You are viewing a plain text version of this content. The canonical link for it is here.
Posted to builds@apache.org by Emmanuel Lécharny <el...@symas.com> on 2018/04/30 16:02:27 UTC
Pb releasing apache directory LDAP API
Hi guys,
yesterday, I tried to cut a release of Apache Directory LDAP API 1.0.1.
It went well, but never hit Nexus.
Today, I tried to do a mvn deploy on the created tag, and now, it's
visible in Nexus (orgapachedirectory-1151) but I can't close it because
it complains about some missing .asc signatures :
Missing Signature:
'/org/apache/directory/api/api-asn1-api/1.0.1/api-asn1-api-1.0.1.jar.asc'
does not exist for 'api-asn1-api-1.0.1.jar'.
...
The .md5 and .sha1 signatures are present though.
The release is a pretty straightforward process that has been
established for almost a decade, and that worked just fine for tens of
releases... It's documented on
http://directory.staging.apache.org/api/developer-guide.html (Release
Process), but basically, it's all about doing :
mvn release:prepare -DdryRun=true
mvn deploy
mvn release:clean
mvn release:prepare
mvn release:perform
What could have gone wrong ?
Thanks !
Re: Pb releasing apache directory LDAP API
Posted by Emmanuel Lécharny <el...@gmail.com>.
Le 30/04/2018 à 23:29, Emmanuel Lécharny a écrit :
>
>
> Le 30/04/2018 à 23:05, Allen Wittenauer a écrit :
>>
>>> On Apr 30, 2018, at 9:02 AM, Emmanuel Lécharny <el...@symas.com> wrote:
>>>
>>> Missing Signature:
>>> '/org/apache/directory/api/api-asn1-api/1.0.1/api-asn1-api-1.0.1.jar.asc'
>>> does not exist for 'api-asn1-api-1.0.1.jar'.
>>> ...
>>>
>>>
>>> The .md5 and .sha1 signatures are present though.
>>
>> asc files are PGP signature files.
>>
>>> What could have gone wrong ?
>>
>> Are the directions missing -Papache-release or gpg:sign?
>
> I never had to specifically gives such direction : they are implicit.
>
> The LDAP API project inherits from apache 18 which is used when
> releasing a project, using the apache-release profile.
>
> gpg:sign is also supposed to be invoked automatically when doing a
> release:perform, it's configured as so in the apache parent pom.
>
>
> Now, are you suggesting I run mvn deploy -Papache-release ?
Seems like it's needed when running mvn deploy, otherwise the .asc files
never get created...
Still, that does not explain why the standard mvn release:perform never
pushed the packages into nexus (the previous release, 1.0.0, worked like
a charm following the exact same procedure, and the changes from 1.0.0
to 1.0.1 are really minimalistic, plus the various poms haven't been
changed except the scm tag which has been changed from svn to git.
Quite a mystery...
As a matter of fact, while running a mvn deploy -Papache-release, I just
got this warning :
...
Downloading:
https://repository.apache.org/service/local/staging/deploy/maven2/org/apache/directory/api/api-all/maven-metadata.xml
[WARNING] Could not transfer metadata
org.apache.directory.api:api-all/maven-metadata.xml from/to
apache.releases.https
(https://repository.apache.org/service/local/staging/deploy/maven2):
Connect to repository.apache.org:443
[repository.apache.org/207.244.88.140] failed: Operation timed out
(Connection timed out)
...
and the process stopped with an error. The previous packages were
correctly pushed to nexus, though (except that when I tried to close the
staging repo, it told me that there were 2 missing signature, one md5
and one sha1...)
There is something fishy.
--
Emmanuel Lecharny
Symas.com
directory.apache.org
Re: Pb releasing apache directory LDAP API
Posted by Emmanuel Lécharny <el...@gmail.com>.
Le 30/04/2018 à 23:05, Allen Wittenauer a écrit :
>
>> On Apr 30, 2018, at 9:02 AM, Emmanuel Lécharny <el...@symas.com> wrote:
>>
>> Missing Signature:
>> '/org/apache/directory/api/api-asn1-api/1.0.1/api-asn1-api-1.0.1.jar.asc'
>> does not exist for 'api-asn1-api-1.0.1.jar'.
>> ...
>>
>>
>> The .md5 and .sha1 signatures are present though.
>
> asc files are PGP signature files.
>
>> What could have gone wrong ?
>
> Are the directions missing -Papache-release or gpg:sign?
I never had to specifically gives such direction : they are implicit.
The LDAP API project inherits from apache 18 which is used when
releasing a project, using the apache-release profile.
gpg:sign is also supposed to be invoked automatically when doing a
release:perform, it's configured as so in the apache parent pom.
Now, are you suggesting I run mvn deploy -Papache-release ?
--
Emmanuel Lecharny
Symas.com
directory.apache.org
Re: Pb releasing apache directory LDAP API
Posted by Allen Wittenauer <aw...@effectivemachines.com>.
> On Apr 30, 2018, at 9:02 AM, Emmanuel Lécharny <el...@symas.com> wrote:
>
> Missing Signature:
> '/org/apache/directory/api/api-asn1-api/1.0.1/api-asn1-api-1.0.1.jar.asc'
> does not exist for 'api-asn1-api-1.0.1.jar'.
> ...
