You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@flagon.apache.org by Joshua Poore <po...@apache.org> on 2019/08/07 02:16:11 UTC

[VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Hi Folks,
 
Please VOTE on the Apache Flagon 2.0.2 Release Candidate # 1

Context: v2.0.1 release had a major, uncaught flaw in the package.json file. Once the VOTE passed to release 2.0.1, this was published to the npm registry resulting in an unusable npm package. This was immediately unpublished. However, npm prohibits republishing over the same package version number. As such, we are treating v2.0.1 as a failed release. v2.0.2 resolves the package.json issue, and adds the final npm dev dependency update to resolve all install audit warnings rel to Prototype Pollution, and package deprecation notices. See changelog for full details. Additionally, see the newly added UserALE.js testing framework (on confluence, link below) for instructions for how to build, perform unit and integration tests, and test the npm distribution as though it was installed directly from the npm registry. 

VOTE details follow:
 
About Flagon: http://flagon.incubator.apache.org/ <http://flagon.incubator.apache.org/> 
 
This Patch release includes :
 
	• Updates to package.json and package-lock.json to resolve downstream Prototype Pollution vulnerabilities in dev dependencies
	• Updates to package.json and package-lock.json to modernize deprecated npm modules
	• Minor updates to README documentation for UserALE.js' Example Test Utilities.
 
We solved 11 issues: https://issues.apache.org/jira/projects/FLAGON/versions/12345954 <https://issues.apache.org/jira/projects/FLAGON/versions/12345954>
 
Git source tag (43de2fc1e1c5d5e1a83119a91947f7bbe6d313f3): https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019 <https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019>
 
Staging repo: https://dist.apache.org/repos/dist/dev/incubator/flagon/ <https://dist.apache.org/repos/dist/dev/incubator/flagon/> 
 
Source Release Artifacts: https://dist.apache.org/repos/dist/dev/incubator/flagon/apache-flagon-useralejs-incubating-2.0.2-RC1/ <https://dist.apache.org/repos/dist/dev/incubator/flagon/apache-flagon-useralejs-incubating-2.0.2-RC1/>
 
PGP release keys (signed using F937rFAE3FCADF6E): https://dist.apache.org/repos/dist/release/incubator/flagon/KEYS <https://dist.apache.org/repos/dist/release/incubator/flagon/KEYS> 
 
Reference the {product} testing framework to assist in your unit and integration tests: https://cwiki.apache.org/confluence/display/FLAGON/UserALE.js+Testing+Framework <https://cwiki.apache.org/confluence/display/FLAGON/UserALE.js+Testing+Framework> 

Link to Successful Jenkins Build(s): https://builds.apache.org/job/useralejs-ci/91/ <https://builds.apache.org/job/useralejs-ci/91/>, https://builds.apache.org/job/useralejs-ci/92/ <https://builds.apache.org/job/useralejs-ci/92/>
 
Vote will be open for 72 hours. Please VOTE as follows: 
 
[ ] +1, let's get it released!!!
[ ] +/-0, fine, but consider to fix few issues before...
[ ] -1, nope, because... (and please explain why)
Thank you to everyone that is able to VOTE as well as everyone that contributed to Apache Flagon 2.0.0

Re: [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by David Meikle <da...@meikle.io>.

On Wed, 7 Aug 2019 at 03:16, Joshua Poore <po...@apache.org> wrote:

> Vote will be open for 72 hours. Please VOTE as follows:
>
> [ ] +1, let's get it released!!!
> [ ] +/-0, fine, but consider to fix few issues before...
> [ ] -1, nope, because... (and please explain why)
>
>
+1 - signatures, hashes, NOTICE and LICENSE, incubating in name, builds on
Ubuntu 19.04 with Node 12.7.0.

Cheers,
Dave

Re: [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by Tim Allison <ta...@apache.org>.

