You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@juneau.apache.org by James Bognar <ja...@apache.org> on 2020/01/12 18:24:53 UTC
[VOTE] Release Apache Juneau 8.1.3 RC1
I am pleased to be calling this vote for the source release of Apache
Juneau 8.1.3 RC1.
The binaries are available at:
https://dist.apache.org/repos/dist/dev/juneau/binaries/juneau-8.1.3-RC1/
The release candidate to be voted over is available at:
https://dist.apache.org/repos/dist/dev/juneau/source/juneau-8.1.3-RC1/
SHA-512 checksums:
apache-juneau-8.1.3-src.zip:
48C13039 9573BD18 B4C11FB5 13AE8E9F 16D9AC16
450BCDEF AC2C1E51 E5E1EFD8 75ED0EAC 80398902
981C2846 56029A81 AC4BBF9D 7EB2AA8E 4D4B68F5
B682399A
apache-juneau-8.1.3-bin.zip:
78B63158 C556EB9B ED405BF0 7002C572 F8DA055A
407A198F FA7AEE3E 0C91F4CE 54F14260 99F478A4
B12E122A 2C95C145 DBD4D49A AC277ECF 4860F5C3
A5D3C0BD
Build the release candidate using:
mvn clean install
The release candidate is signed with a GPG key available at:
https://dist.apache.org/repos/dist/release/juneau/KEYS
A staged Maven repository is available for review at:
https://repository.apache.org/content/repositories/orgapachejuneau-1030/
The Git commit for this release is...
https://gitbox.apache.org/repos/asf?p=juneau.git;a=commit;h=d83c0392a39392717e32a491ee34edd2353f5446
Please vote on releasing this package as:
Apache Juneau 8.1.3
This vote will be open until 16-Jan-2020 9:00am and passes if a
majority of at least three +1 Apache Juneau PMC votes are cast.
[ ] +1 Release this package
[ ] 0 I don't feel strongly about it, but don't object
[ ] -1 Do not release this package because...
Anyone can participate in testing and voting, not just committers,
please feel free to try out the release candidate and provide your
votes.
[CANCELLED][VOTE] Release Apache Juneau 8.1.3 RC1
Posted by James Bognar <ja...@apache.org>.
Thanks Stian,
I'll take care of these issues right away. Thanks for finding them!
On Mon, Jan 13, 2020 at 4:51 AM Stian Soiland-Reyes <st...@apache.org> wrote:
>
> My vote is unfortunately: -1
>
> I am not sure how I missed this before, but juneau-doc in the src
> release seems to include tools.jar binary from Oracle JDK 1.7, which
> (in addition to its copyright and license missing) cannot be released
> under Apache License 2.0.
>
> It is also dubious if it's legal to redistribute tools.jar without also
> redistributing the rest of JRE.
> https://www.oracle.com/technetwork/java/javase/jdk-7-readme-429198.html#redistributablejdkfiles
>
> > The limited set of files and directories from the JDK listed below may
> > be included in vendor redistributions of the Java Runtime Environment
> > (JRE). They cannot be redistributed separately, and must accompany a
> > JRE distribution.
>
> I don't know why it should be necessary to include tools.jar to
> generate Javadocs as it is included in all JDK distributions.
>
>
>
> There is also juneau-doc/juneau-doc.jar which includes some binaries
> like
> 1823 Defl:N 969 47% 01-12-2020 10:30 eedf49f6 org/apache/juneau/doc/internal/DocGenerator$Topics.class
> 11006 Defl:N 4855 56% 01-12-2020 10:30 fe85af9d org/apache/juneau/doc/internal/DocGenerator.class
>
> This jar is also missing LICENSE/NOTICE but looks like it has been
> generated by this very same build. Could this perhaps instead be a
> Maven dependency from a previous release of Juneau?
>
>
> It is also a convention that ASF source releases should not include
> software binaries.
>
>
> This is a blocking matter so I am afraid my vote is negative.
