > Linux: uname -a
> >
> > 5) Build the site for a single module project
> >
> > Note: Some plugins require the components to be installed instead of
> packaged.
> >
> > mvn site
> > Check the site reports in:
> > - Windows: target\site\index.html
> > - Linux: target/site/index.html
> >
> > -the end-
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> > For additional commands, e-mail: dev-help@commons.apache.org
> >
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>
Re: [VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by "Bruno P. Kinoshita" <ki...@apache.org>.
+1
Tested on
Apache Maven 3.8.5 (3599d3414f046de2324203b78ddcf9b5e4388aa0)
Maven home: /opt/apache-maven-3.8.5
Java version: 17.0.9, vendor: Private Build, runtime: /usr/lib/jvm/java-17-openjdk-amd64
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "5.15.0-89-generic", arch: "amd64", family: "unix"
Thank you!
Bruno
On 2023/11/26 21:46:42 Gary Gregory wrote:
> We have fixed a few bugs and added some enhancements since Apache
> Commons Logging 1.2 was released, so I would like to release Apache
> Commons Logging 1.3.0.
>
> Apache Commons Logging 1.3.0 RC1 is available for review here:
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1
> (svn revision 65553)
>
> The Git tag commons-logging-1.3.0-RC1 commit for this RC is
> e0255a5845814802586b91c889ab3e9fc4bf9d68 which you can browse here:
> https://gitbox.apache.org/repos/asf?p=commons-logging.git;a=commit;h=e0255a5845814802586b91c889ab3e9fc4bf9d68
> You may checkout this tag using:
> git clone https://gitbox.apache.org/repos/asf/commons-logging.git
> --branch commons-logging-1.3.0-RC1 commons-logging-1.3.0-RC1
>
> Maven artifacts are here:
> https://repository.apache.org/content/repositories/orgapachecommons-1676/commons-logging/commons-logging/1.3.0/
>
> These are the artifacts and their hashes:
>
> #Release SHA-512s
> #Sun Nov 26 16:38:45 EST 2023
> commons-logging-1.3.0-adapters.jar=0b67e5fbca807b3d00ab5569cfac9fd14e268302ef514dee52eb1272762b35211d602045aefa71731108b900f6e0b7c78c3df39a989f3b86736e95a471b342c6
> commons-logging-1.3.0-api.jar=d801af15997767abfbf0168651b19a55b8958e3b8c0106e054bdfd0098fdcb198c8dad0c123bd91448d0cb7b81851d4606319e43fed102c976b47143e481f371
> commons-logging-1.3.0-bin.tar.gz=1fb9e4537fc59b75baf83b72a8e484604e6124ff7969b6f82955b29beeb5b86d9d115a494a6687e9a89a0b274f1ae9c226f289a7531334cc0451a3d4d5c2e3dc
> commons-logging-1.3.0-bin.zip=43291b189957da5882eaf753792a041cd25f599b7fb6d960a16799ae450ae3cde59197fe4a664d59243a44c0cdd067eb9979ef2a225b762b0f56264a871c325c
> commons-logging-1.3.0-bom.json=07580d9d52d4f93bf2a79e41388549a4f6f814cfcc5d6e05832036e480d0364e0bce212b79cc4e921d55587a00e0d1d1a1bcf8b3195fe9765e94f38294b60170
> commons-logging-1.3.0-bom.xml=48a60112f79f6809a515a525837094b16e0ebff7daeeb561f20b639f18d47b3585f8e21595c469229caca9a0f2287649dbd8ce70105baa7d36bd621b68f42af7
> commons-logging-1.3.0-javadoc.jar=73abbcf238b831d33fdb5c62406b6066183e3dce603535203b6fb0abc34c6aad9605eec2a5ca11981a2544b81447f8580f27a26f66e564f308c35152391c2cd7
> commons-logging-1.3.0-sources.jar=ca39a42b2380c2c85800368546d8903b72e13f62bec665dd52db16f21dc214ecf81ff8a51f4739b5393b1d31326668e4ad5d0402eb4570728ad2a4321aeb6aa1
> commons-logging-1.3.0-src.tar.gz=20cc40c7d7848da618801a86333f3984151d3089f806e5d7a1e92c83c1f90d330f1c7ded5d0ae70e48dd9de684f2e5da32de24fa2c406f6b419f77704c0e74f8
> commons-logging-1.3.0-src.zip=516db2b8854846cf4c2bf5f4f3f4b7fc132183a7003eed0cff291f53f7f0a35d0dc4cc7eb362cd99ad5bf619620f16f7079e3015a7e01bda9e8802eca04a3fa3
> commons-logging-1.3.0-test-sources.jar=159ec27c4343f926fe1cdc8977138b5200ef6f1284a3dddd361ae3cd19520d3e7b117e418272a4534b768859f1229e8ff7cd3555bed4f292c27e583a92fe9f2f
> commons-logging-1.3.0-tests.jar=fb1d052e16ec83f9c6002a44ef79b84c08ad04b9ac3d378060e6adcf6d98860f4411c114837cca872427b1e5c663060a77f7157aabadf81fac1979ea34b44055
> commons-logging_commons-logging-1.3.0.spdx.json=a416b9ae6d632f0638eb1c90184ecbe85bb91ce641b5ccea6ed64a144a6af80b20decaeb5d369aabb5e1cedd266d966fec5bc7517465414ab68036c526f9cb21
>
> I have tested this with
>
> mvn -V -Prelease -Ptest-deploy -P jacoco -P japicmp clean package site deploy
>
> using:
>
> Apache Maven 3.9.5 (57804ffe001d7215b5e7bcb531cf83df38f93546)
> Maven home: /usr/local/Cellar/maven/3.9.5/libexec
> Java version: 21.0.1, vendor: Homebrew, runtime:
> /usr/local/Cellar/openjdk/21.0.1/libexec/openjdk.jdk/Contents/Home
> Default locale: en_US, platform encoding: UTF-8
> OS name: "mac os x", version: "14.1.1", arch: "x86_64", family: "mac"
>
> Darwin **** 23.1.0 Darwin Kernel Version 23.1.0: Mon Oct 9 21:27:27
> PDT 2023; root:xnu-10002.41.9~6/RELEASE_X86_64 x86_64
>
> Details of changes since 1.2 are in the release notes:
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/RELEASE-NOTES.txt
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/changes-report.html
>
> Site:
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/index.html
> (note some *relative* links are broken and the 1.3.0 directories
> are not yet created - these will be OK once the site is deployed.)