+1

On Thu, Aug 8, 2019 at 9:16 PM Joshua Poore <po...@apache.org> wrote:
>
> +1
>
> I tested the h*** out of this. Don’t forget to VOTE y’all!
>
> > On Aug 6, 2019, at 10:16 PM, Joshua Poore <po...@apache.org> wrote:
> >
> >
> > Hi Folks,
> >
> > Please VOTE on the Apache Flagon 2.0.2 Release Candidate # 1
> >
> > Context: v2.0.1 release had a major, uncaught flaw in the package.json file. Once the VOTE passed to release 2.0.1, this was published to the npm registry resulting in an unusable npm package. This was immediately unpublished. However, npm prohibits republishing over the same package version number. As such, we are treating v2.0.1 as a failed release. v2.0.2 resolves the package.json issue, and adds the final npm dev dependency update to resolve all install audit warnings rel to Prototype Pollution, and package deprecation notices. See changelog for full details. Additionally, see the newly added UserALE.js testing framework (on confluence, link below) for instructions for how to build, perform unit and integration tests, and test the npm distribution as though it was installed directly from the npm registry.
> >
> > VOTE details follow:
> >
> > About Flagon: http://flagon.incubator.apache.org/ <http://flagon.incubator.apache.org/>
> >
> > This Patch release includes :
> >
> >       • Updates to package.json and package-lock.json to resolve downstream Prototype Pollution vulnerabilities in dev dependencies
> >       • Updates to package.json and package-lock.json to modernize deprecated npm modules
> >       • Minor updates to README documentation for UserALE.js' Example Test Utilities.
> >
> > We solved 11 issues: https://issues.apache.org/jira/projects/FLAGON/versions/12345954 <https://issues.apache.org/jira/projects/FLAGON/versions/12345954>
> >
> > Git source tag (43de2fc1e1c5d5e1a83119a91947f7bbe6d313f3): https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019 <https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019>
> >
> > Staging repo: https://dist.apache.org/repos/dist/dev/incubator/flagon/ <https://dist.apache.org/repos/dist/dev/incubator/flagon/>
> >
> > Source Release Artifacts: https://dist.apache.org/repos/dist/dev/incubator/flagon/apache-flagon-useralejs-incubating-2.0.2-RC1/ <https://dist.apache.org/repos/dist/dev/incubator/flagon/apache-flagon-useralejs-incubating-2.0.2-RC1/>
> >
> > PGP release keys (signed using F937rFAE3FCADF6E): https://dist.apache.org/repos/dist/release/incubator/flagon/KEYS <https://dist.apache.org/repos/dist/release/incubator/flagon/KEYS>
> >
> > Reference the {product} testing framework to assist in your unit and integration tests: https://cwiki.apache.org/confluence/display/FLAGON/UserALE.js+Testing+Framework <https://cwiki.apache.org/confluence/display/FLAGON/UserALE.js+Testing+Framework>
> >
> > Link to Successful Jenkins Build(s): https://builds.apache.org/job/useralejs-ci/91/ <https://builds.apache.org/job/useralejs-ci/91/>, https://builds.apache.org/job/useralejs-ci/92/ <https://builds.apache.org/job/useralejs-ci/92/>
> >
> > Vote will be open for 72 hours. Please VOTE as follows:
> >
> > [ ] +1, let's get it released!!!
> > [ ] +/-0, fine, but consider to fix few issues before...
> > [ ] -1, nope, because... (and please explain why)
> > Thank you to everyone that is able to VOTE as well as everyone that contributed to Apache Flagon 2.0.0
>

Re: [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by Furkan KAMACI <fu...@gmail.com>.

Hi,

[IPMC vote mail did not displayed as a separate mail thread than dev@ mail.
I've just realized it. So, that's why I send my vote after your reminder.]

+1 from me.

 I checked:

- Incubating in name
- Disclaimer exists
- LICENSE and NOTICE are fine
- No unexpected binary files
- Code compiles and tests successfully run