>
> [+] git commit vs tag
> [+] sha512 checksums correct
> [+] git vs src zip (excess .DS_Store in git, now removed)
> [+] LICENSE, NOTICE src
> [ ] LICENSE, NOTICE bin
> [+] mvn apache-rat:rat
> [-] binaries in src distribution? (juneau-doc/tools.jar - what license?)
> [ ] mvn clean install
> [ ] bin vs built
> [ ] mvn repo vs bin
> [ ] mvn repo vs src
>
>
> Tested with:
>
> (base) stain@biggie:~$ lsb_release -d
> Description: Ubuntu 18.04.3 LTS
>
> (base) stain@biggie:~$ mvn --versionon
> Apache Maven 3.6.0 (97c98ec64a1fdfee7767ce5ffb20918da4f719f3; 2018-10-24T19:41:47+01:00)
> Maven home: /home/stain/software/maven
> Java version: 11.0.5, vendor: Private Build, runtime: /usr/lib/jvm/java-11-openjdk-amd64
> Default locale: en_GB, platform encoding: UTF-8
> OS name: "linux", version: "4.15.0-74-generic", arch: "amd64", family: "unix"
>
>
> On Sun, 12 Jan 2020 13:24:53 -0500, James Bognar <ja...@apache.org> wrote:
> > I am pleased to be calling this vote for the source release of Apache
> > Juneau 8.1.3 RC1.
> >
> > The binaries are available at:
> > https://dist.apache.org/repos/dist/dev/juneau/binaries/juneau-8.1.3-RC1/
> >
> > The release candidate to be voted over is available at:
> > https://dist.apache.org/repos/dist/dev/juneau/source/juneau-8.1.3-RC1/
> >
> > SHA-512 checksums:
> > apache-juneau-8.1.3-src.zip:
> > 48C13039 9573BD18 B4C11FB5 13AE8E9F 16D9AC16
> > 450BCDEF AC2C1E51 E5E1EFD8 75ED0EAC 80398902
> > 981C2846 56029A81 AC4BBF9D 7EB2AA8E 4D4B68F5
> > B682399A
> > apache-juneau-8.1.3-bin.zip:
> > 78B63158 C556EB9B ED405BF0 7002C572 F8DA055A
> > 407A198F FA7AEE3E 0C91F4CE 54F14260 99F478A4
> > B12E122A 2C95C145 DBD4D49A AC277ECF 4860F5C3
> > A5D3C0BD
> >
> > Build the release candidate using:
> > mvn clean install
> >
> > The release candidate is signed with a GPG key available at:
> > https://dist.apache.org/repos/dist/release/juneau/KEYS
> >
> > A staged Maven repository is available for review at:
> > https://repository.apache.org/content/repositories/orgapachejuneau-1030/
> >
> > The Git commit for this release is...
> > https://gitbox.apache.org/repos/asf?p=juneau.git;a=commit;h=d83c0392a39392717e32a491ee34edd2353f5446
> >
> > Please vote on releasing this package as:
> > Apache Juneau 8.1.3
> >
> > This vote will be open until 16-Jan-2020 9:00am and passes if a
> > majority of at least three +1 Apache Juneau PMC votes are cast.
> >
> > [ ] +1 Release this package
> > [ ] 0 I don't feel strongly about it, but don't object
> > [ ] -1 Do not release this package because...
> >
> > Anyone can participate in testing and voting, not just committers,
> > please feel free to try out the release candidate and provide your
> > votes.
Re: [VOTE] Release Apache Juneau 8.1.3 RC1
Posted by Stian Soiland-Reyes <st...@apache.org>.
My vote is unfortunately: -1
I am not sure how I missed this before, but juneau-doc in the src
release seems to include tools.jar binary from Oracle JDK 1.7, which
(in addition to its copyright and license missing) cannot be released
under Apache License 2.0.
It is also dubious if it's legal to redistribute tools.jar without also
redistributing the rest of JRE.
https://www.oracle.com/technetwork/java/javase/jdk-7-readme-429198.html#redistributablejdkfiles
> The limited set of files and directories from the JDK listed below may
> be included in vendor redistributions of the Java Runtime Environment
> (JRE). They cannot be redistributed separately, and must accompany a
> JRE distribution.
