You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@excalibur.apache.org by Leo Simons <ma...@leosimons.com> on 2007/03/20 02:29:10 UTC
www.apache.org/dist/excalibur signatures (was: Re: Cron ( cd /home/henkp/checker ; /usr/bin/make -s cron ) (fwd))
(dropping private@, adding dev@).
On Mar 19, 2007, at 11:36 AM, Leo Simons wrote:
> On Mar 19, 2007, at 3:55 AM, J Aaron Farr wrote:
>> "Henk P. Penning" <he...@cs.uu.nl> writes:
>>
>>> Some 29 other excalibur artifacts aren't properly signed :
>>>
>>> http://people.apache.org/~henkp/checker/sig.html#unsig-excalibur
>>>
>>> They are all owned by Leo Simons.
>
> Oh dear, I can't believe it. That's been broken for two years or
> so, then.
>
>>> ... I see some (all?) of the objects are symlinks to other things.
>>> The other things /do/ have proper sigs, so it seems to be a matter
>>> of missing symlinks (to the corresponding .asc's). It would be
>>> nice
>>> if this could be fixed too.
>>
>> Ug. We could add the symlinks. The thing is, the symlinks should be
>> updated and really, they're not even useful anymore. Personally, I'd
>> like to just remove them.
>>
>> Leo? Thoughts?
>
> I will find time to fix it tonight.
Should all be done (was indeed just symlinking to do). The main
reason to keep the symlinks is google -- if someone searches for
"avalon-framework-4.2.0.tar.gz" it is nice if they end up in the
right location. Removing the symlinks would hamper that a bit.
I also note that /dist/avalon is missing 35 signatures, all related
files owned by Niclas.
Also interesting from Henk's page -- there's a total of 3467
artifacts in /dist, now. Of those, 659 are from excalibur, 640 are
from avalon, and 561 are from jakarta. The next runner-up then is
tomcat, with a measly 168 artifacts. In other words, you *still* have
to consider us rather big by modern-day standard!
Now, should we archive some things? The policy says,
"Older releases that you would no longer recommend to the
general public should be placed on archive.apache.org."
that means we should probably get rid of /www/www.apache.org/dist/
avalon/ completely on the active mirrors and just have it on archive
in theory, but in practice, files like avalon-framework-4.1.4.jar
should simply stay up there in safety gathering dust, since that's
still an active dependency for a lot of stuff "out there", and
there's not really a big reason to not recommend it for use.
- Leo
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@excalibur.apache.org
For additional commands, e-mail: dev-help@excalibur.apache.org
Re: www.apache.org/dist/excalibur signatures
Posted by "Henk P. Penning" <he...@cs.uu.nl>.
On Tue, 20 Mar 2007, Leo Simons wrote:
> Date: Tue, 20 Mar 2007 14:29:44 +0100
> From: Leo Simons <ma...@leosimons.com>
> To: Henk P.Penning <he...@cs.uu.nl>
> Cc: Niclas Hedhman <ni...@hedhman.org>,
> Excalibur Developers List <de...@excalibur.apache.org>
> Subject: Re: www.apache.org/dist/excalibur signatures
>
> On Mar 20, 2007, at 1:42 PM, Henk P. Penning wrote:
>> thanks for the quick response ; I'll delete them tomorrow,
>> unless someone speaks up.