>
> JApiCmp Report (compared to 1.2):
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/japicmp.html
> Note that this report contains false-positives regarding generics:
> Generics are erased at compile-time, so can't be binary incompatible.
>
> RAT Report:
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/rat-report.html
>
> KEYS:
> https://downloads.apache.org/commons/KEYS
>
> Please review the release candidate and vote.
> This vote will close no sooner than 72 hours from now.
>
> [ ] +1 Release these artifacts
> [ ] +0 OK, but...
> [ ] -0 OK, but really should fix...
> [ ] -1 I oppose this release because...
>
> Thank you,
>
> Gary Gregory,
> Release Manager (using key 86fdc7e2a11262cb)
>
> For following is intended as a helper and refresher for reviewers.
>
> Validating a release candidate
> ==============================
>
> These guidelines are NOT complete.
>
> Requirements: Git, Java, Maven.
>
> You can validate a release from a release candidate (RC) tag as follows.
>
> 1a) Clone and checkout the RC tag
>
> git clone https://gitbox.apache.org/repos/asf/commons-logging.git
> --branch commons-logging-1.3.0-RC1 commons-logging-1.3.0-RC1
> cd commons-logging-1.3.0-RC1
>
> 1b) Download and unpack the source archive from:
>
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/source
>
> 2) Check Apache licenses
>
> This step is not required if the site includes a RAT report page which
> you then must check.
>
> mvn apache-rat:check
>
> 3) Check binary compatibility
>
> Older components still use Apache Clirr:
>
> This step is not required if the site includes a Clirr report page
> which you then must check.
>
> mvn clirr:check
>
> Newer components use JApiCmp with the japicmp Maven Profile:
>
> This step is not required if the site includes a JApiCmp report page
> which you then must check.
>
> mvn install -DskipTests -P japicmp japicmp:cmp
>
> 4) Build the package
>
> mvn -V clean package
>
> You can record the Maven and Java version produced by -V in your VOTE reply.
> To gather OS information from a command line:
> Windows: ver
> Linux: uname -a
>
> 5) Build the site for a single module project
>
> Note: Some plugins require the components to be installed instead of packaged.
>
> mvn site
> Check the site reports in:
> - Windows: target\site\index.html
> - Linux: target/site/index.html
>
> -the end-
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by Rob Tompkins <ch...@apache.org>.
+1 signatures; reports; site; release-notes; builds java: 8, 11, 17, and 21 all good.
Thanks Gary!!!!!!
Happy thanksgiving
Cheers,
-Rob
> On Nov 26, 2023, at 4:46 PM, Gary Gregory <ga...@gmail.com> wrote:
>
> We have fixed a few bugs and added some enhancements since Apache
> Commons Logging 1.2 was released, so I would like to release Apache
> Commons Logging 1.3.0.
>
> Apache Commons Logging 1.3.0 RC1 is available for review here:
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1
> (svn revision 65553)
>
> The Git tag commons-logging-1.3.0-RC1 commit for this RC is
> e0255a5845814802586b91c889ab3e9fc4bf9d68 which you can browse here:
> https://gitbox.apache.org/repos/asf?p=commons-logging.git;a=commit;h=e0255a5845814802586b91c889ab3e9fc4bf9d68
> You may checkout this tag using:
> git clone https://gitbox.apache.org/repos/asf/commons-logging.git
> --branch commons-logging-1.3.0-RC1 commons-logging-1.3.0-RC1
>
> Maven artifacts are here:
> https://repository.apache.org/content/repositories/orgapachecommons-1676/commons-logging/commons-logging/1.3.0/
>
> These are the artifacts and their hashes:
>
> #Release SHA-512s
> #Sun Nov 26 16:38:45 EST 2023
> commons-logging-1.3.0-adapters.jar=0b67e5fbca807b3d00ab5569cfac9fd14e268302ef514dee52eb1272762b35211d602045aefa71731108b900f6e0b7c78c3df39a989f3b86736e95a471b342c6
> commons-logging-1.3.0-api.jar=d801af15997767abfbf0168651b19a55b8958e3b8c0106e054bdfd0098fdcb198c8dad0c123bd91448d0cb7b81851d4606319e43fed102c976b47143e481f371
> commons-logging-1.3.0-bin.tar.gz=1fb9e4537fc59b75baf83b72a8e484604e6124ff7969b6f82955b29beeb5b86d9d115a494a6687e9a89a0b274f1ae9c226f289a7531334cc0451a3d4d5c2e3dc
> commons-logging-1.3.0-bin.zip=43291b189957da5882eaf753792a041cd25f599b7fb6d960a16799ae450ae3cde59197fe4a664d59243a44c0cdd067eb9979ef2a225b762b0f56264a871c325c
> commons-logging-1.3.0-bom.json=07580d9d52d4f93bf2a79e41388549a4f6f814cfcc5d6e05832036e480d0364e0bce212b79cc4e921d55587a00e0d1d1a1bcf8b3195fe9765e94f38294b60170
> commons-logging-1.3.0-bom.xml=48a60112f79f6809a515a525837094b16e0ebff7daeeb561f20b639f18d47b3585f8e21595c469229caca9a0f2287649dbd8ce70105baa7d36bd621b68f42af7