Kind Regards,
Furkan KAMACI

17 Ağu 2019 Cmt, saat 02:54 tarihinde Joshua Poore <po...@apache.org>
şunu yazdı:

> Hi IPMC—
>
> Just a reminder: please VOTE on Apache Flagon UserALE.js (Incubating)
> v2.0.2
>
> We need +3 binding VOTE from Incubator having met the VOTE requirements on
> dev@
>
> Note that we have addressed the omission of the disclaimer files from .bin
> distribution packages Justin discovered, with no commits needed to fix. See
> below.
>
> As this is a security-related patch, attention to this VOTE is much
> appreciated.
>
> Thanks!
>
> Josh
>
> > On Aug 14, 2019, at 11:10 PM, Joshua Poore <po...@apache.org> wrote:
> >
> > General@
> >
> > Following Justin’s comment below—Disclaimer missing from .bin release
> packages—I have repackaged release candidate #1 to include Disclaimers and
> pushed to https://dist.apache.org/repos/dist/dev/incubator/flagon/ <
> https://dist.apache.org/repos/dist/dev/incubator/flagon/>.
> >
> > As this issue was a file omission and did not affect source or build
> artifacts, the commit reference used for voting in dev@ have not changed,
> nor have git tags for the release candidate. .bin packages now include our
> Disclaimer.
> >
> > As a matter of good practice I have re-evaluated the repackaged release
> candidate against the following:
> >
> > [ x ] Build and Unit Tests Pass
> > [ x ] Integration Tests Pass
> > [ x ] "Incubating" in References to Project and Distribution File Names
> > [ x ] Signatures and Hashes Match Keys
> > [ x ] DISCLAIMER, LICENSE, and NOTICE Files in Source and Binary Release
> Packages
> > [ x ] DISCLAIMER, LICENSE, and NOTICE are consistent with ASF and
> Incubator Policy
> > [ x ] CHANGELOG included with release distribution
> > [ x ] All Source Files Have Correct ASF Headers
> > [ x ] No Unexpected Binary Files in Source Release Packages
> >
> > Please feel free to evaluate as you VOTE. See the thread below for the
> interim summary of VOTEs on dev@
> >
> > VOTE details follow:
> >
> > Please VOTE on the Apache Flagon (Incubating) 2.0.2 Release Candidate # 1
> >
> > This VOTE has passed successfully within the Apache Flagon community. We
> are now posting the VOTE on general@ as required by Apache Release
> Management policies.
> >
> > Interim RESULT on dev@ are as follows:
> >
> > [+1] 7
> > Joshua Poore
> > Rob Foley (`Confused`)
> > Laura Mariano
> > Furkan Kamaci*
> > Arthi Vezhavendan
> > Tim Allison*
> > Dave Meikle*
> >
> > [0] 0
> >
> > [-1]
> >
> > *Binding IPMC/PPMC Mentor VOTE
> >
> > The VOTE thread on dev@ can be found here:
> https://lists.apache.org/thread.html/1d0efb2a17b1b1a3bb83a6bf882f994000f7d9db316f8b244db54076@%3Cdev.flagon.apache.org%3E
> <
> https://lists.apache.org/thread.html/1d0efb2a17b1b1a3bb83a6bf882f994000f7d9db316f8b244db54076@%3Cdev.flagon.apache.org%3E
> >
> >
> > VOTE details follow:
> >
> > About Flagon: http://flagon.incubator.apache.org/ <
> http://flagon.incubator.apache.org/> <http://flagon.incubator.apache.org/
> <http://flagon.incubator.apache.org/>>
> >
> > This Patch release includes :
> >
> >       • Updates to package.json and package-lock.json to resolve
> downstream Prototype Pollution vulnerabilities in dev dependencies
> >       • Updates to package.json and package-lock.json to modernize
> deprecated npm modules
> >       • Minor updates to README documentation for UserALE.js' Example
> Test Utilities.
> >
> > We solved 11 issues:
> https://issues.apache.org/jira/projects/FLAGON/versions/12345954 <
> https://issues.apache.org/jira/projects/FLAGON/versions/12345954><
> https://issues.apache.org/jira/projects/FLAGON/versions/12345954 <
> https://issues.apache.org/jira/projects/FLAGON/versions/12345954>>
> >
> > Git source tag (43de2fc1e1c5d5e1a83119a91947f7bbe6d313f3):
> https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019
> <
> https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019>
> <
> https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019
> <
> https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019
> >>
> >
> > Staging repo: https://dist.apache.org/repos/dist/dev/incubator/flagon/ <
> https://dist.apache.org/repos/dist/dev/incubator/flagon/>
> >
> > Source Release Artifacts:
> https://dist.apache.org/repos/dist/dev/incubator/flagon/apache-flagon-useralejs-incubating-2.0.2-RC1/
> <
> https://dist.apache.org/repos/dist/dev/incubator/flagon/apache-flagon-useralejs-incubating-2.0.2-RC1/>
>
> >
> > PGP release keys (signed using F937rFAE3FCADF6E):
> https://dist.apache.org/repos/dist/release/incubator/flagon/KEYS <
> https://dist.apache.org/repos/dist/release/incubator/flagon/KEYS>
> >
> > Reference the UserALE.js testing framework to assist in your unit and
> integration tests:
> https://cwiki.apache.org/confluence/display/FLAGON/UserALE.js+Testing+Framework
> <
> https://cwiki.apache.org/confluence/display/FLAGON/UserALE.js+Testing+Framework
> >
> >
> > Link to Successful Jenkins Build(s):
> https://builds.apache.org/job/useralejs-ci/91/ <
> https://builds.apache.org/job/useralejs-ci/91/>
> >
> > Vote will be open for 72 hours. Please VOTE as follows:
> >
> > [ ] +1, let's get it released!!!
> > [ ] +/-0, fine, but consider to fix few issues before...
> > [ ] -1, nope, because... (and please explain why)
> >
> > Thank you to everyone that is able to VOTE as well as everyone that
> contributed to Apache Flagon 2.0.0
> >
> > Thanks,
> >
> > Josh
> >
> >> On Aug 14, 2019, at 8:27 AM, Joshua Poore <po...@me.com.INVALID>
> wrote:
> >>
> >> Hi Justin,
> >>
> >> Please clarify your VOTE. Are we at -1 or 0 from you? If its a 0 -
> "consider fixing a few issues”. I can easily roll a new release with
> DISCLAIMERS in bin push as new release package so that this issue can be
> vetted prior to release, but doesn’t require another VOTE altogether.
> >>
> >> Josh
> >>
> >>> On Aug 13, 2019, at 11:58 PM, Justin Mclean <ju...@classsoftware.com>
> wrote:
> >>>
> >>> Hi,
> >>>
> >>> +1 (binding) on the source release, but sorry it’s -1 (binding) for
> the binaries as they are missing the DISCLAIMER file [2]
> >>>
> >>> You might want to consider using a checklist when checking releases
> [1]. Also when voting on release it a good idea to list what you checked
> rather than just saying +1.
> >>>
> >>> I checked:
> >>> - incubating in name
> >>> - signatures and hashes fine
> >>> - DISCLAIMER in source but not in binary releases
> >>> - LICENSE and NOTICE fine
> >>> - all source files have ASF headers
> >>> - no unexpected binary files in source release
> >>>
> >>> There also no need to put the KEYS fine inside the release, it's sort
> of a bit late to find it there after you unzipped it :-)
> >>>
> >>> Thanks,
> >>> Justin
> >>>
> >>> 1.
> https://cwiki.apache.org/confluence/display/INCUBATOR/Incubator+Release+Checklist
> >>> 2. https://incubator.apache.org/policy/incubation.html#disclaimers
> >>> ---------------------------------------------------------------------
> >>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> >>> For additional commands, e-mail: general-help@incubator.apache.org
> >>>
> >>
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> >> For additional commands, e-mail: general-help@incubator.apache.org
> >>
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
>

Re: [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by Joshua Poore <po...@apache.org>.

