You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@flex.apache.org by Alex Harui <ah...@adobe.com> on 2014/06/17 09:35:13 UTC
[VOTE] Apache FlexJS 0.0.2 RC1
Hi,
This is vote for the second (0.0.2) release of Apache FlexJS.
The release candidate can be found here;
https://dist.apache.org/repos/dist/dev/flex/flexjs/0.0.2/rc1/
Before voting please review the section,"What are the ASF requirements on
approving a release?", at:
http://www.apache.org/dev/release.html#approving-a-release
At a minimum you would be expected to check that:
- MD5 and signed packages are correct
- README, RELEASE_NOTES, NOTICE and LICENSE files are all fine
- As this is the first release please carefully check the LICENSE and
NOTICE files
- That the build script completes successfully
- That you can compile and cross-compile a simple example using the SDK.
The source package is set up the same way as the repo. This means that
the results of the build are not the same as an IDE-compatible SDK. The
compiled source package can be used in combination with the FalconJX
source package to compile some of the sample applications.
The most convenient way to use the binary package is to install it via Ant
or the Installer. To use an Installer you must use InstallApacheFlex
version 3.1 or later which is still in release candidate status at this
time. You can get InstallApacheFlex 3.1 here:
https://dist.apache.org/repos/dist/dev/flex/installer/3.1/rc3/binaries/
Please vote to approve this release:
+1 Approve the release
-1 Veto the release (please provide specific comments to why)
This vote will be open for 72 hours or until a result can be called.
The vote passes if there is:
- At least 3 +1 votes from the PMC
- More positive votes than negative votes
Remember that this is an initial 'alpha-quality' release so I expect there
will be many bugs found. IMO the goal is not to try to find and fix bugs
in the RC, but to make sure we have the packaging right, and enough
functionality that folks will have some success trying to use it.
People who are not in PMC are also encouraged to test out the release and
vote, although their votes will not be binding, they can influence how the
PMC votes.
When voting please indicate what OS, IDE, Flash Player version and AIR
version you tested FlexUnit with.
There is an ant script that automates the common steps to validate a
release. Instead of individually downloading the package and signature
files, unzipping, etc, you can instead:
1) create an empty folder,
2) download into that folder this file:
https://dist.apache.org/repos/dist/dev/flex/falcon/0.0.2/rc1/ApproveFlexJS.
xml
3) run the script: ant -e -f ApproveFlexJS.xml -Drelease.version=0.0.2
-Drc=1
You will have to install Google Closure Linter and JSHint prior to running
the script.
Please put all discussion about this release in the DISCUSSION thread not
this VOTE thread.
Thanks,
Alex
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Justin Mclean <ju...@me.com>.
Hi,
> Link to the discussion, please?
There also the community building and social aspects of a release [1] (from the same thread), ie "Community over code".
Thanks,
Justin
1. http://mail-archives.apache.org/mod_mbox/www-legal-discuss/201405.mbox/%3cCE4928B9-22D5-456C-817C-85FAE66AC270@jaguNET.com%3e
AW: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Christofer Dutz <ch...@c-ware.de>.
Ok ... if this is really all needed, then I will pobably not be able to vote very much in the near future.
According to this list there's a lot of stuff you have to to. A lot of which at the moment I don't even know how to do. With the current pace of releases I would probably stop working on features and getting stuff done instead of actually doing things in that little spare time I am able to scrape from my post-work-life ;-)
Chris
________________________________________
Von: Erik de Bruin <er...@ixsoftware.nl>
Gesendet: Mittwoch, 18. Juni 2014 13:14
An: dev@flex.apache.org
Betreff: Re: [VOTE] Apache FlexJS 0.0.2 RC1
If the items on that list are what we're REQUIRED to check before voting,
than I agree that the script is a bad thing, but it also means all my votes
up to this point have been invalid.
If they are NOT required, I maintain my position that the script is a very
nice utility that allows me to efficiently do my due diligence when voting
and should definitely stay available.
EdB
On Wed, Jun 18, 2014 at 12:18 PM, Justin Mclean <ju...@classsoftware.com>
wrote:
> Hi,
>
> > Ok, back into constructive mode: what ISN'T in the script that should be
> > there to make it comply with your list of "a lot of other items"?
>
> Off top of my head - there's others.
>
> In general:
> - Check KEYS file
> - Copyright year in NOTICE is correct
> - double check wording in LICENCE and NOTICE is correct (there's a few
> older versions floating about)
> - Check that binary LICENSE and NOTICE are correct as these may be
> different to source release
> - RELEASE_NOTES contain correct list of fixed bugs
> - Check use of trademarks
> - Check headers on bundled software
> - Check compliance with licences of bundles software
> - Check if bundled software has a NOTICE file and that correctly reflected
> - Git tags need to match with source code in source package
> - Source package is named correctly
> - DISCLAIMER files has been removed if was in incubation
> - Check for unlicensed and binary files using the latest version of rat
> (and not using a given rat target)
> - Check images contain no trademark or copyrighted images
> - Check for font files and licences
>
> For the installer in particular (when I first raised this issue):
> - Check that it been signed correctly
> - Check it been compile with the correct version of AIR and Flex SDK
> - Check caching works
> - Check localisation works
> - Check performance over slow connection (usually a given for me)
> - SDK produced version numbers are correct
> - SDK produced RSL build number is correct
> - SDK xml files contain correct information / tokens expanded correctly
> - That the SDK is actually usable (sort of the most important one)
> - Compare generated SDK with git tag
>
> Justin
--
Ix Multimedia Software
Jan Luykenstraat 27
3521 VB Utrecht
T. 06-51952295
I. www.ixsoftware.nl
RE: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Logibérica - Paulo Esgaio <pe...@logiberica.com>.
[+1]
On 6/18/14 9:39 AM, "Justin Mclean" <ju...@classsoftware.com> wrote:
>
>> That said, in future vote threads, I will try to mention that
>> additional testing is encouraged.
>It should be more than encouraged, it should be mandatory!
>
>> Now can we get on to voting?
>If you agree with the above sure.
Well, the policy says "test", but doesn't define what that means. I don't think we can mandate what that means. As long as the PMC voter is happy with their set of tests, I think we have to accept that.
Now let's get on with the vote. Please?
-Alex
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Alex Harui <ah...@adobe.com>.
On 6/18/14 9:39 AM, "Justin Mclean" <ju...@classsoftware.com> wrote:
>
>> That said, in future vote threads, I will try to mention that additional
>> testing is encouraged.
>It should be more than encouraged, it should be mandatory!
>
>> Now can we get on to voting?
>If you agree with the above sure.
Well, the policy says "test", but doesn't define what that means. I don't
think we can mandate what that means. As long as the PMC voter is happy
with their set of tests, I think we have to accept that.
Now let's get on with the vote. Please?
-Alex
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,
> Back when our mentors were casting the binding votes that allowed us to do
> incubator releases, I believe they ran the minimal steps supported by the
> approval script.
From my experience on the incubator PMC, I'd say that Incubator releases can a bit more lenient as it is assumed they will fix the remaining issues before coming a TLP.
> The concern that the script will invite folks to do less testing is valid,
> but IMO, insulting to our fellow PMC members.
No insult was indented.
> That said, in future vote threads, I will try to mention that additional
> testing is encouraged.
It should be more than encouraged, it should be mandatory!
> Now can we get on to voting?
If you agree with the above sure.
Justin
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Alex Harui <ah...@adobe.com>.
Back when our mentors were casting the binding votes that allowed us to do
incubator releases, I believe they ran the minimal steps supported by the
approval script. If it was good enough for Apache then, I believe it is
good enough now. I made these scripts public so that fellow PMC members,
who wish to help the community by getting the latest software released,
can do so with the minimum effort and not put the validity of the vote at
risk. Remember how we used to see some quick +1 votes and worried that
the PMC member didn't check everything? This script tries to make sure
they did check the mimimum set of things to cast a valid vote.
The concern that the script will invite folks to do less testing is valid,
but IMO, insulting to our fellow PMC members. I think we elected good
people who can make the right call between how much optional testing they
need to perform and the risk to the project and foundation if we miss
something.
That said, in future vote threads, I will try to mention that additional
testing is encouraged. And if I forget please add to the discuss thread.
Now can we get on to voting?
-Alex
On 6/18/14 4:35 AM, "Justin Mclean" <ju...@classsoftware.com> wrote:
>Hi,
>
>IMO there a big gap between what minimally required for a valid release
>and what is a good release. A lot of Apache knowledge is not codified
>into rules or even guidelines. Please don't be put off testing a
>release, you certainly don't have to do everything I put on that list
>(and there's a few things I missed). The currently process sort of
>assumes that if enough people look at it and test it in different ways
>then most things will be caught most of the time. IMO reducing that to a
>simple script that only checks a few things means we'll miss stuff. I
>agree it's a useful tool, but it doesn't replace due diligence when
>voting on a release.
>
>Thanks,
>Justin
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,
IMO there a big gap between what minimally required for a valid release and what is a good release. A lot of Apache knowledge is not codified into rules or even guidelines. Please don't be put off testing a release, you certainly don't have to do everything I put on that list (and there's a few things I missed). The currently process sort of assumes that if enough people look at it and test it in different ways then most things will be caught most of the time. IMO reducing that to a simple script that only checks a few things means we'll miss stuff. I agree it's a useful tool, but it doesn't replace due diligence when voting on a release.
Thanks,
Justin
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Erik de Bruin <er...@ixsoftware.nl>.
If the items on that list are what we're REQUIRED to check before voting,
than I agree that the script is a bad thing, but it also means all my votes
up to this point have been invalid.
If they are NOT required, I maintain my position that the script is a very
nice utility that allows me to efficiently do my due diligence when voting
and should definitely stay available.
EdB
On Wed, Jun 18, 2014 at 12:18 PM, Justin Mclean <ju...@classsoftware.com>
wrote:
> Hi,
>
> > Ok, back into constructive mode: what ISN'T in the script that should be
> > there to make it comply with your list of "a lot of other items"?
>
> Off top of my head - there's others.
>
> In general:
> - Check KEYS file
> - Copyright year in NOTICE is correct
> - double check wording in LICENCE and NOTICE is correct (there's a few
> older versions floating about)
> - Check that binary LICENSE and NOTICE are correct as these may be
> different to source release
> - RELEASE_NOTES contain correct list of fixed bugs
> - Check use of trademarks
> - Check headers on bundled software
> - Check compliance with licences of bundles software
> - Check if bundled software has a NOTICE file and that correctly reflected
> - Git tags need to match with source code in source package
> - Source package is named correctly
> - DISCLAIMER files has been removed if was in incubation
> - Check for unlicensed and binary files using the latest version of rat
> (and not using a given rat target)
> - Check images contain no trademark or copyrighted images
> - Check for font files and licences
>
> For the installer in particular (when I first raised this issue):
> - Check that it been signed correctly
> - Check it been compile with the correct version of AIR and Flex SDK
> - Check caching works
> - Check localisation works
> - Check performance over slow connection (usually a given for me)
> - SDK produced version numbers are correct
> - SDK produced RSL build number is correct
> - SDK xml files contain correct information / tokens expanded correctly
> - That the SDK is actually usable (sort of the most important one)
> - Compare generated SDK with git tag
>
> Justin
--
Ix Multimedia Software
Jan Luykenstraat 27
3521 VB Utrecht
T. 06-51952295
I. www.ixsoftware.nl
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,
> Ok, back into constructive mode: what ISN'T in the script that should be
> there to make it comply with your list of "a lot of other items"?
Off top of my head - there's others.
In general:
- Check KEYS file
- Copyright year in NOTICE is correct
- double check wording in LICENCE and NOTICE is correct (there's a few older versions floating about)
- Check that binary LICENSE and NOTICE are correct as these may be different to source release
- RELEASE_NOTES contain correct list of fixed bugs
- Check use of trademarks
- Check headers on bundled software
- Check compliance with licences of bundles software
- Check if bundled software has a NOTICE file and that correctly reflected
- Git tags need to match with source code in source package
- Source package is named correctly
- DISCLAIMER files has been removed if was in incubation
- Check for unlicensed and binary files using the latest version of rat (and not using a given rat target)
- Check images contain no trademark or copyrighted images
- Check for font files and licences
For the installer in particular (when I first raised this issue):
- Check that it been signed correctly
- Check it been compile with the correct version of AIR and Flex SDK
- Check caching works
- Check localisation works
- Check performance over slow connection (usually a given for me)
- SDK produced version numbers are correct
- SDK produced RSL build number is correct
- SDK xml files contain correct information / tokens expanded correctly
- That the SDK is actually usable (sort of the most important one)
- Compare generated SDK with git tag
Justin
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Erik de Bruin <er...@ixsoftware.nl>.
>
> As I have clearly stated I have no issue is the script, it is a useful
> tool. The danger is that it is used for the sole reason for voting +1 on
> releases and that IMO doesn't provide enough PMC oversight. While there a
> minimal set of things requited to vote +1 on a release there are a lot of
> other items that make a release a good one.
Ok, back into constructive mode: what ISN'T in the script that should be
there to make it comply with your list of "a lot of other items"?
EdB
--
Ix Multimedia Software
Jan Luykenstraat 27
3521 VB Utrecht
T. 06-51952295
I. www.ixsoftware.nl
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,
> I resent your threat to block this vote by vetoing the commit of a utility script.
It is in no way a "threat" as you put it. With my PMC hat on I have concerns about this approach and also how it was introduced without review or discussion or vote. As per our guidelines any PMC member or committer can veto a checkin if they have a good reason.
Anything that changes or effects how people vote on a release needs to be looked at very carefully and discussed not just blindly accepted. As PMC members it is our responsibility to look out for anything like this. Yes I would rather spend my time writing code/fixing bugs but as a PMC member there other responsibilities I also need to consider.
As I have clearly stated I have no issue is the script, it is a useful tool. The danger is that it is used for the sole reason for voting +1 on releases and that IMO doesn't provide enough PMC oversight. While there a minimal set of things requited to vote +1 on a release there are a lot of other items that make a release a good one.
Justin
AW: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Christofer Dutz <ch...@c-ware.de>.
I too agree, that having a script that GUIDES me through the process sounds like a really good thing to have.
Currently I personally haven't been voting much, cause I am working on completely other things and I didn't want to do anything wrong. Having some guidance here will definitely encourage me to do more voting in the near future.
So my +1 for the guiadance script.
Chris
________________________________________
Von: Erik de Bruin <er...@ixsoftware.nl>
Gesendet: Mittwoch, 18. Juni 2014 11:02
An: dev@flex.apache.org
Betreff: Re: [VOTE] Apache FlexJS 0.0.2 RC1
Weird. We must be running different scripts.
The one I'm looking at just steps me through the process, asking for my
input when needed to make sure I have done my due diligence. It doesn't
just automatically run through the steps before exiting with: "all seems
well, please vote +1".
Nor does it say anywhere that I'm obliged to use this script if I want to
vote. It's a utility, not a mandatory tool. And I think it's a very helpful
utility.
I resent your threat to block this vote by vetoing the commit of a utility
script. Unless you're using this issue to prove my points about
legal/procedural stuff stifling the project, I beg you to put your time and
energy into something positive like fixing bugs or adding features.
EdB
On Wed, Jun 18, 2014 at 10:39 AM, Justin Mclean <ju...@classsoftware.com>
wrote:
> Hi,
>
> > Did you actually look at the script and run it?
>
> Yes was the first thing I did - hence my concerns.
>
> Justin
>
--
Ix Multimedia Software
Jan Luykenstraat 27
3521 VB Utrecht
T. 06-51952295
I. www.ixsoftware.nl
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Erik de Bruin <er...@ixsoftware.nl>.
Weird. We must be running different scripts.
The one I'm looking at just steps me through the process, asking for my
input when needed to make sure I have done my due diligence. It doesn't
just automatically run through the steps before exiting with: "all seems
well, please vote +1".
Nor does it say anywhere that I'm obliged to use this script if I want to
vote. It's a utility, not a mandatory tool. And I think it's a very helpful
utility.
I resent your threat to block this vote by vetoing the commit of a utility
script. Unless you're using this issue to prove my points about
legal/procedural stuff stifling the project, I beg you to put your time and
energy into something positive like fixing bugs or adding features.
EdB
On Wed, Jun 18, 2014 at 10:39 AM, Justin Mclean <ju...@classsoftware.com>
wrote:
> Hi,
>
> > Did you actually look at the script and run it?
>
> Yes was the first thing I did - hence my concerns.
>
> Justin
>
--
Ix Multimedia Software
Jan Luykenstraat 27
3521 VB Utrecht
T. 06-51952295
I. www.ixsoftware.nl
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,
> Did you actually look at the script and run it?
Yes was the first thing I did - hence my concerns.
Justin
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Erik de Bruin <er...@ixsoftware.nl>.
Did you actually look at the script and run it?
It's like a wizard that steps you through the process rather than an
automation of the process itself. It doesn't try take any responsibility
away from the voter, quite the opposite actually: it makes sure the voter
doesn't skip any part of the process.
And above all, it's just a utility, not a mandatory tool.
Justin, this is exactly what we've been talking about on private@:
unnecessary procedural stuff holding up the project. Let it be and let's
move on.
EdB
On Wed, Jun 18, 2014 at 10:06 AM, Justin Mclean <ju...@classsoftware.com>
wrote:
> Hi,
>
> > Meanwhile, using the script or otherwise, can we vote on these packages?
>
> Currently I'm considering if I should the veto the checkin(s) or not.
> - This approach was not discussed on the mailing list before being
> introduced
> - I'm not convinced that the script is enough to provide proper PMC
> oversight
> - There's a temptation to just use the script as the sole means to vote on
> releases
>
> Thanks,
> Justin
>
>
--
Ix Multimedia Software
Jan Luykenstraat 27
3521 VB Utrecht
T. 06-51952295
I. www.ixsoftware.nl
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,
> Meanwhile, using the script or otherwise, can we vote on these packages?
Currently I'm considering if I should the veto the checkin(s) or not.
- This approach was not discussed on the mailing list before being introduced
- I'm not convinced that the script is enough to provide proper PMC oversight
- There's a temptation to just use the script as the sole means to vote on releases
Thanks,
Justin
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Alex Harui <ah...@adobe.com>.
On 6/17/14 2:46 PM, "Justin Mclean" <ju...@classsoftware.com> wrote:
>Hi,
>
>>> At the very least this should of been discussed (and perhaps VOTEed on)
>>> before being implemented in 2 releases.
>> I don't think there is anything to discuss and vote on as long as it
>> doesn't violate policy. Nobody has to use it. I'm just offering it up
>>as
>> a convenience.
>
>It has already been used as the sole basis to cast a binding vote. Your
>vote email(s) don't give the impression is it optional, but in fact it is
>preferred.
My email says "can", not "must". And I think it is clear now that it is
optional.
>
>IMO Not discussing this in the open before implementing it and now
>putting in yet another vote before it being the issue resolved is not
>really community minded.
I'm sorry you feel that way. If others concur I will email an apology.
Meanwhile, using the script or otherwise, can we vote on these packages?
-Alex
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,
>> At the very least this should of been discussed (and perhaps VOTEed on)
>> before being implemented in 2 releases.
> I don't think there is anything to discuss and vote on as long as it
> doesn't violate policy. Nobody has to use it. I'm just offering it up as
> a convenience.
It has already been used as the sole basis to cast a binding vote. Your vote email(s) don't give the impression is it optional, but in fact it is preferred.
IMO Not discussing this in the open before implementing it and now putting in yet another vote before it being the issue resolved is not really community minded.
Justin
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Alex Harui <ah...@adobe.com>.
On 6/17/14 10:29 AM, "Justin Mclean" <ju...@classsoftware.com> wrote:
>Hi,
>
>> I followed these threads as they happened. I have not gone back and
>> reviewed them, but my takeaway was this: A PMC cannot not use the
>>output
>> of a tool to determine the correctness of a release package because the
>> determination of the correctness of LICENSE and NOTICE and the headers
>> cannot be infallibly done by software.
>
>That's my meaning as well. Of course you don't have to manually type
>everything, but the files headers, LICENSE and NOTICE need to be checked
>manually not via a script. Also each PMC member should be free to check
>the release how they want , IMO multiple methods == more chance an error
>is caught.
>
>So you would agree that in this case Peter's vote is invalid as he only
>run the script and pasted the output of that into the vote? Sorry Peter,
>I don't mean to single you out, but it does illustrate the danger of
>using a script to validate releases.
No, the script stops and asks him to read the text of the notice files.
Which he did.
>
>Tools like you script and rat help with validating releases but are not a
>replacement for manual checks. I think your script is useful and helpful
>but it can't be the sole reason for voting +1.
Hmm. What step from policy is not in the script? It is the steps I
perform when I vote.
>
>> This script only downloads the artifacts, runs gpg to dump the sig and
>> makes sure it matches, then dumps the rat report and each notice file to
>> the console and asks you to decide on its correctness
>
>IMO That's a little misleading are you need to look at the source (and
>perhaps the source of dependancies) in conjunction with NOTICE/LICENSE to
>see if they are correct.
What do you look for in the source and how do you do it? I run Rat which
the script does, and try to watch commits@, but I don't read every source
file before voting. I don't see that mandated by policy either.
>
>IMO the script should ask you to manually check the headers, LICENSE and
>NOTICE and not prompt you for a y/n. There's to much temptation to say it
>all looks good and just to hit "Y'.
It does ask you to check what was dumped to the console and even offers
reminders of what to look for. I don't see how that is any more error
prone than bringing up the file in an editor. I can skim the file in an
editor just as easily.
>
>> I will post a [MENTOR] thread on private@ to try to get Dave Fisher's
>>attention.
>Feel free but I don't think that requires mentor attention, we as a PMC
>should be able to sort this out.
>
>At the very least this should of been discussed (and perhaps VOTEed on)
>before being implemented in 2 releases.
I don't think there is anything to discuss and vote on as long as it
doesn't violate policy. Nobody has to use it. I'm just offering it up as
a convenience.
-Alex
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,
Sorry Peter again didn't mean to single you out, just trying to illustrate a point.
> I think tools which make it easier to validate will encourage people to
> participate more.
Again I agree here, if it gets people looking at released and understanding the process that great. But PMC binding votes need a bit more care.
> If my vote is invalid than validating manually will not change that.
IMO Having a new voting method that hasn't been discussed / voted upon does muddy the water a little.
Justin
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Peter Ent <pe...@adobe.com>.
I ran the script twice; the first to verify that it worked and on the
second run, read every word that it produced. Some of it I didn't know the
rightness or wrongness of the statements, so that, to me, makes my vote
not quite as valid. But then I would imagine that most people who vote are
not 100% certain if everything is correct. I can tell if it is clear and
logical, which I believe it to be true.
I think tools which make it easier to validate will encourage people to
participate more. If the task is arduous, then more people will just leave
the decision in the hands of a few.
If my vote is invalid than validating manually will not change that.
--peter
On 6/17/14 1:29 PM, "Justin Mclean" <ju...@classsoftware.com> wrote:
>Hi,
>
>> I followed these threads as they happened. I have not gone back and
>> reviewed them, but my takeaway was this: A PMC cannot not use the
>>output
>> of a tool to determine the correctness of a release package because the
>> determination of the correctness of LICENSE and NOTICE and the headers
>> cannot be infallibly done by software.
>
>That's my meaning as well. Of course you don't have to manually type
>everything, but the files headers, LICENSE and NOTICE need to be checked
>manually not via a script. Also each PMC member should be free to check
>the release how they want , IMO multiple methods == more chance an error
>is caught.
>
>So you would agree that in this case Peter's vote is invalid as he only
>run the script and pasted the output of that into the vote? Sorry Peter,
>I don't mean to single you out, but it does illustrate the danger of
>using a script to validate releases.
>
>Tools like you script and rat help with validating releases but are not a
>replacement for manual checks. I think your script is useful and helpful
>but it can't be the sole reason for voting +1.
>
>> This script only downloads the artifacts, runs gpg to dump the sig and
>> makes sure it matches, then dumps the rat report and each notice file to
>> the console and asks you to decide on its correctness
>
>IMO That's a little misleading are you need to look at the source (and
>perhaps the source of dependancies) in conjunction with NOTICE/LICENSE to
>see if they are correct.
>
>IMO the script should ask you to manually check the headers, LICENSE and
>NOTICE and not prompt you for a y/n. There's to much temptation to say it
>all looks good and just to hit "Y'.
>
>> I will post a [MENTOR] thread on private@ to try to get Dave Fisher's
>>attention.
>Feel free but I don't think that requires mentor attention, we as a PMC
>should be able to sort this out.
>
>At the very least this should of been discussed (and perhaps VOTEed on)
>before being implemented in 2 releases.
>
>Thanks,
>Justin
>
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,
> I followed these threads as they happened. I have not gone back and
> reviewed them, but my takeaway was this: A PMC cannot not use the output
> of a tool to determine the correctness of a release package because the
> determination of the correctness of LICENSE and NOTICE and the headers
> cannot be infallibly done by software.
That's my meaning as well. Of course you don't have to manually type everything, but the files headers, LICENSE and NOTICE need to be checked manually not via a script. Also each PMC member should be free to check the release how they want , IMO multiple methods == more chance an error is caught.
So you would agree that in this case Peter's vote is invalid as he only run the script and pasted the output of that into the vote? Sorry Peter, I don't mean to single you out, but it does illustrate the danger of using a script to validate releases.
Tools like you script and rat help with validating releases but are not a replacement for manual checks. I think your script is useful and helpful but it can't be the sole reason for voting +1.
> This script only downloads the artifacts, runs gpg to dump the sig and
> makes sure it matches, then dumps the rat report and each notice file to
> the console and asks you to decide on its correctness
IMO That's a little misleading are you need to look at the source (and perhaps the source of dependancies) in conjunction with NOTICE/LICENSE to see if they are correct.
IMO the script should ask you to manually check the headers, LICENSE and NOTICE and not prompt you for a y/n. There's to much temptation to say it all looks good and just to hit "Y'.
> I will post a [MENTOR] thread on private@ to try to get Dave Fisher's attention.
Feel free but I don't think that requires mentor attention, we as a PMC should be able to sort this out.
At the very least this should of been discussed (and perhaps VOTEed on) before being implemented in 2 releases.
Thanks,
Justin
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Alex Harui <ah...@adobe.com>.
I followed these threads as they happened. I have not gone back and
reviewed them, but my takeaway was this: A PMC cannot not use the output
of a tool to determine the correctness of a release package because the
determination of the correctness of LICENSE and NOTICE and the headers
cannot be infallibly done by software.
Policy does not say that we cannot use a script to skip on having to
manually type all of what you would normally type on the command line to
validate a release, and I don't recall anything in these long threads
saying that either, in fact, my takeaway was that lots of folks were doing
that and it was acceptable. If you have a specific post that shows how
policy prevents that, please provide a link.
This script only downloads the artifacts, runs gpg to dump the sig and
makes sure it matches, then dumps the rat report and each notice file to
the console and asks you to decide on its correctness, then launches a
build and any tests the build script runs.
Could there be a bug in the script? Sure, but when checking manually I can
also mis-type which NOTICE file I look at. And you are encouraged to
examine the script itself if you are concerned about its correctness. And
of course, you are not required to use the script.
If you have further concerns about the validity of scripts in the release
checking process, I will post a [MENTOR] thread on private@ to try to get
Dave Fisher's attention. At ApacheCon (which was before these long
threads) we discussed use of scripts and he did not say they were not
allowed, and even asked for a copy of the script I had at the time. I'd
rather do that before going back to legal-discuss and waking up these
threads again.
-Alex
On 6/17/14 2:10 AM, "Justin Mclean" <ju...@classsoftware.com> wrote:
>HI,
>
>> Link to the discussion, please?
>
>Been several - they are quite long - the 3rd one is probably the most
>relevant.
>1.
>http://mail-archives.apache.org/mod_mbox/www-legal-discuss/201405.mbox/%3c
>CAAS6=7jTVyaDhwepAqob-=83DxJ-uaMS9GyG5j5XdHYybvAtGQ@mail.gmail.com%3e
>2.http://mail-archives.apache.org/mod_mbox/www-legal-discuss/201405.mbox/%
>3cCAAS6=7hMsjJ1ATztOyeE_QNdPpQvvsxmx58vWrCqug1po2OGEQ@mail.gmail.com%3e
>3.
>http://mail-archives.apache.org/mod_mbox/www-legal-discuss/201405.mbox/%3c
>CAOFYJNaqACY-JXUesx-V0PnsiCCkfVo_xKdEMO-N5Nt7Y_JTFQ@mail.gmail.com%3e
>
>A release is "a legal act guarded by responsible oversight" [1] and
>automating that means we lose the oversight, and "until the policy is
>changed, PMCs and RMs are expected and *required* to comply." [2]. Worse
>case the board will do this [3].
>
>The script are certainly useful as a double check but IMO should not be
>use used as the sole reason to vote +1. At the very least we need to have
>a discussion re this method of checking release and a VOTE on it before
>introducing it. Given the legal ramifications (and our limited legal
>understanding) IMO we should err of the side of caution.
>
>Thanks,
>Justin
>
>1.
>http://mail-archives.apache.org/mod_mbox/www-legal-discuss/201405.mbox/%3c
>6F8EDB3F-12C5-4D0C-A379-E9AB4F99F391@jaguNET.com%3e
>2.
>http://mail-archives.apache.org/mod_mbox/www-legal-discuss/201405.mbox/%3c
>47681A1F-924F-496F-8209-46EF3EDB7F02@jaguNET.com%3e
>3.
>http://mail-archives.apache.org/mod_mbox/www-legal-discuss/201405.mbox/%3c
>80083BE7-9F6C-43DC-A97F-9AED674C9B98@jaguNET.com%3e
>
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Justin Mclean <ju...@classsoftware.com>.
HI,
> Link to the discussion, please?
Been several - they are quite long - the 3rd one is probably the most relevant.
1. http://mail-archives.apache.org/mod_mbox/www-legal-discuss/201405.mbox/%3cCAAS6=7jTVyaDhwepAqob-=83DxJ-uaMS9GyG5j5XdHYybvAtGQ@mail.gmail.com%3e
2.http://mail-archives.apache.org/mod_mbox/www-legal-discuss/201405.mbox/%3cCAAS6=7hMsjJ1ATztOyeE_QNdPpQvvsxmx58vWrCqug1po2OGEQ@mail.gmail.com%3e
3. http://mail-archives.apache.org/mod_mbox/www-legal-discuss/201405.mbox/%3cCAOFYJNaqACY-JXUesx-V0PnsiCCkfVo_xKdEMO-N5Nt7Y_JTFQ@mail.gmail.com%3e
A release is "a legal act guarded by responsible oversight" [1] and automating that means we lose the oversight, and "until the policy is changed, PMCs and RMs are expected and *required* to comply." [2]. Worse case the board will do this [3].
The script are certainly useful as a double check but IMO should not be use used as the sole reason to vote +1. At the very least we need to have a discussion re this method of checking release and a VOTE on it before introducing it. Given the legal ramifications (and our limited legal understanding) IMO we should err of the side of caution.
Thanks,
Justin
1. http://mail-archives.apache.org/mod_mbox/www-legal-discuss/201405.mbox/%3c6F8EDB3F-12C5-4D0C-A379-E9AB4F99F391@jaguNET.com%3e
2. http://mail-archives.apache.org/mod_mbox/www-legal-discuss/201405.mbox/%3c47681A1F-924F-496F-8209-46EF3EDB7F02@jaguNET.com%3e
3. http://mail-archives.apache.org/mod_mbox/www-legal-discuss/201405.mbox/%3c80083BE7-9F6C-43DC-A97F-9AED674C9B98@jaguNET.com%3e
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by OmPrakash Muppirala <bi...@gmail.com>.
On Jun 17, 2014 12:51 AM, "Justin Mclean" <ju...@classsoftware.com> wrote:
>
> Hi,
>
> > There is an ant script that automates the common steps to validate a
> > release. Instead of individually downloading the package and signature
> > files, unzipping, etc, you can instead:
> > 1) create an empty folder,
> > 2) download into that folder this file:
> >
https://dist.apache.org/repos/dist/dev/flex/falcon/0.0.2/rc1/ApproveFlexJS.
> > xml
> > 3) run the script: ant -e -f ApproveFlexJS.xml -Drelease.version=0.0.2
> > -Drc=1
>
> Again this is against Apache policy - releases must be manually checked,
relaying on a scripts means the vote is not valid nor is the PMC performing
it duties correctly. If you want this change you would need to take have a
VOTE on it and/or take it to the board. See the recent discussion(s) on
legal discuss.
Link to the discussion, please?
Thanks,
Om
>
> Justin
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Tom Chiverton <tc...@extravision.com>.
On 17/06/14 10:05, Erik de Bruin wrote:
> And what is considered "manually"? Do I have to manually type commands into
> the terminal in order to comply? Is an ant script a script? Why are scripts
> considered "bad"? It seems to me that a script provides consistency,
> completeness and ease of use, allowing more people to participate in the
> testing and voting process.
What if there is a bug in the check script?
It's introducing another point of failure and another artefact that
needs tests for no reason.
If we are not going through the release as normal end users would, it's
not a good test of the release to end users.
Tom
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Erik de Bruin <er...@ixsoftware.nl>.
>
> 100% agree and that a useful and good thing, but that does not make them
> legal releases, and IMO it exposes the PMC (and thus the board) to greater
> risk.
>
Yeah, this has to stop. We cannot avoid doing 'useful and good things'
simply because some bored lawyer hypothesised there might be an outside
chance he would actually have to do some work otherwise.
Apache legal stuff, much more than any other (outside) influence, is slowly
draining the project of energy and participants.
EdB
--
Ix Multimedia Software
Jan Luykenstraat 27
3521 VB Utrecht
T. 06-51952295
I. www.ixsoftware.nl
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,
> It seems to me that a script provides consistency,
> completeness and ease of use, allowing more people to participate in the
> testing and voting process.
100% agree and that a useful and good thing, but that does not make them legal releases, and IMO it exposes the PMC (and thus the board) to greater risk.
Justin
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Erik de Bruin <er...@ixsoftware.nl>.
>
> this is against Apache policy - releases must be manually checked
That seems oddly backwards for an organisation that exists to create,
support and evangelise bit collections that automate things...
And what is considered "manually"? Do I have to manually type commands into
the terminal in order to comply? Is an ant script a script? Why are scripts
considered "bad"? It seems to me that a script provides consistency,
completeness and ease of use, allowing more people to participate in the
testing and voting process.
EdB
--
Ix Multimedia Software
Jan Luykenstraat 27
3521 VB Utrecht
T. 06-51952295
I. www.ixsoftware.nl
Re: [VOTE] Apache FlexJS 0.0.2 RC1
Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,
> There is an ant script that automates the common steps to validate a
> release. Instead of individually downloading the package and signature
> files, unzipping, etc, you can instead:
> 1) create an empty folder,
> 2) download into that folder this file:
> https://dist.apache.org/repos/dist/dev/flex/falcon/0.0.2/rc1/ApproveFlexJS.
> xml
> 3) run the script: ant -e -f ApproveFlexJS.xml -Drelease.version=0.0.2
> -Drc=1
Again this is against Apache policy - releases must be manually checked, relaying on a scripts means the vote is not valid nor is the PMC performing it duties correctly. If you want this change you would need to take have a VOTE on it and/or take it to the board. See the recent discussion(s) on legal discuss.
Justin