You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by Shawn McKinney <sm...@apache.org> on 2021/07/04 14:13:53 UTC
[VOTE] Apache Fortress 2.0.6 release
Hello,
This is an announcement to vote for the next release of Apache Directory Fortress, 2.0.6.
Here are the list of bugs and enhancements:
https://issues.apache.org/jira/projects/FC/versions/12349361
A tag created for git: ‘2.0.6', and the sources may be pulled using git commands:
git clone --branch 2.0.6 https://git-wip-us.apache.org/repos/asf/directory-fortress-core.git
git clone --branch 2.0.6 https://git-wip-us.apache.org/repos/asf/directory-fortress-realm.git
git clone --branch 2.0.6 https://git-wip-us.apache.org/repos/asf/directory-fortress-enmasse.git
git clone --branch 2.0.6 https://git-wip-us.apache.org/repos/asf/directory-fortress-commander.git
with their associated checksums:
- core: 4562f51a4a05ec4bd52e6c8d737491b0b4d99056
- realm: 643823206c4934c6a463a2c6e5bbb00defab1435
- rest: eb7e363dad5ccb9477a6ca85ebc1a83903d18c9d
- web: 306a960af86922f51695efec2f45d1e0fba441c0
Or, source and binary distros may be downloaded from SVN:
- https://dist.apache.org/repos/dist/dev/directory/fortress/2.0.6/
The staging repo on Nexus:
- https://repository.apache.org/content/repositories/orgapachedirectory-1202
Test against LDAP using one of these:
- https://github.com/apache/directory-fortress-core/blob/master/README-QUICKSTART-DOCKER-APACHEDS.md
- https://github.com/apache/directory-fortress-core/blob/master/README-QUICKSTART-DOCKER-SLAPD.md
- Choose one of the above. Complete (only) the sections leading up to and including the SECTION entitled: 'Apache Fortress Core Integration Test’
Please vote:
[ ] +1 | Release Fortress 2.0.6
[ ] +/-0 | Abstain
[ ] -1 | Do *NOT* Release Fortress 2.0.6
—
Shawn
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Apache Fortress 2.0.6 release
Posted by Shawn McKinney <sm...@apache.org>.
> On Jul 6, 2021, at 10:12 AM, Emmanuel Lécharny <el...@gmail.com> wrote:
>
> This is irrelevant.
>
> Whatever due diligence CXF did, as soon as we know that there is a GPL/LGPL dependency, we can't cut a release with it in our packages.
>
> The simple fact it's a transitive dependency is not protecting us here.
>
> The question is: do we *need* this dependency?
The answer’s ‘no’. The jar can be excluded from both CXF dependencies in enmasse: cxf-core and cxf-rt-frontend-jaxrs.
No problems that I’m aware of.
So, let’s cancel this vote. I’ll rebuild the artifacts and we’ll try again.
Good catch Stefan.
> If so, then do we have a way to release a package that does not contain it, and explain the user they have to add it themselves would they need it ?
>
> FTR, in Mina, we release a package that optionally would require a dependency on the rxtx library, which is GPL. Obviously, we can't add this dependency in our package, so we tell the user that they can compile the code using a -Pserial flag to incorporate the lib, which is *not* packaged by us otherwise.
>
> This way, what we release cannot 'contaminate' the user without their knowledge.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Apache Fortress 2.0.6 release
Posted by Shawn McKinney <sm...@apache.org>.
> On Jul 6, 2021, at 10:12 AM, Emmanuel Lécharny <el...@gmail.com> wrote:
>
> This is irrelevant.
>
> Whatever due diligence CXF did, as soon as we know that there is a GPL/LGPL dependency, we can't cut a release with it in our packages.
>
> The simple fact it's a transitive dependency is not protecting us here.
>
> The question is: do we *need* this dependency?
The answer’s ‘no’. The jar can be excluded from both CXF dependencies in enmasse: cxf-core and cxf-rt-frontend-jaxrs.
No problems that I’m aware of.
So, let’s cancel this vote. I’ll rebuild the artifacts and we’ll try again.