> commons-logging-1.3.0-javadoc.jar=73abbcf238b831d33fdb5c62406b6066183e3dce603535203b6fb0abc34c6aad9605eec2a5ca11981a2544b81447f8580f27a26f66e564f308c35152391c2cd7
> commons-logging-1.3.0-sources.jar=ca39a42b2380c2c85800368546d8903b72e13f62bec665dd52db16f21dc214ecf81ff8a51f4739b5393b1d31326668e4ad5d0402eb4570728ad2a4321aeb6aa1
> commons-logging-1.3.0-src.tar.gz=20cc40c7d7848da618801a86333f3984151d3089f806e5d7a1e92c83c1f90d330f1c7ded5d0ae70e48dd9de684f2e5da32de24fa2c406f6b419f77704c0e74f8
> commons-logging-1.3.0-src.zip=516db2b8854846cf4c2bf5f4f3f4b7fc132183a7003eed0cff291f53f7f0a35d0dc4cc7eb362cd99ad5bf619620f16f7079e3015a7e01bda9e8802eca04a3fa3
> commons-logging-1.3.0-test-sources.jar=159ec27c4343f926fe1cdc8977138b5200ef6f1284a3dddd361ae3cd19520d3e7b117e418272a4534b768859f1229e8ff7cd3555bed4f292c27e583a92fe9f2f
> commons-logging-1.3.0-tests.jar=fb1d052e16ec83f9c6002a44ef79b84c08ad04b9ac3d378060e6adcf6d98860f4411c114837cca872427b1e5c663060a77f7157aabadf81fac1979ea34b44055
> commons-logging_commons-logging-1.3.0.spdx.json=a416b9ae6d632f0638eb1c90184ecbe85bb91ce641b5ccea6ed64a144a6af80b20decaeb5d369aabb5e1cedd266d966fec5bc7517465414ab68036c526f9cb21
>
> I have tested this with
>
> mvn -V -Prelease -Ptest-deploy -P jacoco -P japicmp clean package site deploy
>
> using:
>
> Apache Maven 3.9.5 (57804ffe001d7215b5e7bcb531cf83df38f93546)
> Maven home: /usr/local/Cellar/maven/3.9.5/libexec
> Java version: 21.0.1, vendor: Homebrew, runtime:
> /usr/local/Cellar/openjdk/21.0.1/libexec/openjdk.jdk/Contents/Home
> Default locale: en_US, platform encoding: UTF-8
> OS name: "mac os x", version: "14.1.1", arch: "x86_64", family: "mac"
>
> Darwin **** 23.1.0 Darwin Kernel Version 23.1.0: Mon Oct 9 21:27:27
> PDT 2023; root:xnu-10002.41.9~6/RELEASE_X86_64 x86_64
>
> Details of changes since 1.2 are in the release notes:
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/RELEASE-NOTES.txt
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/changes-report.html
>
> Site:
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/index.html
> (note some *relative* links are broken and the 1.3.0 directories
> are not yet created - these will be OK once the site is deployed.)
>
> JApiCmp Report (compared to 1.2):
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/japicmp.html
> Note that this report contains false-positives regarding generics:
> Generics are erased at compile-time, so can't be binary incompatible.
>
> RAT Report:
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/site/rat-report.html
>
> KEYS:
> https://downloads.apache.org/commons/KEYS
>
> Please review the release candidate and vote.
> This vote will close no sooner than 72 hours from now.
>
> [ ] +1 Release these artifacts
> [ ] +0 OK, but...
> [ ] -0 OK, but really should fix...
> [ ] -1 I oppose this release because...
>
> Thank you,
>
> Gary Gregory,
> Release Manager (using key 86fdc7e2a11262cb)
>
> For following is intended as a helper and refresher for reviewers.
>
> Validating a release candidate
> ==============================
>
> These guidelines are NOT complete.
>
> Requirements: Git, Java, Maven.
>
> You can validate a release from a release candidate (RC) tag as follows.
>
> 1a) Clone and checkout the RC tag
>
> git clone https://gitbox.apache.org/repos/asf/commons-logging.git
> --branch commons-logging-1.3.0-RC1 commons-logging-1.3.0-RC1
> cd commons-logging-1.3.0-RC1
>
> 1b) Download and unpack the source archive from:
>
> https://dist.apache.org/repos/dist/dev/commons/logging/1.3.0-RC1/source
>
> 2) Check Apache licenses
>
> This step is not required if the site includes a RAT report page which
> you then must check.
>
> mvn apache-rat:check
>
> 3) Check binary compatibility
>
> Older components still use Apache Clirr:
>
> This step is not required if the site includes a Clirr report page
> which you then must check.
>
> mvn clirr:check
>
> Newer components use JApiCmp with the japicmp Maven Profile:
>
> This step is not required if the site includes a JApiCmp report page
> which you then must check.
>
> mvn install -DskipTests -P japicmp japicmp:cmp
>
> 4) Build the package
>
> mvn -V clean package
>
> You can record the Maven and Java version produced by -V in your VOTE reply.
> To gather OS information from a command line:
> Windows: ver
> Linux: uname -a
>
> 5) Build the site for a single module project
>
> Note: Some plugins require the components to be installed instead of packaged.