I don't know why it should be necessary to include tools.jar to
generate Javadocs as it is included in all JDK distributions.
There is also juneau-doc/juneau-doc.jar which includes some binaries
like
1823 Defl:N 969 47% 01-12-2020 10:30 eedf49f6 org/apache/juneau/doc/internal/DocGenerator$Topics.class
11006 Defl:N 4855 56% 01-12-2020 10:30 fe85af9d org/apache/juneau/doc/internal/DocGenerator.class
This jar is also missing LICENSE/NOTICE but looks like it has been
generated by this very same build. Could this perhaps instead be a
Maven dependency from a previous release of Juneau?
It is also a convention that ASF source releases should not include
software binaries.
This is a blocking matter so I am afraid my vote is negative.
[+] git commit vs tag
[+] sha512 checksums correct
[+] git vs src zip (excess .DS_Store in git, now removed)
[+] LICENSE, NOTICE src
[ ] LICENSE, NOTICE bin
[+] mvn apache-rat:rat
[-] binaries in src distribution? (juneau-doc/tools.jar - what license?)
[ ] mvn clean install
[ ] bin vs built
[ ] mvn repo vs bin
[ ] mvn repo vs src
Tested with:
(base) stain@biggie:~$ lsb_release -d
Description: Ubuntu 18.04.3 LTS
(base) stain@biggie:~$ mvn --versionon
Apache Maven 3.6.0 (97c98ec64a1fdfee7767ce5ffb20918da4f719f3; 2018-10-24T19:41:47+01:00)
Maven home: /home/stain/software/maven
Java version: 11.0.5, vendor: Private Build, runtime: /usr/lib/jvm/java-11-openjdk-amd64
Default locale: en_GB, platform encoding: UTF-8
OS name: "linux", version: "4.15.0-74-generic", arch: "amd64", family: "unix"
On Sun, 12 Jan 2020 13:24:53 -0500, James Bognar <ja...@apache.org> wrote:
> I am pleased to be calling this vote for the source release of Apache
> Juneau 8.1.3 RC1.
>
> The binaries are available at:
> https://dist.apache.org/repos/dist/dev/juneau/binaries/juneau-8.1.3-RC1/
>
> The release candidate to be voted over is available at:
> https://dist.apache.org/repos/dist/dev/juneau/source/juneau-8.1.3-RC1/
>
> SHA-512 checksums:
> apache-juneau-8.1.3-src.zip:
> 48C13039 9573BD18 B4C11FB5 13AE8E9F 16D9AC16
> 450BCDEF AC2C1E51 E5E1EFD8 75ED0EAC 80398902
> 981C2846 56029A81 AC4BBF9D 7EB2AA8E 4D4B68F5
> B682399A
> apache-juneau-8.1.3-bin.zip:
> 78B63158 C556EB9B ED405BF0 7002C572 F8DA055A
> 407A198F FA7AEE3E 0C91F4CE 54F14260 99F478A4
> B12E122A 2C95C145 DBD4D49A AC277ECF 4860F5C3
> A5D3C0BD
>
> Build the release candidate using:
> mvn clean install
>
> The release candidate is signed with a GPG key available at:
> https://dist.apache.org/repos/dist/release/juneau/KEYS
>
> A staged Maven repository is available for review at:
> https://repository.apache.org/content/repositories/orgapachejuneau-1030/
>
> The Git commit for this release is...
> https://gitbox.apache.org/repos/asf?p=juneau.git;a=commit;h=d83c0392a39392717e32a491ee34edd2353f5446
>
> Please vote on releasing this package as:
> Apache Juneau 8.1.3
>
> This vote will be open until 16-Jan-2020 9:00am and passes if a
> majority of at least three +1 Apache Juneau PMC votes are cast.
>
> [ ] +1 Release this package
> [ ] 0 I don't feel strongly about it, but don't object
> [ ] -1 Do not release this package because...
>
> Anyone can participate in testing and voting, not just committers,
> please feel free to try out the release candidate and provide your
> votes.