Hi,
for the record ; I removed these files :
avalon/avalon-logkit/distributions/avalon-logkit-2.0.dev-0-src.tar.gz
avalon/avalon-logkit/distributions/avalon-logkit-2.0.dev-0-src.zip
avalon/avalon-logkit/distributions/avalon-logkit-2.0.dev-0.tar.gz
avalon/avalon-logkit/distributions/avalon-logkit-2.0.dev-0.zip
avalon/merlin/distributions/distributions.tar.gz
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-0-src.tar.gz
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-0-src.zip
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-0.tar.gz
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-0.zip
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-1-src.tar.gz
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-1-src.zip
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-1.tar.gz
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-1.zip
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-3-src.tar.gz
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-3-src.zip
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-3.tar.gz
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-3.zip
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-4-src.tar.gz
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-4-src.zip
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-4.tar.gz
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-4.zip
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-5-src.tar.gz
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-5-src.zip
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-5.tar.gz
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-5.zip
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-6-src.tar.gz
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-6-src.zip
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-6.tar.gz
avalon/merlin/distributions/merlin-jmx-demo-1.0.rc-6.zip
avalon/merlin/jars/merlin-jmx-demo-1.0.rc-1.jar
avalon/merlin/jars/merlin-jmx-demo-1.0.rc-3.jar
avalon/merlin/jars/merlin-jmx-demo-1.0.rc-4.jar
avalon/merlin/jars/merlin-jmx-demo-1.0.rc-5.jar
avalon/merlin/jars/merlin-jmx-demo-1.0.rc-6.jar
avalon/merlin/jars/merlin-jmx-demo-1.0.rc-7.jar
HPP
---------------------------------------------------------------- _
Henk P. Penning, Computer Systems Group R Uithof CGN-A232 _/ \_
Dept of Computer Science, Utrecht University T +31 30 253 4106 / \_/ \
Padualaan 14, 3584CH Utrecht, the Netherlands F +31 30 251 3791 \_/ \_/
http://www.cs.uu.nl/~henkp/ M penning@cs.uu.nl \_/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@excalibur.apache.org
For additional commands, e-mail: dev-help@excalibur.apache.org
Re: www.apache.org/dist/excalibur signatures
Posted by Leo Simons <ma...@leosimons.com>.
On Mar 20, 2007, at 1:42 PM, Henk P. Penning wrote:
> On Tue, 20 Mar 2007, Niclas Hedhman wrote:
>
>> Date: Tue, 20 Mar 2007 20:03:59 +0800
>> From: Niclas Hedhman <ni...@hedhman.org>
>> To: Henk P. Penning <he...@cs.uu.nl>
>> Cc: Leo Simons <ma...@leosimons.com>,
>> Excalibur Developers List <de...@excalibur.apache.org>
>> Subject: Re: www.apache.org/dist/excalibur signatures
>> Sender: Niclas Hedhman <he...@gmail.com>
>> On Tuesday 20 March 2007 18:07, Henk P. Penning wrote:
>
>>> http://people.apache.org/~henkp/checker/sig.html#user-niclas
>
>> So IMHO, all those 35 files should just be deleted, and but either
>> I don't
>> know where to delete them, or I don't have karma for it. Ex;
>
> Niclas,
>
> thanks for the quick response ; I'll delete them tomorrow,
> unless someone speaks up.
Thanks Henk!
- Leo
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@excalibur.apache.org
For additional commands, e-mail: dev-help@excalibur.apache.org
Re: www.apache.org/dist/excalibur signatures
Posted by "Henk P. Penning" <he...@cs.uu.nl>.
On Tue, 20 Mar 2007, Niclas Hedhman wrote:
> Date: Tue, 20 Mar 2007 20:03:59 +0800
> From: Niclas Hedhman <ni...@hedhman.org>
> To: Henk P. Penning <he...@cs.uu.nl>
> Cc: Leo Simons <ma...@leosimons.com>,
> Excalibur Developers List <de...@excalibur.apache.org>
> Subject: Re: www.apache.org/dist/excalibur signatures
> Sender: Niclas Hedhman <he...@gmail.com>
>
> On Tuesday 20 March 2007 18:07, Henk P. Penning wrote:
>> http://people.apache.org/~henkp/checker/sig.html#user-niclas
> So IMHO, all those 35 files should just be deleted, and but either I don't
> know where to delete them, or I don't have karma for it. Ex;
Niclas,
thanks for the quick response ; I'll delete them tomorrow,
unless someone speaks up.
Note : copies will be kept on 'archive.apache.org'.
> Niclas Hedhman, Software Developer
Regards,
Henk Penning
---------------------------------------------------------------- _
Henk P. Penning, Computer Systems Group R Uithof CGN-A232 _/ \_
Dept of Computer Science, Utrecht University T +31 30 253 4106 / \_/ \
Padualaan 14, 3584CH Utrecht, the Netherlands F +31 30 251 3791 \_/ \_/
http://www.cs.uu.nl/~henkp/ M penning@cs.uu.nl \_/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@excalibur.apache.org
For additional commands, e-mail: dev-help@excalibur.apache.org
Re: www.apache.org/dist/excalibur signatures
Posted by Niclas Hedhman <ni...@hedhman.org>.
On Tuesday 20 March 2007 18:07, Henk P. Penning wrote:
> Leo was talking about
>
> http://people.apache.org/~henkp/checker/sig.html#user-niclas
>
> ; these are unsigned tar.gz's, zip's, jar's etc.
>
> It would be nice if some maintainance could be done :
> remove obsolete stuff, and sign the rest ?
The "dev" marker in LogKit was used a while before Maven's SNAPSHOT became the
norm. And the "rc" for the jmx-demo stuff is definately part of my creation
of the release scripts and for some unknown reason not cleaned up properly
(jmx-demo was not a big project and would not have that many release
candidates, hence I am pretty sure it was for the purpose of creating the
release scripts.)
The final file is the
avalon/merlin/distributions/distributions.tar.gz
which I don't know what it is, but the content is only the jmx-demo stuff, so
I suggest it to be deleted as well.
So IMHO, all those 35 files should just be deleted, and but either I don't
know where to delete them, or I don't have karma for it. Ex;
[niclas@minotaur /www/www.apache.org/dist/avalon/avalon-logkit/distributions]$
ls -l
total 1164
-rw-rw-r-- 1 apbackup 5023 59466 Apr 11 2004
avalon-logkit-2.0.dev-0-src.tar.gz
-rw-rw-r-- 1 apbackup 5023 129969 Apr 11 2004
avalon-logkit-2.0.dev-0-src.zip
-rw-rw-r-- 1 apbackup 5023 316286 Apr 11 2004
avalon-logkit-2.0.dev-0.tar.gz
-rw-rw-r-- 1 apbackup 5023 625609 Apr 11 2004 avalon-logkit-2.0.dev-0.zip
Cheers
--
Niclas Hedhman, Software Developer
I live here; http://tinyurl.com/2qq9er
I work here; http://tinyurl.com/2ymelc
I relax here; http://tinyurl.com/2cgsug
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@excalibur.apache.org
For additional commands, e-mail: dev-help@excalibur.apache.org
Re: www.apache.org/dist/excalibur signatures
Posted by "Henk P. Penning" <he...@cs.uu.nl>.
On Tue, 20 Mar 2007, Niclas Hedhman wrote:
> Date: Tue, 20 Mar 2007 10:36:42 +0800
> From: Niclas Hedhman <ni...@hedhman.org>
> To: Leo Simons <ma...@leosimons.com>
> Cc: Excalibur Developers List <de...@excalibur.apache.org>,
> Henk P. Penning <he...@cs.uu.nl>
> Subject: Re: www.apache.org/dist/excalibur signatures (was: Re: Cron
> <he...@minotaur> ( cd /home/henkp/checker ; /usr/bin/make -s cron ) (fwd))
> Sender: Niclas Hedhman <he...@gmail.com>
>
> On Tuesday 20 March 2007 09:29, Leo Simons wrote:
>> I also note that /dist/avalon is missing 35 signatures, all related
>> files owned by Niclas.
> Are we talking
Leo was talking about
http://people.apache.org/~henkp/checker/sig.html#user-niclas
; these are unsigned tar.gz's, zip's, jar's etc.
It would be nice if some maintainance could be done :
remove obsolete stuff, and sign the rest ?
> Niclas Hedhman, Software Developer
Thanks, regards,
Henk Penning
---------------------------------------------------------------- _
Henk P. Penning, Computer Systems Group R Uithof CGN-A232 _/ \_
Dept of Computer Science, Utrecht University T +31 30 253 4106 / \_/ \
Padualaan 14, 3584CH Utrecht, the Netherlands F +31 30 251 3791 \_/ \_/
http://www.cs.uu.nl/~henkp/ M penning@cs.uu.nl \_/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@excalibur.apache.org
For additional commands, e-mail: dev-help@excalibur.apache.org
Re: www.apache.org/dist/excalibur signatures (was: Re: Cron ( cd /home/henkp/checker ; /usr/bin/make -s cron ) (fwd))
Posted by Niclas Hedhman <ni...@hedhman.org>.
On Tuesday 20 March 2007 09:29, Leo Simons wrote:
> Should all be done (was indeed just symlinking to do). The main
> reason to keep the symlinks is google -- if someone searches for
> "avalon-framework-4.2.0.tar.gz" it is nice if they end up in the
> right location. Removing the symlinks would hamper that a bit.
Putting back http://avalon.apache.org links as well??
> I also note that /dist/avalon is missing 35 signatures, all related
> files owned by Niclas.
Are we talking
[niclas@minotaur /www/www.apache.org/dist/avalon]$
for FILE in \
`find . -type f | grep -v asc | grep -v md5 | grep -v MD5` ; \
do \
ASC=`ls $FILE.asc 2>/dev/null` ; \
if [ "$ASC" = "" ] ; \
then \
ls -l $FILE ; \
fi ; \
done | grep "2004"
which returns 44 items
??
Not sure you conclude the are "owned" by me, but they seem familiar...
merlin-jmx-demo --> I was told to put Release Candidates in dist/, and IIRC it
was corrected later.
*.meta --> These were files used by Merlin itself for bootstrapping
purposes. Not sure why they are in /dist/avalon at all. Merlin would locate
those in Maven repository.
avalon-logkit-2.0.dev-0-src.tar.gz --> the "dev" marker means that this is not
a released artifact at all, and should not be in /dist. Probably missed
leftover from the time when developing an automated "release generator".
After all, we had something like 150 artifacts to process...
That leaves;
./merlin/binaries/3.3.0/merlin-3.3.0-install.exe --> I don't have Windows, so
I don't think I have been involved directly in manipulation of this file.
./merlin/distributions/distributions.tar.gz --> No idea what this file is,
but the content seems to suggest that it is garbage.
I hope this compilation helps.
And as you pointed, it was very hard to keep the tongue in the right place due
to the enormous amount of artifacts to be processed and checked for releases.
Now I find it remarkable that there are not a lot more mistakes.
I remember I was preparing that once to provide re-producable builds of
Excalibur and Fortress (mainly to get Gump operational), but also so that
Cocoon could operate with properly released components and not it own built
snapshots of everything.
Cheers
--
Niclas Hedhman, Software Developer
I live here; http://tinyurl.com/2qq9er
I work here; http://tinyurl.com/2ymelc
I relax here; http://tinyurl.com/2cgsug
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@excalibur.apache.org
For additional commands, e-mail: dev-help@excalibur.apache.org
Re: www.apache.org/dist/excalibur signatures
Posted by "Henk P. Penning" <he...@cs.uu.nl>.
On Tue, 20 Mar 2007, Leo Simons wrote:
> Date: Tue, 20 Mar 2007 14:40:32 +0100
> From: Leo Simons <ma...@leosimons.com>
> To: Henk P.Penning <he...@cs.uu.nl>
> Cc: Excalibur Developers List <de...@excalibur.apache.org>,
> Niclas Hedhman <ni...@hedhman.org>
> Subject: Re: www.apache.org/dist/excalibur signatures
>
> On Mar 20, 2007, at 10:50 AM, Henk P. Penning wrote:
>> http://people.apache.org/~henkp/checker/md5.html
>> That is not to say that a big cleanup is in order, but it puts
>> the numbers in perspective.
> : -). I don't really want to sift through the 100s of files in dist/avalon to
> : figure out what to do with each of them; many of them are so old that
> : no-one will remember. Do we have any idea how much that stuff is still
> : accessed? If it's only a little bit, we can consider just rm -Rf-ing it and
> : pointing to archive.apache.org.
Agree ; there is no point in a partial rm. It is impossible to make
a good distinction between genuine interest and stupid, curl/wget/etc
crawlers.
> Is there an easy way to find out just the (non-symlink) dupes just within
> dist/excalibur?
There aren't any (over 40 KB) ; the 'doubles' section only knows about
real files (it ignores symlinks).
> - Leo
HPP
---------------------------------------------------------------- _
Henk P. Penning, Computer Systems Group R Uithof CGN-A232 _/ \_
Dept of Computer Science, Utrecht University T +31 30 253 4106 / \_/ \
Padualaan 14, 3584CH Utrecht, the Netherlands F +31 30 251 3791 \_/ \_/
http://www.cs.uu.nl/~henkp/ M penning@cs.uu.nl \_/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@excalibur.apache.org
For additional commands, e-mail: dev-help@excalibur.apache.org
Re: www.apache.org/dist/excalibur signatures
Posted by Leo Simons <ma...@leosimons.com>.
On Mar 20, 2007, at 10:50 AM, Henk P. Penning wrote:
>> Also interesting from Henk's page -- there's a total of 3467
>> artifacts in /dist, now. Of those, 659 are from excalibur, 640 are
>> from avalon, and 561 are from jakarta. The next runner-up then is
>> tomcat, with a measly 168 artifacts. In other words, you *still*
>> have to consider us rather big by modern-day standard!
>
> ... two remarks :
>
> 1. there are a lot of excalibur/avalon doubles ; see 'fyi : some
> doubles' in
>
> http://people.apache.org/~henkp/checker/md5.html
>
> 2. othere projects recently cleaned up a lot of old versions ;
> refering users to 'archive.apache.org' in README.html files.
>
> That is not to say that a big cleanup is in order, but it puts
> the numbers in perspective.
:-). I don't really want to sift through the 100s of files in dist/
avalon to figure out what to do with each of them; many of them are
so old that no-one will remember. Do we have any idea how much that
stuff is still accessed? If it's only a little bit, we can consider
just rm -Rf-ing it and pointing to archive.apache.org.
Is there an easy way to find out just the (non-symlink) dupes just
within dist/excalibur?
- Leo
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@excalibur.apache.org
For additional commands, e-mail: dev-help@excalibur.apache.org
Re: www.apache.org/dist/excalibur signatures
Posted by "Henk P. Penning" <he...@cs.uu.nl>.
On Tue, 20 Mar 2007, Leo Simons wrote:
> Date: Tue, 20 Mar 2007 02:29:10 +0100
> From: Leo Simons <ma...@leosimons.com>
> To: Excalibur Developers List <de...@excalibur.apache.org>
> Cc: Henk P. Penning <he...@cs.uu.nl>, Niclas Hedhman <ni...@hedhman.org>
> Subject: www.apache.org/dist/excalibur signatures (was: Re: Cron
> <he...@minotaur> ( cd /home/henkp/checker ; /usr/bin/make -s cron ) (fwd))
[ ... ]
Hi,
>> I will find time to fix it tonight.
>
> Should all be done (was indeed just symlinking to do).
Thanks a lot ; almost there :-). Please see
http://people.apache.org/~henkp/checker/sig.html#user-leosimons
This .asc is pointing to a .md5 :
excalibur/excalibur-fortress/binaries/avalon-fortress-container-1.1.zip.asc
-> excalibur-fortress-container-1.1.zip.md5
There remain 3 'missing sigs'. It would be nice if those were fixed too.
> I also note that /dist/avalon is missing 35 signatures, all related files
> owned by Niclas.
> Also interesting from Henk's page -- there's a total of 3467 artifacts in
> /dist, now. Of those, 659 are from excalibur, 640 are from avalon, and 561
> are from jakarta. The next runner-up then is tomcat, with a measly 168
> artifacts. In other words, you *still* have to consider us rather big by
> modern-day standard!
... two remarks :
1. there are a lot of excalibur/avalon doubles ; see 'fyi : some doubles' in
http://people.apache.org/~henkp/checker/md5.html
2. othere projects recently cleaned up a lot of old versions ;
refering users to 'archive.apache.org' in README.html files.
That is not to say that a big cleanup is in order, but it puts
the numbers in perspective.
> - Leo
Thanks again, regards,
Henk Penning
---------------------------------------------------------------- _
Henk P. Penning, Computer Systems Group R Uithof CGN-A232 _/ \_
Dept of Computer Science, Utrecht University T +31 30 253 4106 / \_/ \
Padualaan 14, 3584CH Utrecht, the Netherlands F +31 30 251 3791 \_/ \_/
http://www.cs.uu.nl/~henkp/ M penning@cs.uu.nl \_/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@excalibur.apache.org
For additional commands, e-mail: dev-help@excalibur.apache.org