Hi IPMC—

Just a reminder: please VOTE on Apache Flagon UserALE.js (Incubating) v2.0.2

We need +3 binding VOTE from Incubator having met the VOTE requirements on dev@

Note that we have addressed the omission of the disclaimer files from .bin distribution packages Justin discovered, with no commits needed to fix. See below.

As this is a security-related patch, attention to this VOTE is much appreciated.

Thanks!

Josh

> On Aug 14, 2019, at 11:10 PM, Joshua Poore <po...@apache.org> wrote:
> 
> General@
> 
> Following Justin’s comment below—Disclaimer missing from .bin release packages—I have repackaged release candidate #1 to include Disclaimers and pushed to https://dist.apache.org/repos/dist/dev/incubator/flagon/ <https://dist.apache.org/repos/dist/dev/incubator/flagon/>.
> 
> As this issue was a file omission and did not affect source or build artifacts, the commit reference used for voting in dev@ have not changed, nor have git tags for the release candidate. .bin packages now include our Disclaimer.
> 
> As a matter of good practice I have re-evaluated the repackaged release candidate against the following:
> 
> [ x ] Build and Unit Tests Pass
> [ x ] Integration Tests Pass
> [ x ] "Incubating" in References to Project and Distribution File Names
> [ x ] Signatures and Hashes Match Keys
> [ x ] DISCLAIMER, LICENSE, and NOTICE Files in Source and Binary Release Packages
> [ x ] DISCLAIMER, LICENSE, and NOTICE are consistent with ASF and Incubator Policy
> [ x ] CHANGELOG included with release distribution
> [ x ] All Source Files Have Correct ASF Headers
> [ x ] No Unexpected Binary Files in Source Release Packages
> 
> Please feel free to evaluate as you VOTE. See the thread below for the interim summary of VOTEs on dev@
> 
> VOTE details follow:
> 
> Please VOTE on the Apache Flagon (Incubating) 2.0.2 Release Candidate # 1
> 
> This VOTE has passed successfully within the Apache Flagon community. We are now posting the VOTE on general@ as required by Apache Release Management policies. 
> 
> Interim RESULT on dev@ are as follows:
> 
> [+1] 7  
> Joshua Poore
> Rob Foley (`Confused`)
> Laura Mariano
> Furkan Kamaci*
> Arthi Vezhavendan
> Tim Allison*
> Dave Meikle*
> 
> [0] 0
> 
> [-1]
> 
> *Binding IPMC/PPMC Mentor VOTE
> 
> The VOTE thread on dev@ can be found here: https://lists.apache.org/thread.html/1d0efb2a17b1b1a3bb83a6bf882f994000f7d9db316f8b244db54076@%3Cdev.flagon.apache.org%3E <https://lists.apache.org/thread.html/1d0efb2a17b1b1a3bb83a6bf882f994000f7d9db316f8b244db54076@%3Cdev.flagon.apache.org%3E>
> 
> VOTE details follow:
> 
> About Flagon: http://flagon.incubator.apache.org/ <http://flagon.incubator.apache.org/> <http://flagon.incubator.apache.org/ <http://flagon.incubator.apache.org/>> 
> 
> This Patch release includes :
> 
> 	• Updates to package.json and package-lock.json to resolve downstream Prototype Pollution vulnerabilities in dev dependencies
> 	• Updates to package.json and package-lock.json to modernize deprecated npm modules
> 	• Minor updates to README documentation for UserALE.js' Example Test Utilities.
> 
> We solved 11 issues: https://issues.apache.org/jira/projects/FLAGON/versions/12345954 <https://issues.apache.org/jira/projects/FLAGON/versions/12345954><https://issues.apache.org/jira/projects/FLAGON/versions/12345954 <https://issues.apache.org/jira/projects/FLAGON/versions/12345954>>
> 
> Git source tag (43de2fc1e1c5d5e1a83119a91947f7bbe6d313f3): https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019 <https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019> <https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019 <https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019>>
> 
> Staging repo: https://dist.apache.org/repos/dist/dev/incubator/flagon/ <https://dist.apache.org/repos/dist/dev/incubator/flagon/>
> 
> Source Release Artifacts: https://dist.apache.org/repos/dist/dev/incubator/flagon/apache-flagon-useralejs-incubating-2.0.2-RC1/ <https://dist.apache.org/repos/dist/dev/incubator/flagon/apache-flagon-useralejs-incubating-2.0.2-RC1/> 
> 
> PGP release keys (signed using F937rFAE3FCADF6E): https://dist.apache.org/repos/dist/release/incubator/flagon/KEYS <https://dist.apache.org/repos/dist/release/incubator/flagon/KEYS>
> 
> Reference the UserALE.js testing framework to assist in your unit and integration tests: https://cwiki.apache.org/confluence/display/FLAGON/UserALE.js+Testing+Framework <https://cwiki.apache.org/confluence/display/FLAGON/UserALE.js+Testing+Framework>
> 
> Link to Successful Jenkins Build(s): https://builds.apache.org/job/useralejs-ci/91/ <https://builds.apache.org/job/useralejs-ci/91/>
> 
> Vote will be open for 72 hours. Please VOTE as follows: 
> 
> [ ] +1, let's get it released!!!
> [ ] +/-0, fine, but consider to fix few issues before...
> [ ] -1, nope, because... (and please explain why)
> 
> Thank you to everyone that is able to VOTE as well as everyone that contributed to Apache Flagon 2.0.0
> 
> Thanks,
> 
> Josh
> 
>> On Aug 14, 2019, at 8:27 AM, Joshua Poore <po...@me.com.INVALID> wrote:
>> 
>> Hi Justin,
>> 
>> Please clarify your VOTE. Are we at -1 or 0 from you? If its a 0 - "consider fixing a few issues”. I can easily roll a new release with DISCLAIMERS in bin push as new release package so that this issue can be vetted prior to release, but doesn’t require another VOTE altogether.
>> 
>> Josh
>> 
>>> On Aug 13, 2019, at 11:58 PM, Justin Mclean <ju...@classsoftware.com> wrote:
>>> 
>>> Hi,
>>> 
>>> +1 (binding) on the source release, but sorry it’s -1 (binding) for the binaries as they are missing the DISCLAIMER file [2]
>>> 
>>> You might want to consider using a checklist when checking releases [1]. Also when voting on release it a good idea to list what you checked rather than just saying +1.
>>> 
>>> I checked:
>>> - incubating in name
>>> - signatures and hashes fine
>>> - DISCLAIMER in source but not in binary releases
>>> - LICENSE and NOTICE fine
>>> - all source files have ASF headers
>>> - no unexpected binary files in source release
>>> 
>>> There also no need to put the KEYS fine inside the release, it's sort of a bit late to find it there after you unzipped it :-)
>>> 
>>> Thanks,
>>> Justin
>>> 
>>> 1. https://cwiki.apache.org/confluence/display/INCUBATOR/Incubator+Release+Checklist
>>> 2. https://incubator.apache.org/policy/incubation.html#disclaimers
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>>> For additional commands, e-mail: general-help@incubator.apache.org
>>> 
>> 
>> 
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>> For additional commands, e-mail: general-help@incubator.apache.org
>> 
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org