>
> mvn site
> Check the site reports in:
> - Windows: target\site\index.html
> - Linux: target/site/index.html
>
> -the end-
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: Reproducibility of Commons artifacts was: [VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by "Piotr P. Karwasz" <pi...@gmail.com>.
Hi Hervé,
On Fri, 5 Jan 2024 at 08:14, Herve Boutemy <hb...@apache.org> wrote:
> Piotr found the issue about the second run of bundle plugin and about moditect 1.1.0 sensitivity to TZ: I don't know how hard it was to learn this, nor how.
> Do you have any idea on how to ease such discovery?
The first time we encountered a difference in a zipfile metadata, it
was hard. We knew from the binary diff from diffoscope that the
difference is in the metadata, but it took us some time to notice that
the file listings differed by an executable flag.
For the Moditect problem I already knew where to look and I noticed
that the timestamps from Gary's official artifacts and mine differed
by 6 hours. Since the UNIX `unzip` utility does not support the
"Extended Timestamp" I used Commons Compress to list all the
extensions in the ZIP entries.
In general I think that diffoscope could be improved by:
* listing all the extensions of ZIP entries explicitly and in order,
* adding some basic properties for each file, e.g. "Java class file,
bytecode 52" or "Text file, CRLF line endings".
Piotr
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: Reproducibility of Commons artifacts was: [VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by Herve Boutemy <hb...@apache.org>.
Hi team,
I'm happy to have people like you trying to rebuild and compare: your feedback on your experience is very valuable.
Here are a few remarks on this thread:
- if you want to rebuild and *compare against a remote repository* (be it a SNAPSHOT or a release), you absolutely need to *avoid "mvn install" first*, because this install step completely dismisses the remote repository
a corollary is that you need to check your local repo (~/.m2/repository) and eventually clean it
and sadly it's not easy for artifact:compare to detect if the reference file comes from local mvn install or form a download from remote... I need to think more about this: created https://issues.apache.org/jira/browse/MARTIFACT-58
- on the diffoscope output not being easy to analyze to know how to fix issues:
can you confirm me that the "artifact:compare" output is ok to read and discover how to run diffoscope?
can you confirm that diffoscope output is ok to read, to see the diff (even if you don't know yet how to fix the build to avoid that difference)?
on going from diff reading step to instructions on how to fix: given the very diverse nature of issues that can lead to the difference, I don't see how to make analysis easier than pure reader's experience
Piotr found the issue about the second run of bundle plugin and about moditect 1.1.0 sensitivity to TZ: I don't know how hard it was to learn this, nor how.
Do you have any idea on how to ease such discovery?
Any other feedback appreciated
Regards,
Hervé
On 2023/12/29 18:33:29 Gary Gregory wrote:
> TY Piotr!
>
> Putting your pieces together for a local Commons Compress, this works for me:
>
> export TZ=UTC
> mvn clean install
> mvn clean package artifact:compare \
> -Dreference.repo=apache.snapshots \
> -DskipTests \
> -Dcommons.spdx.version=0.7.1 -Dspdx.skip
>
> Gary
>
> On Fri, Dec 29, 2023 at 12:44 PM Piotr P. Karwasz
> <pi...@gmail.com> wrote:
> >
> > Hi Gary,
> >
> > On Fri, 29 Dec 2023 at 15:11, Gary Gregory <ga...@gmail.com> wrote:
> > > I run, copied from the
> > > https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/commons/compress/commons-compress-1.25.0.buildspec:
> > >
> > > mvn -Prelease clean package package -DskipTests -Dmaven.javadoc.skip
> > > -Dgpg.skip -Dcyclonedx.skip -Dcommons.release.dryRun
> > > -Dcommons.release.isDistModule=false
> > >
> > > Then:
> > >
> > > mvn package package artifact:compare
> >
> > Maven has a short guide to check reproducibility:
> > https://maven.apache.org/guides/mini/guide-reproducible-builds.html
> >
> > If you want to check a local artifact vs a previous local artifact you
> > need to use:
> >
> > mvn clean install
> > mvn clean package artifact:compare -DskipTests
> >
> > The first run install the artifact into the local Maven repo, the
> > second one generates new ones and compares them with those installed.
> >
> > To check local vs remote you just need the second part. I am able to
> > reproduce the current Commons Compress snapshot with:
> >
> > export TZ=UTC
> > export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
> > mvn clean package artifact:compare \
> > -Dreference.repo=apache.snapshots \
> > -DskipTests \
> > -Dcommons.spdx.version=0.7.1 -Dspdx.skip
> >
> > I have no idea how those snapshots are generated, but they match my
> > local ones. The last line bumps the SPDX Maven Plugin to a version
> > that supports `-Dspdx.skip` ;-)
> >
> > Piotr
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> > For additional commands, e-mail: dev-help@commons.apache.org
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: Reproducibility of Commons artifacts was: [VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by Gary Gregory <ga...@gmail.com>.
TY Piotr!
Putting your pieces together for a local Commons Compress, this works for me:
export TZ=UTC
mvn clean install
mvn clean package artifact:compare \
-Dreference.repo=apache.snapshots \
-DskipTests \
-Dcommons.spdx.version=0.7.1 -Dspdx.skip
Gary
On Fri, Dec 29, 2023 at 12:44 PM Piotr P. Karwasz
<pi...@gmail.com> wrote:
>
> Hi Gary,
>
> On Fri, 29 Dec 2023 at 15:11, Gary Gregory <ga...@gmail.com> wrote:
> > I run, copied from the
> > https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/commons/compress/commons-compress-1.25.0.buildspec:
> >
> > mvn -Prelease clean package package -DskipTests -Dmaven.javadoc.skip
> > -Dgpg.skip -Dcyclonedx.skip -Dcommons.release.dryRun
> > -Dcommons.release.isDistModule=false
> >
> > Then:
> >
> > mvn package package artifact:compare
>
> Maven has a short guide to check reproducibility:
> https://maven.apache.org/guides/mini/guide-reproducible-builds.html
>
> If you want to check a local artifact vs a previous local artifact you
> need to use:
>
> mvn clean install
> mvn clean package artifact:compare -DskipTests
>
> The first run install the artifact into the local Maven repo, the
> second one generates new ones and compares them with those installed.
>
> To check local vs remote you just need the second part. I am able to
> reproduce the current Commons Compress snapshot with:
>
> export TZ=UTC
> export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
> mvn clean package artifact:compare \
> -Dreference.repo=apache.snapshots \
> -DskipTests \
> -Dcommons.spdx.version=0.7.1 -Dspdx.skip
>
> I have no idea how those snapshots are generated, but they match my
> local ones. The last line bumps the SPDX Maven Plugin to a version
> that supports `-Dspdx.skip` ;-)
>
> Piotr
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: Reproducibility of Commons artifacts was: [VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by "Piotr P. Karwasz" <pi...@gmail.com>.
Hi Gary,
On Fri, 29 Dec 2023 at 15:11, Gary Gregory <ga...@gmail.com> wrote:
> I run, copied from the
> https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/commons/compress/commons-compress-1.25.0.buildspec:
>
> mvn -Prelease clean package package -DskipTests -Dmaven.javadoc.skip
> -Dgpg.skip -Dcyclonedx.skip -Dcommons.release.dryRun
> -Dcommons.release.isDistModule=false
>
> Then:
>
> mvn package package artifact:compare
Maven has a short guide to check reproducibility:
https://maven.apache.org/guides/mini/guide-reproducible-builds.html
If you want to check a local artifact vs a previous local artifact you
need to use:
mvn clean install
mvn clean package artifact:compare -DskipTests
The first run install the artifact into the local Maven repo, the
second one generates new ones and compares them with those installed.
To check local vs remote you just need the second part. I am able to
reproduce the current Commons Compress snapshot with:
export TZ=UTC
export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
mvn clean package artifact:compare \
-Dreference.repo=apache.snapshots \
-DskipTests \
-Dcommons.spdx.version=0.7.1 -Dspdx.skip
I have no idea how those snapshots are generated, but they match my
local ones. The last line bumps the SPDX Maven Plugin to a version
that supports `-Dspdx.skip` ;-)
Piotr
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: Reproducibility of Commons artifacts was: [VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by Gary Gregory <ga...@gmail.com>.
I run, copied from the
https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/commons/compress/commons-compress-1.25.0.buildspec:
mvn -Prelease clean package package -DskipTests -Dmaven.javadoc.skip
-Dgpg.skip -Dcyclonedx.skip -Dcommons.release.dryRun
-Dcommons.release.isDistModule=false
Then:
mvn package package artifact:compare
Which gives me:
[INFO] --- artifact:3.5.0:compare (default-cli) @ commons-compress ---
[WARNING] SCM source tag in buildinfo source.scm.tag=HEAD does not
permit rebuilders reproducible source checkout
[INFO] Saved info on build to
/Users/garydgregory/git/commons-compress/target/commons-compress-1.25.1-SNAPSHOT.buildinfo
[INFO] Checking against reference build from central...
[INFO] Reference buildinfo file not found: it will be generated from
downloaded reference artifacts
[INFO] Reference build java.version: 17 (from MANIFEST.MF Build-Jdk-Spec)
[INFO] Reference build os.name: Unix (from pom.properties newline)
[INFO] Minimal buildinfo generated from downloaded artifacts:
/Users/garydgregory/git/commons-compress/target/reference/commons-compress-1.25.1-SNAPSHOT.buildinfo
[ERROR] size mismatch commons-compress-1.25.1-SNAPSHOT.jar:
investigate with diffoscope
target/reference/org.apache.commons/commons-compress-1.25.1-SNAPSHOT.jar
target/commons-compress-1.25.1-SNAPSHOT.jar
[ERROR] size mismatch commons-compress-1.25.1-SNAPSHOT-tests.jar:
investigate with diffoscope
target/reference/org.apache.commons/commons-compress-1.25.1-SNAPSHOT-tests.jar
target/commons-compress-1.25.1-SNAPSHOT-tests.jar
[ERROR] sha512 mismatch commons-compress-1.25.1-SNAPSHOT.spdx.json:
investigate with diffoscope
target/reference/org.apache.commons/commons-compress-1.25.1-SNAPSHOT.spdx.json
target/site/org.apache.commons_commons-compress-1.25.1-SNAPSHOT.spdx.json
[ERROR] Reproducible Build output summary: 5 files ok, 3 different
[ERROR] see diff
target/reference/commons-compress-1.25.1-SNAPSHOT.buildinfo
target/commons-compress-1.25.1-SNAPSHOT.buildinfo
[ERROR] see also
https://maven.apache.org/guides/mini/guide-reproducible-builds.html
[INFO] Reproducible Build output comparison saved to
/Users/garydgregory/git/commons-compress/target/commons-compress-1.25.1-SNAPSHOT.buildcompare
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
?
TY,
Gary
On Fri, Dec 29, 2023 at 8:50 AM Piotr P. Karwasz
<pi...@gmail.com> wrote:
>
> Hi Gary,
>
> On Fri, 29 Dec 2023 at 13:37, Gary Gregory <ga...@gmail.com> wrote:
> > I do appreciate the fact that I can ask "Am I reproducible" but the
> > output is... cryptic.
>
> Yes, unfortunately if the check fails, finding the reason of the
> failure is hard.
>
> > For example:
> > ...