>
>
> The .md5 and .sha1 signatures are present though.
asc files are PGP signature files.
> What could have gone wrong ?
Are the directions missing -Papache-release or gpg:sign?
Re: Pb releasing apache directory LDAP API
Posted by Emmanuel Lecharny <el...@apache.org>.
Currently, it seems that the packages are signed using PGP (if using
-Papache-release), MD5 and SHA1.
As requested, we don't release the binaries we generate with MD5, but that
is a manual signature, this has nothing to do with the way maven
release:perform does sign the packages. And, yes, it would be very valuable
to have a way to spacify that we don't want md5 or sha1 signatures, but
only pgp, SHA-256 or SHA-512. I don't know if this is an option in maven...
Bertrand Delacretaz raised the issue 2 weeks ago, IAFAIR.
On Mon, Apr 30, 2018 at 10:57 PM, Greg Stein <gs...@gmail.com> wrote:
> There has been discussion of updating the required hashes. Maybe that got
> implemented on Nexus? CC'ing peeps...
>
> On Mon, Apr 30, 2018, 13:17 Emmanuel Lécharny <el...@symas.com> wrote:
>
>> Hi guys,
>>
>> yesterday, I tried to cut a release of Apache Directory LDAP API 1.0.1.
>> It went well, but never hit Nexus.
>>
>> Today, I tried to do a mvn deploy on the created tag, and now, it's
>> visible in Nexus (orgapachedirectory-1151) but I can't close it because
>> it complains about some missing .asc signatures :
>>
>> Missing Signature:
>> '/org/apache/directory/api/api-asn1-api/1.0.1/api-asn1-api-1.0.1.jar.asc'
>> does not exist for 'api-asn1-api-1.0.1.jar'.
>> ...
>>
>>
>> The .md5 and .sha1 signatures are present though.
>>
>>
>> The release is a pretty straightforward process that has been
>> established for almost a decade, and that worked just fine for tens of
>> releases... It's documented on
>> http://directory.staging.apache.org/api/developer-guide.html (Release
>> Process), but basically, it's all about doing :
>>
>> mvn release:prepare -DdryRun=true
>> mvn deploy
>> mvn release:clean
>> mvn release:prepare
>> mvn release:perform
>>
>>
>> What could have gone wrong ?
>>
>> Thanks !
>>
>
--
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com
Re: Pb releasing apache directory LDAP API
Posted by tvmusicbangla <tv...@gmail.com>.
I am not understand, it was not using now
On Mon, Apr 30, 2018 at 1:57 PM, Greg Stein <gs...@gmail.com> wrote:
> There has been discussion of updating the required hashes. Maybe that got
> implemented on Nexus? CC'ing peeps...
>
> On Mon, Apr 30, 2018, 13:17 Emmanuel Lécharny <el...@symas.com> wrote:
>
> > Hi guys,
> >
> > yesterday, I tried to cut a release of Apache Directory LDAP API 1.0.1.
> > It went well, but never hit Nexus.
> >
> > Today, I tried to do a mvn deploy on the created tag, and now, it's
> > visible in Nexus (orgapachedirectory-1151) but I can't close it because
> > it complains about some missing .asc signatures :
> >
> > Missing Signature:
> > '/org/apache/directory/api/api-asn1-api/1.0.1/api-asn1-
> api-1.0.1.jar.asc'
> > does not exist for 'api-asn1-api-1.0.1.jar'.
> > ...
> >
> >
> > The .md5 and .sha1 signatures are present though.
> >
> >
> > The release is a pretty straightforward process that has been
> > established for almost a decade, and that worked just fine for tens of
> > releases... It's documented on
> > http://directory.staging.apache.org/api/developer-guide.html (Release
> > Process), but basically, it's all about doing :
> >
> > mvn release:prepare -DdryRun=true
> > mvn deploy
> > mvn release:clean
> > mvn release:prepare
> > mvn release:perform
> >
> >
> > What could have gone wrong ?
> >
> > Thanks !
> >
>
Re: Pb releasing apache directory LDAP API
Posted by Greg Stein <gs...@gmail.com>.
There has been discussion of updating the required hashes. Maybe that got
implemented on Nexus? CC'ing peeps...
On Mon, Apr 30, 2018, 13:17 Emmanuel Lécharny <el...@symas.com> wrote:
> Hi guys,
>
> yesterday, I tried to cut a release of Apache Directory LDAP API 1.0.1.
> It went well, but never hit Nexus.
>
> Today, I tried to do a mvn deploy on the created tag, and now, it's
> visible in Nexus (orgapachedirectory-1151) but I can't close it because
> it complains about some missing .asc signatures :
>
> Missing Signature:
> '/org/apache/directory/api/api-asn1-api/1.0.1/api-asn1-api-1.0.1.jar.asc'
> does not exist for 'api-asn1-api-1.0.1.jar'.
> ...
>
>
> The .md5 and .sha1 signatures are present though.
>
>
> The release is a pretty straightforward process that has been
> established for almost a decade, and that worked just fine for tens of
> releases... It's documented on
> http://directory.staging.apache.org/api/developer-guide.html (Release
> Process), but basically, it's all about doing :
>
> mvn release:prepare -DdryRun=true
> mvn deploy
> mvn release:clean
> mvn release:prepare
> mvn release:perform
>
>
> What could have gone wrong ?
>
> Thanks !
>