Good catch Stefan.
> If so, then do we have a way to release a package that does not contain it, and explain the user they have to add it themselves would they need it ?
>
> FTR, in Mina, we release a package that optionally would require a dependency on the rxtx library, which is GPL. Obviously, we can't add this dependency in our package, so we tell the user that they can compile the code using a -Pserial flag to incorporate the lib, which is *not* packaged by us otherwise.
>
> This way, what we release cannot 'contaminate' the user without their knowledge.
---------------------------------------------------------------------
To unsubscribe, e-mail: fortress-unsubscribe@directory.apache.org
For additional commands, e-mail: fortress-help@directory.apache.org
Re: [VOTE] Apache Fortress 2.0.6 release
Posted by Emmanuel Lécharny <el...@gmail.com>.
On 06/07/2021 16:01, Shawn McKinney wrote:
>
>> On Jul 5, 2021, at 1:18 PM, Stefan Seelmann <ma...@stefan-seelmann.de> wrote:
>>
>> I found one weird thing: the fortress-rest-2.0.6.war contains in
>> WEB-INF/lib the jboss-rmi-api_1.0_spec-1.0.6.Final.jar.
>
> That jar does not appear on a test machine using JDK 8.
>
> Reading the ticket, it’s JDK 11 specific, which is what I used to build the release.
>
>> This is either
>> GPL/LGPL licensed, the git repo includes no license file, the pom.xml
>> mentions LGPL [1], the license file within the JAR states GPL+CPE.
>>
>> But this is a transitive dependency from
>> org.apache.cxf:cxf-core:jar:3.4.4, defined in it's parent pom [2], so if
>> they include it as dependency it must be ok, right?
>
> Depends on if trust is transitive. Do we trust that CXF project did their due diligence?
This is irrelevant.
Whatever due diligence CXF did, as soon as we know that there is a
GPL/LGPL dependency, we can't cut a release with it in our packages.
The simple fact it's a transitive dependency is not protecting us here.
The question is: do we *need* this dependency?
If so, then do we have a way to release a package that does not contain
it, and explain the user they have to add it themselves would they need it ?
FTR, in Mina, we release a package that optionally would require a
dependency on the rxtx library, which is GPL. Obviously, we can't add
this dependency in our package, so we tell the user that they can
compile the code using a -Pserial flag to incorporate the lib, which is
*not* packaged by us otherwise.
This way, what we release cannot 'contaminate' the user without their
knowledge.
--
*Emmanuel Lécharny - CTO* 205 Promenade des Anglais – 06200 NICE
T. +33 (0)4 89 97 36 50
P. +33 (0)6 08 33 32 61
emmanuel.lecharny@busit.com https://www.busit.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: fortress-unsubscribe@directory.apache.org
For additional commands, e-mail: fortress-help@directory.apache.org
Re: [VOTE] Apache Fortress 2.0.6 release
Posted by Shawn McKinney <sm...@apache.org>.
> On Jul 5, 2021, at 1:18 PM, Stefan Seelmann <ma...@stefan-seelmann.de> wrote:
>
> I found one weird thing: the fortress-rest-2.0.6.war contains in
> WEB-INF/lib the jboss-rmi-api_1.0_spec-1.0.6.Final.jar.
That jar does not appear on a test machine using JDK 8.
Reading the ticket, it’s JDK 11 specific, which is what I used to build the release.
> This is either
> GPL/LGPL licensed, the git repo includes no license file, the pom.xml
> mentions LGPL [1], the license file within the JAR states GPL+CPE.
>
> But this is a transitive dependency from
> org.apache.cxf:cxf-core:jar:3.4.4, defined in it's parent pom [2], so if
> they include it as dependency it must be ok, right?
Depends on if trust is transitive. Do we trust that CXF project did their due diligence?
> It's included in fortress-rest since 2.0.5 and was introduced in CXF
> 3.3.0 [3]
>
> Anyone has a clue? Or should we ask legal?
I’d say yes. (Trust but verify)
—
Shawn
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Apache Fortress 2.0.6 release
Posted by Shawn McKinney <sm...@apache.org>.