[RESULT] was [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by Joshua Poore <po...@apache.org>.

All,

The VOTE to Release Apache Flagon UserALE.js (Incubating) v2.0.2 has concluded. Thanks to all who voted.

This VOTE has passed successfully within the Apache Flagon community and the Incubator Project community. 

The VOTE tally is as follows:

[+1] 8  
Joshua Poore
Rob Foley (`Confused`)
Laura Mariano
Furkan Kamaci*
Arthi Vezhavendan
Tim Allison*
Dave Meikle*
Justin McLean*

[0] 0

[-1]

*Binding IPMC VOTE

The Apache Flagon community will progress to remaining release processes.


Thanks,

Joshua Poore (FLAGON PPMC)


> On Aug 20, 2019, at 12:40 AM, Dave Fisher <wa...@comcast.net> wrote:
> 
> You have enough IPMC votes from your mentors.
> 
> I think you are good.
> 
> Sent from my iPhone
> 
>> On Aug 19, 2019, at 7:36 PM, Joshua Poore <po...@me.com.invalid> wrote:
>> 
>> Hi Folks—
>> 
>> Just a reminder to VOTE on Apache Flagon UserALE.js (Incubating) v2.0.2. 
>> 
>> We’ve passed the VOTE on dev@, still looking for a few binding VOTE on general to release this security patch. 
>> 
>> Many thanks!
>> 
>> Josh
>> 
>>> On Aug 17, 2019, at 6:16 PM, Justin Mclean <ju...@classsoftware.com> wrote:
>>> 
>>> Hi,
>>> 
>>> +1(binding)
>>> 
>>> I checked the new binaries and they container the DISCLAIMER and signatures and hashes match. It would off been easier to review if this was another RC as then an easy comparison could be made with the previous files.
>>> 
>>> Thanks,
>>> Justin
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>>> For additional commands, e-mail: general-help@incubator.apache.org
>>> 
>> 
>> 
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>> For additional commands, e-mail: general-help@incubator.apache.org
>> 
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>

Re: [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by Joshua Poore <po...@apache.org>.

Ok. Thanks for guidance and clarification. 



> On Aug 21, 2019, at 12:45 AM, Justin Mclean <ju...@classsoftware.com> wrote:
> 
> Hi,
> 
>> I asked you about this after you caught the missing disclaimer, but didn’t hear back inside of 24 hours so I made a judgement call—I hope I did the right thing. 
> 
> Well it not the wrong thing, it just something that I don;t think has happened before.
> 
>> My logic in this case was that because our Disclaimer was in src, and there were no issues with the Disclaimer itself, repackaging the RC with the Disclaimer in the .bin files would not have required any new commits to files. +1s from dev@ (especially Binding) would have indicated approval of the Disclaimer as well. 
> 
> Change the binary changes the signatures and hashes, if teh project was a TLP IMO that would require another vote.
> 
>> We had +3 IPMC VOTES on dev@, however, to date we only have +2 on general@. Do I need one more on general@?
> 
> You can carry over the IPMC votes.
> 
> Thanks,
> Justin
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org

Re: [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by Justin Mclean <ju...@classsoftware.com>.