> > ├── META-INF/MANIFEST.MF
> > │ @@ -65,11 +65,12 @@
> > │ b.asm;resolution:=optional,javax.crypto;resolution:=optional,javax.cryp
> > │ to.spec;resolution:=optional,org.apache.commons.codec.digest,org.apache
> > │ .commons.io,org.apache.commons.io.file.attribute,org.apache.commons.io.
> > │ input,org.apache.commons.io.output,org.apache.commons.commons-codec;res
> > │ olution:=optional,org.apache.commons.commons-io;resolution:=optional
> > │ Include-Resource: META-INF/LICENSE.txt=LICENSE.txt,META-INF/NOTICE.txt=N
> > │ OTICE.txt
> > │ +Originally-Created-By: Apache Maven Bundle Plugin 5.1.9
> > │ Require-Capability: osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"
> > │ Tool: Bnd-6.4.1.202306080939
> > │ Multi-Release: true
>
> You have a difference in the MANIFEST.MF that consists of an
> additional "Originally-Created-By" header.
>
> Hervé already solved this mystery and you can find the Maven command
> line required here:
>
> https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/commons/compress/commons-compress-1.25.0.buildspec
>
> The reproducibility problem is caused by multiple executions of the
> Apache Maven Bundle Plugin. If you start with an empty `target`
> directory:
>
> * the first execution creates a MANIFEST.MF file, notably a
> "Created-By" header,
> * the second execution reads the MANIFEST.MF file, changes it and
> renames the "Created-By" header from the first execution into
> "Originally-Created-By".
>
> TL;DR: Running `mvn package package artifact:compare` solves the problem.
>
> Piotr
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: Reproducibility of Commons artifacts was: [VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by "Piotr P. Karwasz" <pi...@gmail.com>.
Hi Gary,
On Fri, 29 Dec 2023 at 13:37, Gary Gregory <ga...@gmail.com> wrote:
> I do appreciate the fact that I can ask "Am I reproducible" but the
> output is... cryptic.
Yes, unfortunately if the check fails, finding the reason of the
failure is hard.
> For example:
> ...
> ├── META-INF/MANIFEST.MF
> │ @@ -65,11 +65,12 @@
> │ b.asm;resolution:=optional,javax.crypto;resolution:=optional,javax.cryp
> │ to.spec;resolution:=optional,org.apache.commons.codec.digest,org.apache
> │ .commons.io,org.apache.commons.io.file.attribute,org.apache.commons.io.
> │ input,org.apache.commons.io.output,org.apache.commons.commons-codec;res
> │ olution:=optional,org.apache.commons.commons-io;resolution:=optional
> │ Include-Resource: META-INF/LICENSE.txt=LICENSE.txt,META-INF/NOTICE.txt=N
> │ OTICE.txt
> │ +Originally-Created-By: Apache Maven Bundle Plugin 5.1.9
> │ Require-Capability: osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"
> │ Tool: Bnd-6.4.1.202306080939
> │ Multi-Release: true
You have a difference in the MANIFEST.MF that consists of an
additional "Originally-Created-By" header.
Hervé already solved this mystery and you can find the Maven command
line required here:
https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/org/apache/commons/compress/commons-compress-1.25.0.buildspec
The reproducibility problem is caused by multiple executions of the
Apache Maven Bundle Plugin. If you start with an empty `target`
directory:
* the first execution creates a MANIFEST.MF file, notably a
"Created-By" header,
* the second execution reads the MANIFEST.MF file, changes it and
renames the "Created-By" header from the first execution into
"Originally-Created-By".
TL;DR: Running `mvn package package artifact:compare` solves the problem.
Piotr
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: Reproducibility of Commons artifacts was: [VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by Gary Gregory <ga...@gmail.com>.
Hi Piotr and all,
Thank you for the refresher :-)
I do appreciate the fact that I can ask "Am I reproducible" but the
output is... cryptic.
For example:
git clone https://gitbox.apache.org/repos/asf/commons-compress.git
cd commons-compress
mvn clean install -DskipTests
mvn package artifact:compare \
-DskipTests \
-Dcyclonedx.skip \
-Dcommons.spdx.version=0.7.1 -Dspdx.skip
Tells me:
[INFO] --- artifact:3.5.0:compare (default-cli) @ commons-compress ---
[WARNING] SCM source tag in buildinfo source.scm.tag=HEAD does not
permit rebuilders reproducible source checkout
[INFO] Saved info on build to
/Users/garydgregory/git/commons-compress/target/commons-compress-1.25.1-SNAPSHOT.buildinfo
[INFO] Checking against reference build from central...