> On Jul 5, 2021, at 1:18 PM, Stefan Seelmann <ma...@stefan-seelmann.de> wrote:
>
> I found one weird thing: the fortress-rest-2.0.6.war contains in
> WEB-INF/lib the jboss-rmi-api_1.0_spec-1.0.6.Final.jar.
That jar does not appear on a test machine using JDK 8.
Reading the ticket, it’s JDK 11 specific, which is what I used to build the release.
> This is either
> GPL/LGPL licensed, the git repo includes no license file, the pom.xml
> mentions LGPL [1], the license file within the JAR states GPL+CPE.
>
> But this is a transitive dependency from
> org.apache.cxf:cxf-core:jar:3.4.4, defined in it's parent pom [2], so if
> they include it as dependency it must be ok, right?
Depends on if trust is transitive. Do we trust that CXF project did their due diligence?
> It's included in fortress-rest since 2.0.5 and was introduced in CXF
> 3.3.0 [3]
>
> Anyone has a clue? Or should we ask legal?
I’d say yes. (Trust but verify)
—
Shawn
---------------------------------------------------------------------
To unsubscribe, e-mail: fortress-unsubscribe@directory.apache.org
For additional commands, e-mail: fortress-help@directory.apache.org
Re: [VOTE] Apache Fortress 2.0.6 release
Posted by Stefan Seelmann <ma...@stefan-seelmann.de>.
I found one weird thing: the fortress-rest-2.0.6.war contains in
WEB-INF/lib the jboss-rmi-api_1.0_spec-1.0.6.Final.jar. This is either
GPL/LGPL licensed, the git repo includes no license file, the pom.xml
mentions LGPL [1], the license file within the JAR states GPL+CPE.
But this is a transitive dependency from
org.apache.cxf:cxf-core:jar:3.4.4, defined in it's parent pom [2], so if
they include it as dependency it must be ok, right?
It's included in fortress-rest since 2.0.5 and was introduced in CXF
3.3.0 [3]
Anyone has a clue? Or should we ask legal?
Kind Regards,
Stefan
[1]
https://github.com/jboss/jboss-rmi-api_spec/blob/jboss-rmi-api_1.0_spec-1.0.6.Final/pom.xml
[2] https://github.com/apache/cxf/blob/cxf-3.4.4/parent/pom.xml#L2352
[3] https://issues.apache.org/jira/browse/CXF-7741
On 7/4/21 4:13 PM, Shawn McKinney wrote:
> Hello,
>
> This is an announcement to vote for the next release of Apache Directory Fortress, 2.0.6.
>
> Here are the list of bugs and enhancements:
>
> https://issues.apache.org/jira/projects/FC/versions/12349361
>
> A tag created for git: ‘2.0.6', and the sources may be pulled using git commands:
> git clone --branch 2.0.6 https://git-wip-us.apache.org/repos/asf/directory-fortress-core.git
> git clone --branch 2.0.6 https://git-wip-us.apache.org/repos/asf/directory-fortress-realm.git
> git clone --branch 2.0.6 https://git-wip-us.apache.org/repos/asf/directory-fortress-enmasse.git
> git clone --branch 2.0.6 https://git-wip-us.apache.org/repos/asf/directory-fortress-commander.git
>
> with their associated checksums:
> - core: 4562f51a4a05ec4bd52e6c8d737491b0b4d99056
> - realm: 643823206c4934c6a463a2c6e5bbb00defab1435
> - rest: eb7e363dad5ccb9477a6ca85ebc1a83903d18c9d
> - web: 306a960af86922f51695efec2f45d1e0fba441c0
>
> Or, source and binary distros may be downloaded from SVN:
> - https://dist.apache.org/repos/dist/dev/directory/fortress/2.0.6/
>
> The staging repo on Nexus:
> - https://repository.apache.org/content/repositories/orgapachedirectory-1202
>
> Test against LDAP using one of these:
> - https://github.com/apache/directory-fortress-core/blob/master/README-QUICKSTART-DOCKER-APACHEDS.md
> - https://github.com/apache/directory-fortress-core/blob/master/README-QUICKSTART-DOCKER-SLAPD.md
>
> - Choose one of the above. Complete (only) the sections leading up to and including the SECTION entitled: 'Apache Fortress Core Integration Test’
>
> Please vote:
> [ ] +1 | Release Fortress 2.0.6
> [ ] +/-0 | Abstain
> [ ] -1 | Do *NOT* Release Fortress 2.0.6
>
> —
> Shawn
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: fortress-unsubscribe@directory.apache.org
> For additional commands, e-mail: fortress-help@directory.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: fortress-unsubscribe@directory.apache.org
For additional commands, e-mail: fortress-help@directory.apache.org
Re: [VOTE] Apache Fortress 2.0.6 release
Posted by Stefan Seelmann <ma...@stefan-seelmann.de>.