Hi,

> I asked you about this after you caught the missing disclaimer, but didn’t hear back inside of 24 hours so I made a judgement call—I hope I did the right thing. 

Well it not the wrong thing, it just something that I don;t think has happened before.

> My logic in this case was that because our Disclaimer was in src, and there were no issues with the Disclaimer itself, repackaging the RC with the Disclaimer in the .bin files would not have required any new commits to files. +1s from dev@ (especially Binding) would have indicated approval of the Disclaimer as well. 

Change the binary changes the signatures and hashes, if teh project was a TLP IMO that would require another vote.

> We had +3 IPMC VOTES on dev@, however, to date we only have +2 on general@. Do I need one more on general@?

You can carry over the IPMC votes.

Thanks,
Justin
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org

Re: [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by Joshua Poore <po...@apache.org>.

Hi Justin,

Thanks for the attention on this VOTE. 

I asked you about this after you caught the missing disclaimer, but didn’t hear back inside of 24 hours so I made a judgement call—I hope I did the right thing. Would appreciate any guidance on my logic here.

My logic in this case was that because our Disclaimer was in src, and there were no issues with the Disclaimer itself, repackaging the RC with the Disclaimer in the .bin files would not have required any new commits to files. +1s from dev@ (especially Binding) would have indicated approval of the Disclaimer as well. 

Were it the case that I needed to modify file content for compliance, I would have had to change the commit stream and push tags forward. In the case, I would have certainly kicked back to dev@ to VOTE again.

Also, a little confused about Dave Fisher’s response in our VOTE thread. He said, 

    "You have enough IPMC votes from your mentors.

    I think you are good.”

We had +3 IPMC VOTES on dev@, however, to date we only have +2 on general@. Do I need one more on general@?

Josh

> On Aug 21, 2019, at 12:09 AM, Justin Mclean <ju...@classsoftware.com> wrote:
> 
> Hi,
> 
> It's a little unusual as they voted before the binary was changed so this really should have been two seperate vote threads. But I ‘m fine if you count them this time.
> 
> Thanks,
> Justin
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>

Re: [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by Justin Mclean <ju...@classsoftware.com>.

Hi,

It's a little unusual as they voted before the binary was changed so this really should have been two seperate vote threads. But I ‘m fine if you count them this time.

Thanks,
Justin
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org

[RESULT] was [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by Joshua Poore <po...@apache.org>.

All,

The VOTE to Release Apache Flagon UserALE.js (Incubating) v2.0.2 has concluded. Thanks to all who voted.

This VOTE has passed successfully within the Apache Flagon community and the Incubator Project community. 

The VOTE tally is as follows:

[+1] 8  
Joshua Poore
Rob Foley (`Confused`)
Laura Mariano
Furkan Kamaci*
Arthi Vezhavendan
Tim Allison*
Dave Meikle*
Justin McLean*

[0] 0

[-1]

*Binding IPMC VOTE

The Apache Flagon community will progress to remaining release processes.


Thanks,

Joshua Poore (FLAGON PPMC)


> On Aug 20, 2019, at 12:40 AM, Dave Fisher <wa...@comcast.net> wrote:
> 
> You have enough IPMC votes from your mentors.
> 
> I think you are good.
> 
> Sent from my iPhone
> 
>> On Aug 19, 2019, at 7:36 PM, Joshua Poore <po...@me.com.invalid> wrote:
>> 
>> Hi Folks—
>> 
>> Just a reminder to VOTE on Apache Flagon UserALE.js (Incubating) v2.0.2. 
>> 
>> We’ve passed the VOTE on dev@, still looking for a few binding VOTE on general to release this security patch. 
>> 
>> Many thanks!
>> 
>> Josh
>> 
>>> On Aug 17, 2019, at 6:16 PM, Justin Mclean <ju...@classsoftware.com> wrote:
>>> 
>>> Hi,
>>> 
>>> +1(binding)
>>> 
>>> I checked the new binaries and they container the DISCLAIMER and signatures and hashes match. It would off been easier to review if this was another RC as then an easy comparison could be made with the previous files.
>>> 
>>> Thanks,
>>> Justin
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>>> For additional commands, e-mail: general-help@incubator.apache.org
>>> 
>> 
>> 
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>> For additional commands, e-mail: general-help@incubator.apache.org
>> 
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>

Re: [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by Dave Fisher <wa...@comcast.net>.

You have enough IPMC votes from your mentors.

I think you are good.