[INFO] Reference buildinfo file not found: it will be generated from
downloaded reference artifacts
[INFO] Reference build java.version: 17 (from MANIFEST.MF Build-Jdk-Spec)
[INFO] Reference build os.name: Unix (from pom.properties newline)
[INFO] Minimal buildinfo generated from downloaded artifacts:
/Users/garydgregory/git/commons-compress/target/reference/commons-compress-1.25.1-SNAPSHOT.buildinfo
[ERROR] size mismatch commons-compress-1.25.1-SNAPSHOT.jar:
investigate with diffoscope
target/reference/org.apache.commons/commons-compress-1.25.1-SNAPSHOT.jar
target/commons-compress-1.25.1-SNAPSHOT.jar
[ERROR] Reproducible Build output summary: 4 files ok, 1 different
[ERROR] see diff
target/reference/commons-compress-1.25.1-SNAPSHOT.buildinfo
target/commons-compress-1.25.1-SNAPSHOT.buildinfo
[ERROR] see also
https://maven.apache.org/guides/mini/guide-reproducible-builds.html
[INFO] Reproducible Build output comparison saved to
/Users/garydgregory/git/commons-compress/target/commons-compress-1.25.1-SNAPSHOT.buildcompare
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
and then:
diffoscope target/reference/org.apache.commons/commons-compress-1.25.1-SNAPSHOT.jar
target/commons-compress-1.25.1-SNAPSHOT.jar
--- target/reference/org.apache.commons/commons-compress-1.25.1-SNAPSHOT.jar
+++ target/commons-compress-1.25.1-SNAPSHOT.jar
├── zipinfo {}
│ @@ -1,9 +1,9 @@
│ -Zip file size: 1058930 bytes, number of entries: 620
│ -?rw-r--r-- 2.0 unx 4615 bX defN 24-Jan-01 00:00 META-INF/MANIFEST.MF
│ +Zip file size: 1058940 bytes, number of entries: 620
│ +?rw-r--r-- 2.0 unx 4672 bX defN 24-Jan-01 00:00 META-INF/MANIFEST.MF
│ ?rwxr-xr-x 1.0 unx 0 bx stor 24-Jan-01 00:00 META-INF/
│ ?rwxr-xr-x 1.0 unx 0 bx stor 24-Jan-01 00:00 org/
│ ?rwxr-xr-x 1.0 unx 0 bx stor 24-Jan-01 00:00 org/apache/
│ ?rwxr-xr-x 1.0 unx 0 bx stor 24-Jan-01 00:00 org/apache/commons/
│ ?rwxr-xr-x 1.0 unx 0 bx stor 24-Jan-01 00:00
org/apache/commons/compress/
│ ?rwxr-xr-x 1.0 unx 0 bx stor 24-Jan-01 00:00
org/apache/commons/compress/archivers/
│ ?rwxr-xr-x 1.0 unx 0 bx stor 24-Jan-01 00:00
org/apache/commons/compress/archivers/ar/
│ @@ -615,8 +615,8 @@
│ ?rw-r--r-- 2.0 unx 3009 bx defN 24-Jan-01 00:00
org/apache/commons/compress/utils/TimeUtils.class
│ ?rw-r--r-- 2.0 unx 139 bx defN 24-Jan-01 00:00
org/apache/commons/compress/utils/package-info.class
│ ?rw-r--r-- 2.0 unx 21657 bx defN 24-Jan-01 00:00
META-INF/maven/org.apache.commons/commons-compress/pom.xml
│ ?rw-r--r-- 2.0 unx 79 bx defN 24-Jan-01 00:00
META-INF/maven/org.apache.commons/commons-compress/pom.properties
│ -rw---- 1.0 fat 0 bx stor 24-Jan-01 00:00 META-INF/versions/
│ -rw---- 1.0 fat 0 bx stor 24-Jan-01 00:00 META-INF/versions/9/
│ -rw---- 2.0 fat 2495 bX defN 24-Jan-01 00:00
META-INF/versions/9/module-info.class
│ -620 files, 2115694 bytes uncompressed, 921522 bytes compressed: 56.5%
│ +620 files, 2115751 bytes uncompressed, 921532 bytes compressed: 56.5%
├── META-INF/MANIFEST.MF
│ @@ -65,11 +65,12 @@
│ b.asm;resolution:=optional,javax.crypto;resolution:=optional,javax.cryp
│ to.spec;resolution:=optional,org.apache.commons.codec.digest,org.apache
│ .commons.io,org.apache.commons.io.file.attribute,org.apache.commons.io.
│ input,org.apache.commons.io.output,org.apache.commons.commons-codec;res
│ olution:=optional,org.apache.commons.commons-io;resolution:=optional
│ Include-Resource: META-INF/LICENSE.txt=LICENSE.txt,META-INF/NOTICE.txt=N
│ OTICE.txt
│ +Originally-Created-By: Apache Maven Bundle Plugin 5.1.9
│ Require-Capability: osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.8))"
│ Tool: Bnd-6.4.1.202306080939
│ Multi-Release: true
Hm.. now what?
Gary
On Thu, Dec 28, 2023 at 11:10 AM Piotr P. Karwasz
<pi...@gmail.com> wrote:
>
> Hi Gary,
>
> On Thu, 28 Dec 2023 at 16:03, Gary Gregory <ga...@gmail.com> wrote:
> > What value for $NEXUS_REPO would one use to verify repro _after_ a
> > release? I want to experiment with Apache Commons components...
>
> The `reference.repo` system variable is used by the `referenceRepo`
> parameter of `artifact:compare`:
>
> https://maven.apache.org/plugins/maven-artifact-plugin/compare-mojo.html
>
> with a default value of `central`, so you can skip setting the parameter.
>
> I can reproduce most of the artifacts in your latest Commons
> Fileupload release with this incantation:
>
> export TZ=UTC
> export JAVA_HOME=...path to JDK 17...
> mvn package artifact:compare \
> -DskipTests \
> -Dcyclonedx.skip \
> -Dcommons.spdx.version=0.7.1 -Dspdx.skip
>
> The Maven Artifact Plugin only compares those artifacts, which are
> attached to the current build, so skipping CycloneDX and SPDX
> generation effectively prevents performing a reproducibility check on
> those artifacts.
> This is not ideal, but:
>
> * SPDX has a lot of reproducibility problems,
> * CycloneDX is usually reproducible, but I am probably affected by
> issue#410 [2],
> * we actually only care about the binary artifacts and POMs, the rest
> is a bonus.
