You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@zookeeper.apache.org by Andor Molnar <an...@apache.org> on 2024/10/08 21:32:26 UTC
[VOTE] Apache ZooKeeper release 3.9.3 candidate 1
This is a release candidate for 3.9.3. (rc1)
This is a bugfix release for the 3.9 release line. Includes important
dependency upgrades to address CVEs, several bug- and performance
fixes.
The full release notes is available at:
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310801&version=12354432
*** Please download, test and vote by October 15th 2024, 23:59 UTC+0.
***
Source files:
https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-1/
Maven staging repo:
https://repository.apache.org/content/groups/staging/org/apache/zookeeper/zookeeper/3.9.3/
The release candidate tag in git to be voted upon: release-3.9.3-1
https://github.com/apache/zookeeper/tree/release-3.9.3-1
ZooKeeper's KEYS file containing PGP keys we use to sign the release:
https://www.apache.org/dist/zookeeper/KEYS
The staging version of the website is:
https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-1/website/index.html
Should we release this candidate?
Andor
Re: [VOTE] Apache ZooKeeper release 3.9.3 candidate 1
Posted by Andor Molnar <an...@apache.org>.
I've created a Jira to address this:
https://issues.apache.org/jira/browse/ZOOKEEPER-4876
Andor
On Wed, 2024-10-16 at 17:35 -0500, Andor Molnar wrote:
> Thanks for the heads-up Pat. I take it as a -1.
>
> This vote is now cancelled and I'm creating another RC.
>
> Thanks,
> Andor
>
>
>
> On Wed, 2024-10-16 at 08:59 -0700, Patrick Hunt wrote:
> > FYI OWASP is failing, I think we should address this before
> > releasing:
> >
> > 15:55:28 [ERROR] jetty-http-9.4.53.v20231009.jar: CVE-2024-
> > 6763(3.7)
> >
> > Regards,
> >
> > Patrick
> >
> > On Wed, Oct 16, 2024 at 8:31 AM Damien Diederen
> > <dd...@apache.org> wrote:
> > >
> > > Hi Andor, all,
> > >
> > > I'm afraid I missed the deadline, but here is what I have:
> > >
> > > +1 (binding):
> > >
> > > * Tarball contents match repository tag;
> > >
> > > * Verified checksums and signatures;
> > >
> > > * Built and smoke-tested on NixOS with a slightly adapted
> > > version
> > > of
> > > the Nix recipe and test case;
> > >
> > > * Smoke-tested a standalone server with the (corresponding)
> > > Java,
> > > C
> > > and Perl clients, as well as the zkfuse contrib;
> > >
> > > * Smoke-tested a 3-ensemble with the (corresponding) Java
> > > client
> > > and
> > > SASL/GSSAPI.
> > >
> > > All in all: LGTM. Thank you for taking care of this release!
> > >
> > > Cheers,
> > > Damien
> > >
> > >
> > >
> > > Andor Molnar <an...@apache.org> writes:
> > > > This is a release candidate for 3.9.3. (rc1)
> > > >
> > > > This is a bugfix release for the 3.9 release line. Includes
> > > > important
> > > > dependency upgrades to address CVEs, several bug- and
> > > > performance
> > > > fixes.
> > > >
> > > > The full release notes is available at:
> > > >
> > > > https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310801&version=12354432
> > > >
> > > > *** Please download, test and vote by October 15th 2024, 23:59
> > > > UTC+0.
> > > > ***
> > > >
> > > > Source files:
> > > > https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-1/
> > > >
> > > > Maven staging repo:
> > > > https://repository.apache.org/content/groups/staging/org/apache/zookeeper/zookeeper/3.9.3/
> > > >
> > > > The release candidate tag in git to be voted upon: release-
> > > > 3.9.3-
> > > > 1
> > > > https://github.com/apache/zookeeper/tree/release-3.9.3-1
> > > >
> > > > ZooKeeper's KEYS file containing PGP keys we use to sign the
> > > > release:
> > > > https://www.apache.org/dist/zookeeper/KEYS
> > > >
> > > > The staging version of the website is:
> > > > https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-1/website/index.html
> > > >
> > > >
> > > > Should we release this candidate?
> > > >
> > > > Andor
>
Re: [VOTE] Apache ZooKeeper release 3.9.3 candidate 1
Posted by Andor Molnar <an...@apache.org>.
Thanks for the heads-up Pat. I take it as a -1.
This vote is now cancelled and I'm creating another RC.