Sent from my iPhone

> On Aug 19, 2019, at 7:36 PM, Joshua Poore <po...@me.com.invalid> wrote:
> 
> Hi Folks—
> 
> Just a reminder to VOTE on Apache Flagon UserALE.js (Incubating) v2.0.2. 
> 
> We’ve passed the VOTE on dev@, still looking for a few binding VOTE on general to release this security patch. 
> 
> Many thanks!
> 
> Josh
> 
>> On Aug 17, 2019, at 6:16 PM, Justin Mclean <ju...@classsoftware.com> wrote:
>> 
>> Hi,
>> 
>> +1(binding)
>> 
>> I checked the new binaries and they container the DISCLAIMER and signatures and hashes match. It would off been easier to review if this was another RC as then an easy comparison could be made with the previous files.
>> 
>> Thanks,
>> Justin
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>> For additional commands, e-mail: general-help@incubator.apache.org
>> 
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org

Re: [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by Joshua Poore <po...@me.com.INVALID>.

Hi Folks—

Just a reminder to VOTE on Apache Flagon UserALE.js (Incubating) v2.0.2. 

We’ve passed the VOTE on dev@, still looking for a few binding VOTE on general to release this security patch. 

Many thanks!

Josh

> On Aug 17, 2019, at 6:16 PM, Justin Mclean <ju...@classsoftware.com> wrote:
> 
> Hi,
> 
> +1(binding)
> 
> I checked the new binaries and they container the DISCLAIMER and signatures and hashes match. It would off been easier to review if this was another RC as then an easy comparison could be made with the previous files.
> 
> Thanks,
> Justin
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org

Re: [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by Justin Mclean <ju...@classsoftware.com>.

Hi,

+1(binding)

I checked the new binaries and they container the DISCLAIMER and signatures and hashes match. It would off been easier to review if this was another RC as then an easy comparison could be made with the previous files.

Thanks,
Justin
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org

Re: [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by Joshua Poore <po...@apache.org>.

General@

Following Justin’s comment below—Disclaimer missing from .bin release packages—I have repackaged release candidate #1 to include Disclaimers and pushed to https://dist.apache.org/repos/dist/dev/incubator/flagon/ <https://dist.apache.org/repos/dist/dev/incubator/flagon/>.

As this issue was a file omission and did not affect source or build artifacts, the commit reference used for voting in dev@ have not changed, nor have git tags for the release candidate. .bin packages now include our Disclaimer.

As a matter of good practice I have re-evaluated the repackaged release candidate against the following:

[ x ] Build and Unit Tests Pass
[ x ] Integration Tests Pass
[ x ] "Incubating" in References to Project and Distribution File Names
[ x ] Signatures and Hashes Match Keys
[ x ] DISCLAIMER, LICENSE, and NOTICE Files in Source and Binary Release Packages
[ x ] DISCLAIMER, LICENSE, and NOTICE are consistent with ASF and Incubator Policy
[ x ] CHANGELOG included with release distribution
[ x ] All Source Files Have Correct ASF Headers
[ x ] No Unexpected Binary Files in Source Release Packages

Please feel free to evaluate as you VOTE. See the thread below for the interim summary of VOTEs on dev@

VOTE details follow:

Please VOTE on the Apache Flagon (Incubating) 2.0.2 Release Candidate # 1

This VOTE has passed successfully within the Apache Flagon community. We are now posting the VOTE on general@ as required by Apache Release Management policies. 

Interim RESULT on dev@ are as follows:

[+1] 7  
Joshua Poore
Rob Foley (`Confused`)
Laura Mariano
Furkan Kamaci*
Arthi Vezhavendan
Tim Allison*
Dave Meikle*

[0] 0

[-1]

*Binding IPMC/PPMC Mentor VOTE

The VOTE thread on dev@ can be found here: https://lists.apache.org/thread.html/1d0efb2a17b1b1a3bb83a6bf882f994000f7d9db316f8b244db54076@%3Cdev.flagon.apache.org%3E <https://lists.apache.org/thread.html/1d0efb2a17b1b1a3bb83a6bf882f994000f7d9db316f8b244db54076@%3Cdev.flagon.apache.org%3E>

VOTE details follow:

About Flagon: http://flagon.incubator.apache.org/ <http://flagon.incubator.apache.org/> <http://flagon.incubator.apache.org/ <http://flagon.incubator.apache.org/>> 

This Patch release includes :

	• Updates to package.json and package-lock.json to resolve downstream Prototype Pollution vulnerabilities in dev dependencies
	• Updates to package.json and package-lock.json to modernize deprecated npm modules
	• Minor updates to README documentation for UserALE.js' Example Test Utilities.

