You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@syncope.apache.org by Francesco Chicchiriccò <il...@apache.org> on 2012/05/02 13:50:43 UTC
[DISCUSS] Apache Syncope 1.0.0-RC1-incubating
Discussion thread for vote on 1.0.0-RC1-incubating release, with SVN
source tag (r1332998).
For more information on the release process, check out
http://www.apache.org/dev/release.html
Some of the things to check before voting are:
- does "mvn apache-rat:check" pass on the source
- can you build the contents of source release (both .zip and .tar.gz)
and SVN tag
- do all of the staged jars/wars/tar.gz/zips contain the required
LICENSE and NOTICE files
- are all of the staged jars/wars/tar.gz/zips signed and the signature
verifiable
- is the signing key in the project's KEYS file and on a public server
(i.e. http://www.apache.org/dist/incubator/syncope/)
Regards.
--
Francesco Chicchiriccò
Apache Cocoon PMC and Apache Syncope PPMC Member
http://people.apache.org/~ilgrosso/
Re: [DISCUSS] Apache Syncope 1.0.0-RC1-incubating
Posted by Francesco Chicchiriccò <il...@apache.org>.
On 02/05/2012 15:41, René Mulder wrote:
> +1
>
> although i wasnt able to check the signatures (no practical PGP knowledge),
> i was able to build from various sources, perform apache-rat:check and
> found the LICENCE and NOTICE files in the wars.
Hi Rene,
check [1] for this (for example).
Regards.
[1] http://www.apache.org/dev/release-signing#verifying-signature
On 02/05/2012 13:50, Francesco Chicchiriccò wrote:
> Discussion thread for vote on 1.0.0-RC1-incubating release, with SVN
> source tag (r1332998).
>
> For more information on the release process, check out
> http://www.apache.org/dev/release.html
>
> Some of the things to check before voting are:
> - does "mvn apache-rat:check" pass on the source
> - can you build the contents of source release (both .zip and .tar.gz)
> and SVN tag
> - do all of the staged jars/wars/tar.gz/zips contain the required
> LICENSE and NOTICE files
> - are all of the staged jars/wars/tar.gz/zips signed and the signature
> verifiable
> - is the signing key in the project's KEYS file and on a public server
> (i.e. http://www.apache.org/dist/incubator/syncope/)
>
> Regards.
--
Francesco Chicchiriccò
Apache Cocoon PMC and Apache Syncope PPMC Member
http://people.apache.org/~ilgrosso/
Re: [DISCUSS] Apache Syncope 1.0.0-RC1-incubating
Posted by Francesco Chicchiriccò <il...@apache.org>.
On 04/05/2012 13:17, Emmanuel Lécharny wrote:
> Le 5/3/12 3:49 PM, Francesco Chicchiriccò a écrit :
>> #!/bin/bash
>>
>> DIST_DIR=/home/ilgrosso/work/syncope
>> WORK_DIR=/tmp/verify
>>
>> rm -rf $WORK_DIR
>> mkdir $WORK_DIR
>> cd $WORK_DIR
>>
>> for jarfile in `find $DIST_DIR -name '*.jar' -or -name '*war' | grep -v
>> cargo | grep -v lib | grep -v bundles | grep -v javadoc`; do
>> JAR_DIR=`basename $jarfile`
>> echo "Processing "$JAR_DIR"..."
>>
>> mkdir $JAR_DIR
>> cd $JAR_DIR
>> jar xvf $jarfile META-INF/LICENSE> /dev/null
>> jar xvf $jarfile META-INF/NOTICE> /dev/null
>>
>> echo "LICENSE: "`diff -q $DIST_DIR/LICENSE META-INF/LICENSE`
>> echo "NOTICE: "`diff -q $DIST_DIR/NOTICE META-INF/NOTICE`
>> echo
>>
>> cd ..
>> done
> May I suggest you put that in subversion ? That would be very helpful
> for those testing the releases...
>
Done:
https://svn.apache.org/repos/asf/incubator/syncope/committers/tools/verify-LICENSE-NOTICE.sh
Regards.
--
Francesco Chicchiriccò
Apache Cocoon PMC and Apache Syncope PPMC Member
http://people.apache.org/~ilgrosso/
Re: [DISCUSS] Apache Syncope 1.0.0-RC1-incubating
Posted by Emmanuel Lécharny <el...@gmail.com>.
Le 5/3/12 3:49 PM, Francesco Chicchiriccò a écrit :
> #!/bin/bash
>
> DIST_DIR=/home/ilgrosso/work/syncope
> WORK_DIR=/tmp/verify
>
> rm -rf $WORK_DIR
> mkdir $WORK_DIR
> cd $WORK_DIR
>
> for jarfile in `find $DIST_DIR -name '*.jar' -or -name '*war' | grep -v
> cargo | grep -v lib | grep -v bundles | grep -v javadoc`; do
> JAR_DIR=`basename $jarfile`
> echo "Processing "$JAR_DIR"..."
>
> mkdir $JAR_DIR
> cd $JAR_DIR
> jar xvf $jarfile META-INF/LICENSE> /dev/null
> jar xvf $jarfile META-INF/NOTICE> /dev/null
>
> echo "LICENSE: "`diff -q $DIST_DIR/LICENSE META-INF/LICENSE`
> echo "NOTICE: "`diff -q $DIST_DIR/NOTICE META-INF/NOTICE`
> echo
>
> cd ..
> done
May I suggest you put that in subversion ? That would be very helpful
for those testing the releases...