Thanks,
Andor
On Wed, 2024-10-16 at 08:59 -0700, Patrick Hunt wrote:
> FYI OWASP is failing, I think we should address this before
> releasing:
>
> 15:55:28 [ERROR] jetty-http-9.4.53.v20231009.jar: CVE-2024-6763(3.7)
>
> Regards,
>
> Patrick
>
> On Wed, Oct 16, 2024 at 8:31 AM Damien Diederen
> <dd...@apache.org> wrote:
> >
> > Hi Andor, all,
> >
> > I'm afraid I missed the deadline, but here is what I have:
> >
> > +1 (binding):
> >
> > * Tarball contents match repository tag;
> >
> > * Verified checksums and signatures;
> >
> > * Built and smoke-tested on NixOS with a slightly adapted version
> > of
> > the Nix recipe and test case;
> >
> > * Smoke-tested a standalone server with the (corresponding) Java,
> > C
> > and Perl clients, as well as the zkfuse contrib;
> >
> > * Smoke-tested a 3-ensemble with the (corresponding) Java client
> > and
> > SASL/GSSAPI.
> >
> > All in all: LGTM. Thank you for taking care of this release!
> >
> > Cheers,
> > Damien
> >
> >
> >
> > Andor Molnar <an...@apache.org> writes:
> > > This is a release candidate for 3.9.3. (rc1)
> > >
> > > This is a bugfix release for the 3.9 release line. Includes
> > > important
> > > dependency upgrades to address CVEs, several bug- and performance
> > > fixes.
> > >
> > > The full release notes is available at:
> > >
> > > https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310801&version=12354432
> > >
> > > *** Please download, test and vote by October 15th 2024, 23:59
> > > UTC+0.
> > > ***
> > >
> > > Source files:
> > > https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-1/
> > >
> > > Maven staging repo:
> > > https://repository.apache.org/content/groups/staging/org/apache/zookeeper/zookeeper/3.9.3/
> > >
> > > The release candidate tag in git to be voted upon: release-3.9.3-
> > > 1
> > > https://github.com/apache/zookeeper/tree/release-3.9.3-1
> > >
> > > ZooKeeper's KEYS file containing PGP keys we use to sign the
> > > release:
> > > https://www.apache.org/dist/zookeeper/KEYS
> > >
> > > The staging version of the website is:
> > > https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-1/website/index.html
> > >
> > >
> > > Should we release this candidate?
> > >
> > > Andor
Re: [VOTE] Apache ZooKeeper release 3.9.3 candidate 1
Posted by Patrick Hunt <ph...@apache.org>.
FYI OWASP is failing, I think we should address this before releasing:
15:55:28 [ERROR] jetty-http-9.4.53.v20231009.jar: CVE-2024-6763(3.7)
Regards,
Patrick
On Wed, Oct 16, 2024 at 8:31 AM Damien Diederen <dd...@apache.org>
wrote:
>
> Hi Andor, all,
>
> I'm afraid I missed the deadline, but here is what I have:
>
> +1 (binding):
>
> * Tarball contents match repository tag;
>
> * Verified checksums and signatures;
>
> * Built and smoke-tested on NixOS with a slightly adapted version of
> the Nix recipe and test case;
>
> * Smoke-tested a standalone server with the (corresponding) Java, C
> and Perl clients, as well as the zkfuse contrib;
>
> * Smoke-tested a 3-ensemble with the (corresponding) Java client and
> SASL/GSSAPI.
>
> All in all: LGTM. Thank you for taking care of this release!
>
> Cheers,
> Damien
>
>
>
> Andor Molnar <an...@apache.org> writes:
> > This is a release candidate for 3.9.3. (rc1)
> >
> > This is a bugfix release for the 3.9 release line. Includes important
> > dependency upgrades to address CVEs, several bug- and performance
> > fixes.
> >
> > The full release notes is available at:
> >
> >
> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310801&version=12354432
> >
> > *** Please download, test and vote by October 15th 2024, 23:59 UTC+0.
> > ***
> >
> > Source files:
> >
> https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-1/
> >
> > Maven staging repo:
> >
> https://repository.apache.org/content/groups/staging/org/apache/zookeeper/zookeeper/3.9.3/
> >
> > The release candidate tag in git to be voted upon: release-3.9.3-1
> > https://github.com/apache/zookeeper/tree/release-3.9.3-1
> >
> > ZooKeeper's KEYS file containing PGP keys we use to sign the release:
> > https://www.apache.org/dist/zookeeper/KEYS
> >
> > The staging version of the website is:
> >
> https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-1/website/index.html
> >
> >
> > Should we release this candidate?