We solved 11 issues: https://issues.apache.org/jira/projects/FLAGON/versions/12345954 <https://issues.apache.org/jira/projects/FLAGON/versions/12345954><https://issues.apache.org/jira/projects/FLAGON/versions/12345954 <https://issues.apache.org/jira/projects/FLAGON/versions/12345954>>

Git source tag (43de2fc1e1c5d5e1a83119a91947f7bbe6d313f3): https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019 <https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019> <https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019 <https://github.com/apache/incubator-flagon-useralejs/releases/tag/2.0.2-RC1-08_06_2019>>

Staging repo: https://dist.apache.org/repos/dist/dev/incubator/flagon/ <https://dist.apache.org/repos/dist/dev/incubator/flagon/>

Source Release Artifacts: https://dist.apache.org/repos/dist/dev/incubator/flagon/apache-flagon-useralejs-incubating-2.0.2-RC1/ <https://dist.apache.org/repos/dist/dev/incubator/flagon/apache-flagon-useralejs-incubating-2.0.2-RC1/> 

PGP release keys (signed using F937rFAE3FCADF6E): https://dist.apache.org/repos/dist/release/incubator/flagon/KEYS <https://dist.apache.org/repos/dist/release/incubator/flagon/KEYS>

Reference the UserALE.js testing framework to assist in your unit and integration tests: https://cwiki.apache.org/confluence/display/FLAGON/UserALE.js+Testing+Framework <https://cwiki.apache.org/confluence/display/FLAGON/UserALE.js+Testing+Framework>

Link to Successful Jenkins Build(s): https://builds.apache.org/job/useralejs-ci/91/ <https://builds.apache.org/job/useralejs-ci/91/>

Vote will be open for 72 hours. Please VOTE as follows: 

[ ] +1, let's get it released!!!
[ ] +/-0, fine, but consider to fix few issues before...
[ ] -1, nope, because... (and please explain why)

Thank you to everyone that is able to VOTE as well as everyone that contributed to Apache Flagon 2.0.0

Thanks,

Josh

> On Aug 14, 2019, at 8:27 AM, Joshua Poore <po...@me.com.INVALID> wrote:
> 
> Hi Justin,
> 
> Please clarify your VOTE. Are we at -1 or 0 from you? If its a 0 - "consider fixing a few issues”. I can easily roll a new release with DISCLAIMERS in bin push as new release package so that this issue can be vetted prior to release, but doesn’t require another VOTE altogether.
> 
> Josh
> 
>> On Aug 13, 2019, at 11:58 PM, Justin Mclean <ju...@classsoftware.com> wrote:
>> 
>> Hi,
>> 
>> +1 (binding) on the source release, but sorry it’s -1 (binding) for the binaries as they are missing the DISCLAIMER file [2]
>> 
>> You might want to consider using a checklist when checking releases [1]. Also when voting on release it a good idea to list what you checked rather than just saying +1.
>> 
>> I checked:
>> - incubating in name
>> - signatures and hashes fine
>> - DISCLAIMER in source but not in binary releases
>> - LICENSE and NOTICE fine
>> - all source files have ASF headers
>> - no unexpected binary files in source release
>> 
>> There also no need to put the KEYS fine inside the release, it's sort of a bit late to find it there after you unzipped it :-)
>> 
>> Thanks,
>> Justin
>> 
>> 1. https://cwiki.apache.org/confluence/display/INCUBATOR/Incubator+Release+Checklist
>> 2. https://incubator.apache.org/policy/incubation.html#disclaimers
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>> For additional commands, e-mail: general-help@incubator.apache.org
>> 
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>

Re: [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by Joshua Poore <po...@me.com.INVALID>.

Hi Justin,

Please clarify your VOTE. Are we at -1 or 0 from you? If its a 0 - "consider fixing a few issues”. I can easily roll a new release with DISCLAIMERS in bin push as new release package so that this issue can be vetted prior to release, but doesn’t require another VOTE altogether.

Josh

> On Aug 13, 2019, at 11:58 PM, Justin Mclean <ju...@classsoftware.com> wrote:
> 
> Hi,
> 
> +1 (binding) on the source release, but sorry it’s -1 (binding) for the binaries as they are missing the DISCLAIMER file [2]
> 
> You might want to consider using a checklist when checking releases [1]. Also when voting on release it a good idea to list what you checked rather than just saying +1.
> 
> I checked:
> - incubating in name
> - signatures and hashes fine
> - DISCLAIMER in source but not in binary releases
> - LICENSE and NOTICE fine
> - all source files have ASF headers
> - no unexpected binary files in source release
> 
> There also no need to put the KEYS fine inside the release, it's sort of a bit late to find it there after you unzipped it :-)
> 
> Thanks,
> Justin
> 
> 1. https://cwiki.apache.org/confluence/display/INCUBATOR/Incubator+Release+Checklist
> 2. https://incubator.apache.org/policy/incubation.html#disclaimers
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org

Re: [VOTE] Release Apache Flagon UserALE.js (Incubating) v2.0.2

Posted by Justin Mclean <ju...@classsoftware.com>.

Hi,

+1 (binding) on the source release, but sorry it’s -1 (binding) for the binaries as they are missing the DISCLAIMER file [2]

You might want to consider using a checklist when checking releases [1]. Also when voting on release it a good idea to list what you checked rather than just saying +1.

I checked:
- incubating in name
- signatures and hashes fine
- DISCLAIMER in source but not in binary releases
- LICENSE and NOTICE fine
- all source files have ASF headers
- no unexpected binary files in source release

There also no need to put the KEYS fine inside the release, it's sort of a bit late to find it there after you unzipped it :-)

Thanks,
Justin

1. https://cwiki.apache.org/confluence/display/INCUBATOR/Incubator+Release+Checklist
2. https://incubator.apache.org/policy/incubation.html#disclaimers
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org