>
> Piotr
>
> [1] https://github.com/jvm-repo-rebuild/reproducible-central
> [2] https://github.com/CycloneDX/cyclonedx-maven-plugin/issues/410
>
> PS: We are mixing threads from multiple lists. For those following
> dev@commons, NEXUS_REPO is a reference to this thread from
> dev@logging:
>
> https://lists.apache.org/thread/163ow0knp5q29hrsh1doqm3jwxkrzwoo
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: Reproducibility of Commons artifacts was: [VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by "Piotr P. Karwasz" <pi...@gmail.com>.
Hi Gary,
On Thu, 28 Dec 2023 at 16:03, Gary Gregory <ga...@gmail.com> wrote:
> What value for $NEXUS_REPO would one use to verify repro _after_ a
> release? I want to experiment with Apache Commons components...
The `reference.repo` system variable is used by the `referenceRepo`
parameter of `artifact:compare`:
https://maven.apache.org/plugins/maven-artifact-plugin/compare-mojo.html
with a default value of `central`, so you can skip setting the parameter.
I can reproduce most of the artifacts in your latest Commons
Fileupload release with this incantation:
export TZ=UTC
export JAVA_HOME=...path to JDK 17...
mvn package artifact:compare \
-DskipTests \
-Dcyclonedx.skip \
-Dcommons.spdx.version=0.7.1 -Dspdx.skip
The Maven Artifact Plugin only compares those artifacts, which are
attached to the current build, so skipping CycloneDX and SPDX
generation effectively prevents performing a reproducibility check on
those artifacts.
This is not ideal, but:
* SPDX has a lot of reproducibility problems,
* CycloneDX is usually reproducible, but I am probably affected by
issue#410 [2],
* we actually only care about the binary artifacts and POMs, the rest
is a bonus.
Piotr
[1] https://github.com/jvm-repo-rebuild/reproducible-central
[2] https://github.com/CycloneDX/cyclonedx-maven-plugin/issues/410
PS: We are mixing threads from multiple lists. For those following
dev@commons, NEXUS_REPO is a reference to this thread from
dev@logging:
https://lists.apache.org/thread/163ow0knp5q29hrsh1doqm3jwxkrzwoo
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: Reproducibility of Commons artifacts was: [VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by Gary Gregory <ga...@gmail.com>.
Hi Piotr,
What value for $NEXUS_REPO would one use to verify repro _after_ a
release? I want to experiment with Apache Commons components...
Gary
On Sat, Dec 16, 2023 at 6:56 PM Piotr P. Karwasz
<pi...@gmail.com> wrote:
>
> Hi all,
>
> On Mon, 27 Nov 2023 at 00:15, Piotr P. Karwasz <pi...@gmail.com> wrote:
> > 2. For some strange reason I had to set `TZ=America/New_York` to make
> > the main JAR reproducible. Either the Moditect or the Maven JAR plugin
> > are responsible for that.
>
> The recent Commons artifacts are hard to reproduce, since one of the
> environment variables required by reproducibility is the timezone of
> the system that generated the artifacts.
>
> The problem is due to the Moditect plugin issue#222.
>
> Until this problem is resolved, could you provide you timezone in the
> vote e-mails?
>
> Piotr
>
> [1] https://github.com/moditect/moditect/issues/222
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Reproducibility of Commons artifacts was: [VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by "Piotr P. Karwasz" <pi...@gmail.com>.
Hi all,
On Mon, 27 Nov 2023 at 00:15, Piotr P. Karwasz <pi...@gmail.com> wrote:
> 2. For some strange reason I had to set `TZ=America/New_York` to make
> the main JAR reproducible. Either the Moditect or the Maven JAR plugin
> are responsible for that.
The recent Commons artifacts are hard to reproduce, since one of the
environment variables required by reproducibility is the timezone of
the system that generated the artifacts.
The problem is due to the Moditect plugin issue#222.
Until this problem is resolved, could you provide you timezone in the
vote e-mails?
Piotr
[1] https://github.com/moditect/moditect/issues/222
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by Gilles Sadowski <gi...@gmail.com>.
Le lun. 27 nov. 2023 à 00:15, Piotr P. Karwasz
<pi...@gmail.com> a écrit :
> [...]
> +1 (non binding): everything works correctly with the following remarks:
>
> 1. the SPDX artifact is not reproducible,
> 2. For some strange reason I had to set `TZ=America/New_York` to make
> the main JAR reproducible. Either the Moditect or the Maven JAR plugin
> are responsible for that.
> 3. The SHA512 sums in the distribution can not be used with
> `sha512sum -c` (they lack the file name).
Maybe related to this old feature request:
https://issues.apache.org/jira/browse/COMMONSSITE-133
Gilles
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [VOTE] Release Apache Commons Logging 1.3.0 based on RC1
Posted by "Piotr P. Karwasz" <pi...@gmail.com>.
Hi Gary,
> Please review the release candidate and vote.
> This vote will close no sooner than 72 hours from now.
>
> [ ] +1 Release these artifacts
> [ ] +0 OK, but...
> [ ] -0 OK, but really should fix...
> [ ] -1 I oppose this release because...
I performed the following tests:
* I tested the signature and hashes of the ZIP archives,
* I tested the source archive and the reproducibility of binaries with:
mvn clean verify artifact:compare
-Dreference.repo=https://repository.apache.org/content/repositories/orgapachecommons-1676
* I tested 4 simple JLink runtimes: JCL + Log4j Core 2.x, JCL + Log4j
Core 3.x, JCL + `java.logging` and just JCL.
+1 (non binding): everything works correctly with the following remarks:
1. the SPDX artifact is not reproducible,
2. For some strange reason I had to set `TZ=America/New_York` to make
the main JAR reproducible. Either the Moditect or the Maven JAR plugin
are responsible for that.
3. The SHA512 sums in the distribution can not be used with
`sha512sum -c` (they lack the file name).
Piotr
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org