I found one weird thing: the fortress-rest-2.0.6.war contains in
WEB-INF/lib the jboss-rmi-api_1.0_spec-1.0.6.Final.jar. This is either
GPL/LGPL licensed, the git repo includes no license file, the pom.xml
mentions LGPL [1], the license file within the JAR states GPL+CPE.
But this is a transitive dependency from
org.apache.cxf:cxf-core:jar:3.4.4, defined in it's parent pom [2], so if
they include it as dependency it must be ok, right?
It's included in fortress-rest since 2.0.5 and was introduced in CXF
3.3.0 [3]
Anyone has a clue? Or should we ask legal?
Kind Regards,
Stefan
[1]
https://github.com/jboss/jboss-rmi-api_spec/blob/jboss-rmi-api_1.0_spec-1.0.6.Final/pom.xml
[2] https://github.com/apache/cxf/blob/cxf-3.4.4/parent/pom.xml#L2352
[3] https://issues.apache.org/jira/browse/CXF-7741
On 7/4/21 4:13 PM, Shawn McKinney wrote:
> Hello,
>
> This is an announcement to vote for the next release of Apache Directory Fortress, 2.0.6.
>
> Here are the list of bugs and enhancements:
>
> https://issues.apache.org/jira/projects/FC/versions/12349361
>
> A tag created for git: ‘2.0.6', and the sources may be pulled using git commands:
> git clone --branch 2.0.6 https://git-wip-us.apache.org/repos/asf/directory-fortress-core.git
> git clone --branch 2.0.6 https://git-wip-us.apache.org/repos/asf/directory-fortress-realm.git
> git clone --branch 2.0.6 https://git-wip-us.apache.org/repos/asf/directory-fortress-enmasse.git
> git clone --branch 2.0.6 https://git-wip-us.apache.org/repos/asf/directory-fortress-commander.git
>
> with their associated checksums:
> - core: 4562f51a4a05ec4bd52e6c8d737491b0b4d99056
> - realm: 643823206c4934c6a463a2c6e5bbb00defab1435
> - rest: eb7e363dad5ccb9477a6ca85ebc1a83903d18c9d
> - web: 306a960af86922f51695efec2f45d1e0fba441c0
>
> Or, source and binary distros may be downloaded from SVN:
> - https://dist.apache.org/repos/dist/dev/directory/fortress/2.0.6/
>
> The staging repo on Nexus:
> - https://repository.apache.org/content/repositories/orgapachedirectory-1202
>
> Test against LDAP using one of these:
> - https://github.com/apache/directory-fortress-core/blob/master/README-QUICKSTART-DOCKER-APACHEDS.md
> - https://github.com/apache/directory-fortress-core/blob/master/README-QUICKSTART-DOCKER-SLAPD.md
>
> - Choose one of the above. Complete (only) the sections leading up to and including the SECTION entitled: 'Apache Fortress Core Integration Test’
>
> Please vote:
> [ ] +1 | Release Fortress 2.0.6
> [ ] +/-0 | Abstain
> [ ] -1 | Do *NOT* Release Fortress 2.0.6
>
> —
> Shawn
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: fortress-unsubscribe@directory.apache.org
> For additional commands, e-mail: fortress-help@directory.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org