Release vote form - (was: single vote thread ...)

[Neil C Smith <ne...@apache.org>]

Moving questions out of the lazy consensus thread.

On Sat, 11 Feb 2023 at 01:51, Michael Bien <mb...@gmail.com> wrote:
> questions:

A few good points for thought - we will possibly tweak a little before
running the vote ... or feel free to edit ...

> The text mentions sig testing but there are no checkboxes for that. This creates an uncertainly whether or not someone read the manual or skipped to the boxes.

We've always had that problem, though.  Part of me thinks that if a
PMC member doesn't know what they're required to do before voting, we
have bigger issues .. :-)

But it might be useful to better spell it out for community, non-binding, votes.

Mind you, if you look at the OpenOffice vote, it's pretty much just
the check form and no instructions -
https://lists.apache.org/thread/kt1jwt6zzzc5koq3pgyvgd8qm8gx6omh

In some ways I like the succinctness.  We have more things to link to
- at least 4 different artefact locations - but we could move all the
instructions out of the email onto a web page?

> (also: should I try to automate the sig test in a manually triggered workflow?)

Possibly!  I'm not sure of the easiest way to do this.  We also have
code signing checks for Windows and macOS (along with notarization) to
verify.

There was some talk on infra@ a little while back about automated
testing of hashes and gpg signing on dist.a.o.  I think that used to
be in place.  We also have a shell script that we use in the release
process - https://dist.apache.org/repos/dist/dev/netbeans/testrelease.sh
 Someone other than the signing person running that might be good.

> those are very "catch-all". This could be anything between "i checked the welcome page" and "i opened some RL <insert language> projects and worked with the release for the rest of the day". Would a "what I tested" section be useful or is this just noise? Since I usually mentioned what I tested in past voting threads - if I don't have to do this anymore its fine with me of course.

Again, that's a problem we've always had.  I wouldn't say that's
noise, just prompting other voters to the level of checking they might
do?  We could add an additional info bit at the bottom that could be
optionally filled out?

It doesn't change the validity of votes, though, nor change the fact
that it's really that level of testing on RCs that's most useful.
Assuming we don't get any last minute major issue, 17-rc3 and 17 are
identical - I would hope most people on dev@ have already done the "i
opened some RL <insert language> projects and worked with the release
for the rest of the day" part!  And the "I've built from source" part
for that matter.  The vote is not the time to find problems there.

Best wishes,

Neil

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org

For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists

Re: Release vote form - (was: single vote thread ...)

[Neil C Smith <ne...@apache.org>]

On Sat, 18 Feb 2023 at 11:18, Antonio <an...@vieiro.net.invalid> wrote:
> Apologies for posting in the wrong thread.

No problem!  If we can keep discussion out of [NOTICE], [LAZY
CONSENSUS] and [VOTE] threads, then people can filter specifically on
those subject tags.  And by extension, hopefully not complain they
missed one! ;-)

> I think that adding instructions/a checklist in a wiki page is a great
> idea (things have many buttons now to press :-)).

I'd say the number of buttons hasn't changed, just they're a little
more in your face now! :-)

Speaking of which, on the PMC list we mentioned having a wider
discussion and feeding back on ASF release policy around binaries.
There were some inconsistencies, and some potential improvements that
could be made, particularly around binary verification and possibly
automating checks.  As is often the case, deadlines and lack of time
led to this being more of a "quick fix" for NB17.

Best wishes,

Neil

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org

For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists

Re: Release vote form - (was: single vote thread ...)

[Antonio <an...@vieiro.net.INVALID>]

Hi Neil, all,

Apologies for posting in the wrong thread.

I think that adding instructions/a checklist in a wiki page is a great 
idea (things have many buttons now to press :-)).

Thanks,
Antonio

On 18/2/23 10:37, Neil C Smith wrote:
> I think we should possibly extract the instructions into a wiki page
> we can link to anyway, and keep the email and response form short?