--
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com
Re: [DISCUSS] Apache Syncope 1.0.0-RC1-incubating
Posted by Francesco Chicchiriccò <il...@apache.org>.
On 03/05/2012 15:02, Emmanuel Lécharny wrote:
> [...]
>
> One bad news though :
> the
> https://repository.apache.org/content/repositories/orgapachesyncope-026/org/apache/syncope/syncope-archetype/1.0.0-RC1-incubating/syncope-archetype-1.0.0-RC1-incubating-sources.jar
> does not contain the correct NOTICE and LICENSE files :/
I've just checked (by using the script reported in the following) and it
seems that all sources JAR files have standard LICENSE & NOTICE, not the
correct ones.
The same does not apply - fortunately - to binary JAR and WAR files.
Have you found anything else wrong?
> Ps : we may need a tool (a kind of shell script) to check those files
> on all the jars/wars/etc, otherwise is just a PITA to do it by hand ...
I've drafted the following bash script for this:
#!/bin/bash
DIST_DIR=/home/ilgrosso/work/syncope
WORK_DIR=/tmp/verify
rm -rf $WORK_DIR
mkdir $WORK_DIR
cd $WORK_DIR
for jarfile in `find $DIST_DIR -name '*.jar' -or -name '*war' | grep -v
cargo | grep -v lib | grep -v bundles | grep -v javadoc`; do
JAR_DIR=`basename $jarfile`
echo "Processing "$JAR_DIR"..."
mkdir $JAR_DIR
cd $JAR_DIR
jar xvf $jarfile META-INF/LICENSE > /dev/null
jar xvf $jarfile META-INF/NOTICE > /dev/null
echo "LICENSE: "`diff -q $DIST_DIR/LICENSE META-INF/LICENSE`
echo "NOTICE: "`diff -q $DIST_DIR/NOTICE META-INF/NOTICE`
echo
cd ..
done
--
Francesco Chicchiriccò
Apache Cocoon PMC and Apache Syncope PPMC Member
http://people.apache.org/~ilgrosso/
Re: [DISCUSS] Apache Syncope 1.0.0-RC1-incubating
Posted by Emmanuel Lécharny <el...@gmail.com>.
Le 5/3/12 2:58 PM, Francesco Chicchiriccò a écrit :
> On 03/05/2012 14:52, Emmanuel Lécharny wrote:
>> Hi !
>>
>> /me Checking the release atm. So far, nothing blocking. I'm not
>> totally done but I have a few comments :
>>
>> - When you start a new vote, say so by adding a number in the subject
>> (like "[Vote] Apache Syncope...; Take 3"). It helps people to not get
>> lost...
> You're right, even though I would hope this won't be the case for each
> vote in the future... :-)
:)
>
>> - I still have some files with no license with running mvn rat:check :
>> core/src/main/resources/META-INF/services/org.identityconnectors.common.logging
>>
>> core/src/test/resources/test.csv
>>
>> AFAICT, those two files have no reason to have a license, and I guess
>> that it's covered in the apache-rat-plugin configuration. Can you
>> confirm that the check should be done with mvn apache-rat:check ? In
>> any case, I won't vote -1 because of those two files, just want to be
>> sure.
> As reported in the email body, apache-rat:check should be run, not
> rat:check; the latter has no configuration in our project, while the
> former does.
> The reasons for preferring apache-rat over rat are:
> * apache-rat is included in Apache POM 10, not rat
> * rat is obsolete, as reported by
> http://mojo.codehaus.org/rat-maven-plugin/
Ok, thanks. I checked the configuration, and those two files are
correctly ignored.
One bad news though :
the
https://repository.apache.org/content/repositories/orgapachesyncope-026/org/apache/syncope/syncope-archetype/1.0.0-RC1-incubating/syncope-archetype-1.0.0-RC1-incubating-sources.jar
does not contain the correct NOTICE and LICENSE files :/
Ps : we may need a tool (a kind of shell script) to check those files on
all the jars/wars/etc, otherwise is just a PITA to do it by hand ...
--
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com
Re: [DISCUSS] Apache Syncope 1.0.0-RC1-incubating
Posted by Francesco Chicchiriccò <il...@apache.org>.
On 03/05/2012 14:52, Emmanuel Lécharny wrote:
> Hi !
>
> /me Checking the release atm. So far, nothing blocking. I'm not
> totally done but I have a few comments :
>
> - When you start a new vote, say so by adding a number in the subject
> (like "[Vote] Apache Syncope...; Take 3"). It helps people to not get
> lost...
You're right, even though I would hope this won't be the case for each
vote in the future... :-)
> - I still have some files with no license with running mvn rat:check :
> core/src/main/resources/META-INF/services/org.identityconnectors.common.logging
>
> core/src/test/resources/test.csv
>
> AFAICT, those two files have no reason to have a license, and I guess
> that it's covered in the apache-rat-plugin configuration. Can you
> confirm that the check should be done with mvn apache-rat:check ? In
> any case, I won't vote -1 because of those two files, just want to be
> sure.
As reported in the email body, apache-rat:check should be run, not
rat:check; the latter has no configuration in our project, while the
former does.
The reasons for preferring apache-rat over rat are:
* apache-rat is included in Apache POM 10, not rat
* rat is obsolete, as reported by
http://mojo.codehaus.org/rat-maven-plugin/
Regards.
--
Francesco Chicchiriccò
Apache Cocoon PMC and Apache Syncope PPMC Member
http://people.apache.org/~ilgrosso/