> >
> > Andor
>
Re: [VOTE] Apache ZooKeeper release 3.9.3 candidate 1
Posted by Damien Diederen <dd...@apache.org>.
Hi Andor, all,
I'm afraid I missed the deadline, but here is what I have:
+1 (binding):
* Tarball contents match repository tag;
* Verified checksums and signatures;
* Built and smoke-tested on NixOS with a slightly adapted version of
the Nix recipe and test case;
* Smoke-tested a standalone server with the (corresponding) Java, C
and Perl clients, as well as the zkfuse contrib;
* Smoke-tested a 3-ensemble with the (corresponding) Java client and
SASL/GSSAPI.
All in all: LGTM. Thank you for taking care of this release!
Cheers,
Damien
Andor Molnar <an...@apache.org> writes:
> This is a release candidate for 3.9.3. (rc1)
>
> This is a bugfix release for the 3.9 release line. Includes important
> dependency upgrades to address CVEs, several bug- and performance
> fixes.
>
> The full release notes is available at:
>
> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310801&version=12354432
>
> *** Please download, test and vote by October 15th 2024, 23:59 UTC+0.
> ***
>
> Source files:
> https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-1/
>
> Maven staging repo:
> https://repository.apache.org/content/groups/staging/org/apache/zookeeper/zookeeper/3.9.3/
>
> The release candidate tag in git to be voted upon: release-3.9.3-1
> https://github.com/apache/zookeeper/tree/release-3.9.3-1
>
> ZooKeeper's KEYS file containing PGP keys we use to sign the release:
> https://www.apache.org/dist/zookeeper/KEYS
>
> The staging version of the website is:
> https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-1/website/index.html
>
>
> Should we release this candidate?
>
> Andor
Re: [VOTE] Apache ZooKeeper release 3.9.3 candidate 1
Posted by Szalay-Bekő Máté <sz...@gmail.com>.
+1 (binding)
I did the following tests for the release candidate:
- verified checksum and gpg signature of the artifacts
- I built the source code (incl. the C-client, using -Pfull-build) on
Ubuntu 22.04.4 using OpenJDK 8u402, maven 3.6.3 and GCC version 11.4.0
- all the unit tests passed on my machine (including the C client tests)
- I also built and executed unit tests for zkpython
- I also built the java code (without -Pfull-build) using other JDK
versions: 11.0.22, 17.0.10, 21.0.1 (but didn't run the tests this time,
just used 'clean install -DskipTests')
- checkstyle and spotbugs passed
- apache-rat passed
- owasp (CVE check) passed
- fatjar built
- I executed quick rolling-upgrade tests without SSL (using
https://github.com/symat/zk-rolling-upgrade-test):
- rolling upgrade from 3.6.4 to 3.9.3 RC1
- rolling upgrade from 3.7.2 to 3.9.3 RC1
- rolling upgrade from 3.8.3 to 3.9.3 RC1
- rolling upgrade from 3.8.4 to 3.9.3 RC1
- rolling upgrade from 3.9.2 to 3.9.3 RC1
- checked the uploaded documentation (
https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-1/website/
)
- compared generated release notes (
https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-1/website/releasenotes.html)
with Jira (
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310801&version=12354432
)
Best regards,
Máté
On Wed, Oct 9, 2024 at 4:04 AM Andor Molnar <an...@apache.org> wrote:
> This is a release candidate for 3.9.3. (rc1)
>
> This is a bugfix release for the 3.9 release line. Includes important
> dependency upgrades to address CVEs, several bug- and performance
> fixes.
>
> The full release notes is available at:
>
>
> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310801&version=12354432
>
> *** Please download, test and vote by October 15th 2024, 23:59 UTC+0.
> ***
>
> Source files:
>
> https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-1/
>
> Maven staging repo:
>
> https://repository.apache.org/content/groups/staging/org/apache/zookeeper/zookeeper/3.9.3/
>
> The release candidate tag in git to be voted upon: release-3.9.3-1
> https://github.com/apache/zookeeper/tree/release-3.9.3-1
>
> ZooKeeper's KEYS file containing PGP keys we use to sign the release:
> https://www.apache.org/dist/zookeeper/KEYS
>
> The staging version of the website is:
>
> https://dist.apache.org/repos/dist/dev/zookeeper/zookeeper-3.9.3-candidate-1/website/index.html
>
>
> Should we release this candidate?
>
> Andor
>
>