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org

For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists

Re: Release vote form - (was: single vote thread ...)

[Neil C Smith <ne...@apache.org>]

On Fri, 17 Feb 2023 at 20:27, Antonio <an...@vieiro.net.invalid> wrote:
> I have voted using the template, I think we should rephrase it somewhow.
> It's too verbose to clearly understand.

This I agree with, and as mentioned above it's interesting to compare
with the OpenOffice votes where we took a lead on the form -
https://lists.apache.org/thread/kt1jwt6zzzc5koq3pgyvgd8qm8gx6omh

The form was mainly just added to the end of the existing voting email
we have used for a long time.  That's been getting longer and longer!
Although it does cover (and has always covered) what you need to do in
the section above the form, including a checklist of steps for the
sources.

I think we should possibly extract the instructions into a wiki page
we can link to anyway, and keep the email and response form short?

> Maybe next time we want to clarify what are mandatory actions (should I
> check signatures of the main thing being voted on? Any others?) and
> optional ones.

Requirements for PMC (binding) votes and community ones are somewhat
different.  At least every PMC member voting should have read the ASF
release policy linked in the email at least once -
https://www.apache.org/legal/release-policy.html#management

Building and testing the sources, along with checking the signatures
of the sources, and ensuring the voter is happy with compliance on ASF
release rules (notice, license, no binary, etc.) is mandatory for a
binding vote.  Any PMC member vote without ticking that off will be
treated as non-binding.

From the above policy "Before voting +1 PMC members are required to
download the signed source code package, compile it as provided, and
test the resulting executable on their own platform, along with also
verifying that the package meets the requirements of the ASF policy on
releases."

We'd really appreciate community voters doing similar, but will still
count non-binding votes that don't - eg. just checking binaries.

For binaries, a PMC member ticking off one of those sections should
have checked signatures, done some check of functionality, and made
sure they're confident the binary is derived from the main source
artefact.

Again, from the above policy -  "Note that the PMC is responsible for
all artifacts in their distribution directory, which is a subdirectory
of downloads.apache.org ; and all artifacts placed in their directory
must be signed by a committer, preferably by a PMC member. It is also
necessary for the PMC to ensure that the source package is sufficient
to build any binary artifacts associated with the release."

Again, community voters checking binaries need not include all of those steps.

Best wishes,

Neil

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org

For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists

Re: Release vote form - (was: single vote thread ...)

[Michael Bien <mb...@gmail.com>]

On 11.02.23 11:24, Neil C Smith wrote:
>
>> The text mentions sig testing but there are no checkboxes for that. This creates an uncertainly whether or not someone read the manual or skipped to the boxes.
> We've always had that problem, though.  Part of me thinks that if a
> PMC member doesn't know what they're required to do before voting, we
> have bigger issues .. :-).

true.


> In some ways I like the succinctness.

learned a new word. I do like succinctness too!


>
> Again, that's a problem we've always had.  I wouldn't say that's
> noise, just prompting other voters to the level of checking they might
> do?  We could add an additional info bit at the bottom that could be
> optionally filled out?
>
> It doesn't change the validity of votes, though, nor change the fact
> that it's really that level of testing on RCs that's most useful.
> Assuming we don't get any last minute major issue, 17-rc3 and 17 are
> identical - I would hope most people on dev@ have already done the "i
> opened some RL <insert language> projects and worked with the release
> for the rest of the day" part!  And the "I've built from source" part
> for that matter.  The vote is not the time to find problems there.

good point! Although I do test the RCs a little bit, I usually run dev 
builds during rc phase due to various reasons (testing PRs etc).

I guess the reason I felt to have to test the VCs in past was because it 
feels a bit wrong to +1 something without testing it properly, no matter 
that it is (hopefully) identical to the final RC.


best regards,

michael


>
> Best wishes,
>
> Neil
>


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org

For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists