You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@commons.apache.org by Gary Gregory <ga...@gmail.com> on 2013/04/23 03:19:16 UTC
[ALL] release instructions warning
To release Codec 1.8, I just tried following
https://commons.apache.org/releases/prepare.html
In particular:
"Before you close<http://www.apache.org/dev/publishing-maven-artifacts.html#close-stage>the
staging repository you must remove the tarballs/zips together with
their PGP signatures and checksums using the Nexus web interface. While you
are at it you can also remove the checksums Nexus created for the PGP
signatures of the remaining artifacts, they are not needed at all."
So I dutifully deleted .md5 and sha1 files and guess what? I messed it up
by deleting all MD5 and SHA1 files instead of just this one and that one
out of the 61 files that are presented in the UI. Frak! So beware, our
release process sucks rocks and does not do it well, as it has for years.
:(
Gary
--
E-Mail: garydgregory@gmail.com | ggregory@apache.org
Java Persistence with Hibernate, Second Edition<http://www.manning.com/bauer3/>
JUnit in Action, Second Edition <http://www.manning.com/tahchiev/>
Spring Batch in Action <http://www.manning.com/templier/>
Blog: http://garygregory.wordpress.com
Home: http://garygregory.com/
Tweet! http://twitter.com/GaryGregory
Re: [ALL] release instructions warning
Posted by sebb <se...@gmail.com>.
On 23 April 2013 15:39, Stefan Bodewig <bo...@apache.org> wrote:
> On 2013-04-23, sebb wrote:
>
> > As to the (non-Maven) tarballs: another approach would be to create them
> in
> > Nexus as per usual, but move them (copy/delete) to the svnpubsub staging
> > area [1] before the vote starts.
>
> > It would make the reviewers job slighly harder - one extra URL to
> download
> > and check - but there would then be no need to adjust either staging area
> > after the vote.
> > So any mistakes would have fewer consequences.
>
> This is exactly what
> <
> https://commons.apache.org/releases/prepare.html#Create_the_Release_Candidate
> >
> suggests :-)
>
>
Yes, I see.
I think we need a link from that document to the next stage - publishing
the release.
I'll see about adding that later.
It might also be useful to have a section on how to respin a release vote
if it fails - what needs to be deleted and when etc.
As to the following comment:
"*If anybody knows how we can avoid uploading the distributions, please
lend a hand. The manual step is not only annoying, uploading the files also
wastes time and bandwidth."*
Yes, the manual stages are annoying, but at least the process generates all
the required files, even if they are not all uploaded to the correct place.
It's easy enough to avoid uploading the tarballs - just detach them from
the relevant Maven phase - but then Maven does not create the hashes or the
sigs.
So there are some possibilities:
- stick with the full Nexus upload, and find a way to automate the move of
the files from Nexus to dist/dev staging
- exclude the tarballs from Nexus, and update the build procedures to
create the sigs and hashes; also automate upload to dist/dev staging
- have Nexus publish the tarballs and Maven artifacts to the correct
places. I raised a JIRA [1] about this, but unfortunately it got nowhere.
[1] https://issues.apache.org/jira/browse/INFRA-4144
Stefan
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>
Re: [ALL] release instructions warning
Posted by Stefan Bodewig <bo...@apache.org>.
On 2013-04-23, sebb wrote:
> As to the (non-Maven) tarballs: another approach would be to create them in
> Nexus as per usual, but move them (copy/delete) to the svnpubsub staging
> area [1] before the vote starts.
> It would make the reviewers job slighly harder - one extra URL to download
> and check - but there would then be no need to adjust either staging area
> after the vote.
> So any mistakes would have fewer consequences.
This is exactly what
<https://commons.apache.org/releases/prepare.html#Create_the_Release_Candidate>
suggests :-)
Stefan
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [ALL] release instructions warning
Posted by sebb <se...@gmail.com>.
Some follow-up: the .ASC hashes can (should) be deleted before the vote
starts.
As to the (non-Maven) tarballs: another approach would be to create them in
Nexus as per usual, but move them (copy/delete) to the svnpubsub staging
area [1] before the vote starts.
It would make the reviewers job slighly harder - one extra URL to download
and check - but there would then be no need to adjust either staging area
after the vote.
So any mistakes would have fewer consequences.
It would hopefully be possible to automate at least some of that process.
[1] https://dist.apache.org/repos/dist/dev/commons/
On 23 April 2013 14:03, Gary Gregory <ga...@gmail.com> wrote:
> On Tue, Apr 23, 2013 at 8:51 AM, Gary Gregory <garydgregory@gmail.com
> >wrote:
>
> > On Tue, Apr 23, 2013 at 8:39 AM, sebb <se...@gmail.com> wrote:
> >
> >> On 23 April 2013 02:19, Gary Gregory <ga...@gmail.com> wrote:
> >>
> >> > To release Codec 1.8, I just tried following
> >> > https://commons.apache.org/releases/prepare.html
> >> >
> >> > In particular:
> >> >
> >> > "Before you close<
> >> > http://www.apache.org/dev/publishing-maven-artifacts.html#close-stage
> >> >the
> >> > staging repository you must remove the tarballs/zips together with
> >> > their PGP signatures and checksums using the Nexus web interface.
> While
> >> you
> >> > are at it you can also remove the checksums Nexus created for the PGP
> >> > signatures of the remaining artifacts, they are not needed at all."
> >> >
> >> >
> >> [BTW, this does not have to be done before closing; it can be done
> before
> >> publishing. Not sure why Nexus allows deletion from a closed repo, but
> it
> >> does]
> >>
> >> If a mistake is made, just delete and recreate the staging repo.It's not
> >> that difficult.
> >>
> >
> > OK, will do.
> >
>
> Here:
> https://repository.apache.org/content/repositories/orgapachecommons-129/
>
> Gary
>
>
> >
> > Gary
> >
> >
> >>
> >> Nexus / Maven is not ideal in that it creates hashes for .ASC files, but
> >> having a staging repo is a huge benefit compared with the pre-Nexus
> >> situation.
> >> If you look around Maven Central, you will see a lot of mistaken
> releases
> >> (e.g. snapshots in the release area). Once released to Maven, it cannot
> be
> >> unreleased.
> >>
> >> I don't want to go back to that time.
> >>
> >> So I dutifully deleted .md5 and sha1 files and guess what? I messed it
> up
> >> > by deleting all MD5 and SHA1 files instead of just this one and that
> one
> >> > out of the 61 files that are presented in the UI. Frak! So beware, our
> >> > release process sucks rocks and does not do it well, as it has for
> >> years.
> >> >
> >>
> >> It still takes a bit of care, but I think it's a lot better / safer than
> >> it
> >> used to be.
> >>
> >> Note: it's possible to prevent the non-Maven artifacts from being
> uploaded
> >> to Nexus.
> >> It would then be possible to just leave the useless hashes in place
> >> However, this means additional work has to be done to create the
> >> tarballs/zips and their sigs/hashes.
> >>
> >> We just need a Maven expert to help fix up the process now that
> svnpubsub
> >> is in use.
> >>
> >>
> >>
> >> > :(
> >> >
> >> > Gary
> >> >
> >> > --
> >> > E-Mail: garydgregory@gmail.com | ggregory@apache.org
> >> > Java Persistence with Hibernate, Second Edition<
> >> > http://www.manning.com/bauer3/>
> >> > JUnit in Action, Second Edition <http://www.manning.com/tahchiev/>
> >> > Spring Batch in Action <http://www.manning.com/templier/>
> >> > Blog: http://garygregory.wordpress.com
> >> > Home: http://garygregory.com/
> >> > Tweet! http://twitter.com/GaryGregory
> >> >
> >>
> >
> >
> >
> > --
> > E-Mail: garydgregory@gmail.com | ggregory@apache.org
> > Java Persistence with Hibernate, Second Edition<
> http://www.manning.com/bauer3/>
> > JUnit in Action, Second Edition <http://www.manning.com/tahchiev/>
> > Spring Batch in Action <http://www.manning.com/templier/>
> >
> > Blog: http://garygregory.wordpress.com
> > Home: http://garygregory.com/
> > Tweet! http://twitter.com/GaryGregory
> >
>
>
>
> --
> E-Mail: garydgregory@gmail.com | ggregory@apache.org
> Java Persistence with Hibernate, Second Edition<
> http://www.manning.com/bauer3/>
> JUnit in Action, Second Edition <http://www.manning.com/tahchiev/>
> Spring Batch in Action <http://www.manning.com/templier/>
> Blog: http://garygregory.wordpress.com
> Home: http://garygregory.com/
> Tweet! http://twitter.com/GaryGregory
>
Re: [ALL] release instructions warning
Posted by Gary Gregory <ga...@gmail.com>.
On Tue, Apr 23, 2013 at 8:51 AM, Gary Gregory <ga...@gmail.com>wrote:
> On Tue, Apr 23, 2013 at 8:39 AM, sebb <se...@gmail.com> wrote:
>
>> On 23 April 2013 02:19, Gary Gregory <ga...@gmail.com> wrote:
>>
>> > To release Codec 1.8, I just tried following
>> > https://commons.apache.org/releases/prepare.html
>> >
>> > In particular:
>> >
>> > "Before you close<
>> > http://www.apache.org/dev/publishing-maven-artifacts.html#close-stage
>> >the
>> > staging repository you must remove the tarballs/zips together with
>> > their PGP signatures and checksums using the Nexus web interface. While
>> you
>> > are at it you can also remove the checksums Nexus created for the PGP
>> > signatures of the remaining artifacts, they are not needed at all."
>> >
>> >
>> [BTW, this does not have to be done before closing; it can be done before
>> publishing. Not sure why Nexus allows deletion from a closed repo, but it
>> does]
>>
>> If a mistake is made, just delete and recreate the staging repo.It's not
>> that difficult.
>>
>
> OK, will do.
>
Here:
https://repository.apache.org/content/repositories/orgapachecommons-129/
Gary
>
> Gary
>
>
>>
>> Nexus / Maven is not ideal in that it creates hashes for .ASC files, but
>> having a staging repo is a huge benefit compared with the pre-Nexus
>> situation.
>> If you look around Maven Central, you will see a lot of mistaken releases
>> (e.g. snapshots in the release area). Once released to Maven, it cannot be
>> unreleased.
>>
>> I don't want to go back to that time.
>>
>> So I dutifully deleted .md5 and sha1 files and guess what? I messed it up
>> > by deleting all MD5 and SHA1 files instead of just this one and that one
>> > out of the 61 files that are presented in the UI. Frak! So beware, our
>> > release process sucks rocks and does not do it well, as it has for
>> years.
>> >
>>
>> It still takes a bit of care, but I think it's a lot better / safer than
>> it
>> used to be.
>>
>> Note: it's possible to prevent the non-Maven artifacts from being uploaded
>> to Nexus.
>> It would then be possible to just leave the useless hashes in place
>> However, this means additional work has to be done to create the
>> tarballs/zips and their sigs/hashes.
>>
>> We just need a Maven expert to help fix up the process now that svnpubsub
>> is in use.
>>
>>
>>
>> > :(
>> >
>> > Gary
>> >
>> > --
>> > E-Mail: garydgregory@gmail.com | ggregory@apache.org
>> > Java Persistence with Hibernate, Second Edition<
>> > http://www.manning.com/bauer3/>
>> > JUnit in Action, Second Edition <http://www.manning.com/tahchiev/>
>> > Spring Batch in Action <http://www.manning.com/templier/>
>> > Blog: http://garygregory.wordpress.com
>> > Home: http://garygregory.com/
>> > Tweet! http://twitter.com/GaryGregory
>> >
>>
>
>
>
> --
> E-Mail: garydgregory@gmail.com | ggregory@apache.org
> Java Persistence with Hibernate, Second Edition<http://www.manning.com/bauer3/>
> JUnit in Action, Second Edition <http://www.manning.com/tahchiev/>
> Spring Batch in Action <http://www.manning.com/templier/>
>
> Blog: http://garygregory.wordpress.com
> Home: http://garygregory.com/
> Tweet! http://twitter.com/GaryGregory
>
--
E-Mail: garydgregory@gmail.com | ggregory@apache.org
Java Persistence with Hibernate, Second Edition<http://www.manning.com/bauer3/>
JUnit in Action, Second Edition <http://www.manning.com/tahchiev/>
Spring Batch in Action <http://www.manning.com/templier/>
Blog: http://garygregory.wordpress.com
Home: http://garygregory.com/
Tweet! http://twitter.com/GaryGregory
Re: [ALL] release instructions warning
Posted by Gary Gregory <ga...@gmail.com>.
On Tue, Apr 23, 2013 at 8:39 AM, sebb <se...@gmail.com> wrote:
> On 23 April 2013 02:19, Gary Gregory <ga...@gmail.com> wrote:
>
> > To release Codec 1.8, I just tried following
> > https://commons.apache.org/releases/prepare.html
> >
> > In particular:
> >
> > "Before you close<
> > http://www.apache.org/dev/publishing-maven-artifacts.html#close-stage
> >the
> > staging repository you must remove the tarballs/zips together with
> > their PGP signatures and checksums using the Nexus web interface. While
> you
> > are at it you can also remove the checksums Nexus created for the PGP
> > signatures of the remaining artifacts, they are not needed at all."
> >
> >
> [BTW, this does not have to be done before closing; it can be done before
> publishing. Not sure why Nexus allows deletion from a closed repo, but it
> does]
>
> If a mistake is made, just delete and recreate the staging repo.It's not
> that difficult.
>
OK, will do.
Gary
>
> Nexus / Maven is not ideal in that it creates hashes for .ASC files, but
> having a staging repo is a huge benefit compared with the pre-Nexus
> situation.
> If you look around Maven Central, you will see a lot of mistaken releases
> (e.g. snapshots in the release area). Once released to Maven, it cannot be
> unreleased.
>
> I don't want to go back to that time.
>
> So I dutifully deleted .md5 and sha1 files and guess what? I messed it up
> > by deleting all MD5 and SHA1 files instead of just this one and that one
> > out of the 61 files that are presented in the UI. Frak! So beware, our
> > release process sucks rocks and does not do it well, as it has for years.
> >
>
> It still takes a bit of care, but I think it's a lot better / safer than it
> used to be.
>
> Note: it's possible to prevent the non-Maven artifacts from being uploaded
> to Nexus.
> It would then be possible to just leave the useless hashes in place
> However, this means additional work has to be done to create the
> tarballs/zips and their sigs/hashes.
>
> We just need a Maven expert to help fix up the process now that svnpubsub
> is in use.
>
>
>
> > :(
> >
> > Gary
> >
> > --
> > E-Mail: garydgregory@gmail.com | ggregory@apache.org
> > Java Persistence with Hibernate, Second Edition<
> > http://www.manning.com/bauer3/>
> > JUnit in Action, Second Edition <http://www.manning.com/tahchiev/>
> > Spring Batch in Action <http://www.manning.com/templier/>
> > Blog: http://garygregory.wordpress.com
> > Home: http://garygregory.com/
> > Tweet! http://twitter.com/GaryGregory
> >
>
--
E-Mail: garydgregory@gmail.com | ggregory@apache.org
Java Persistence with Hibernate, Second Edition<http://www.manning.com/bauer3/>
JUnit in Action, Second Edition <http://www.manning.com/tahchiev/>
Spring Batch in Action <http://www.manning.com/templier/>
Blog: http://garygregory.wordpress.com
Home: http://garygregory.com/
Tweet! http://twitter.com/GaryGregory
Re: [ALL] release instructions warning
Posted by sebb <se...@gmail.com>.
On 23 April 2013 02:19, Gary Gregory <ga...@gmail.com> wrote:
> To release Codec 1.8, I just tried following
> https://commons.apache.org/releases/prepare.html
>
> In particular:
>
> "Before you close<
> http://www.apache.org/dev/publishing-maven-artifacts.html#close-stage>the
> staging repository you must remove the tarballs/zips together with
> their PGP signatures and checksums using the Nexus web interface. While you
> are at it you can also remove the checksums Nexus created for the PGP
> signatures of the remaining artifacts, they are not needed at all."
>
>
[BTW, this does not have to be done before closing; it can be done before
publishing. Not sure why Nexus allows deletion from a closed repo, but it
does]
If a mistake is made, just delete and recreate the staging repo.It's not
that difficult.
Nexus / Maven is not ideal in that it creates hashes for .ASC files, but
having a staging repo is a huge benefit compared with the pre-Nexus
situation.
If you look around Maven Central, you will see a lot of mistaken releases
(e.g. snapshots in the release area). Once released to Maven, it cannot be
unreleased.
I don't want to go back to that time.
So I dutifully deleted .md5 and sha1 files and guess what? I messed it up
> by deleting all MD5 and SHA1 files instead of just this one and that one
> out of the 61 files that are presented in the UI. Frak! So beware, our
> release process sucks rocks and does not do it well, as it has for years.
>
It still takes a bit of care, but I think it's a lot better / safer than it
used to be.
Note: it's possible to prevent the non-Maven artifacts from being uploaded
to Nexus.
It would then be possible to just leave the useless hashes in place
However, this means additional work has to be done to create the
tarballs/zips and their sigs/hashes.
We just need a Maven expert to help fix up the process now that svnpubsub
is in use.
> :(
>
> Gary
>
> --
> E-Mail: garydgregory@gmail.com | ggregory@apache.org
> Java Persistence with Hibernate, Second Edition<
> http://www.manning.com/bauer3/>
> JUnit in Action, Second Edition <http://www.manning.com/tahchiev/>
> Spring Batch in Action <http://www.manning.com/templier/>
> Blog: http://garygregory.wordpress.com
> Home: http://garygregory.com/
> Tweet! http://twitter.com/GaryGregory
>
Re: [ALL] release instructions warning
Posted by Henri Yandell <fl...@gmail.com>.
This fills me with foreboding for doing a release again someday :(
On Mon, Apr 22, 2013 at 6:19 PM, Gary Gregory <ga...@gmail.com>wrote:
> To release Codec 1.8, I just tried following
> https://commons.apache.org/releases/prepare.html
>
> In particular:
>
> "Before you close<
> http://www.apache.org/dev/publishing-maven-artifacts.html#close-stage>the
> staging repository you must remove the tarballs/zips together with
> their PGP signatures and checksums using the Nexus web interface. While you
> are at it you can also remove the checksums Nexus created for the PGP
> signatures of the remaining artifacts, they are not needed at all."
>
> So I dutifully deleted .md5 and sha1 files and guess what? I messed it up
> by deleting all MD5 and SHA1 files instead of just this one and that one
> out of the 61 files that are presented in the UI. Frak! So beware, our
> release process sucks rocks and does not do it well, as it has for years.
>
> :(
>
> Gary
>
> --
> E-Mail: garydgregory@gmail.com | ggregory@apache.org
> Java Persistence with Hibernate, Second Edition<
> http://www.manning.com/bauer3/>
> JUnit in Action, Second Edition <http://www.manning.com/tahchiev/>
> Spring Batch in Action <http://www.manning.com/templier/>
> Blog: http://garygregory.wordpress.com
> Home: http://garygregory.com/
> Tweet! http://twitter.com/GaryGregory
>