Re: [VOTE] Release Apache Portals Pluto 3.0.1

[Woonsan Ko <wo...@apache.org>]

Hi,

I'm not sure if the release includes the source packages properly.
"The fundamental requirement for a release is that it consist of the
necessary source code to build the project." [1]
See my comments inline for each package.

[1] http://www.apache.org/dev/release-publishing.html


On Fri, May 11, 2018 at 3:06 PM, Neil Griffin
<ne...@portletfaces.org> wrote:
> Dear Apache Portals Pluto Team and community,
>
> I've staged a release candidate for the new Apache Portals Pluto 3.0.1
> release.
>
> This release candidate includes:
>
> * Fully compliant Reference Implementation of the new Portlet 3.0
> Specification per JCR-362
>     https://www.jcp.org/en/jsr/detail?id=362
> * Fully completed (and corrected) TCK (Test Compatibility Kit) for Portlet
> Spec 3.0
> * Updated portlet-api with associated Javadoc improvements
> * General bugfixes
> * Updated archetypes
>
> Please review the release candidate for this project which is spread
> across the following THREE maven staging repositories:
>
> 1) portlet-api and pluto-portal components and dependencies:
> https://repository.apache.org/content/repositories/orgapacheportals-1018

These do not include source packages to *build* after downloading.
Neither maven artifacts such as pluto-portal-driver-3.0.1-sources.jar
nor GIT tag is qualified as "source code to build the project" in our
releases.
Do those projects not have apache release maven profile or not use the
profile in the release process?

>
> 2) pluto+tomcat bundle:
> https://repository.apache.org/content/repositories/orgapacheportals-1019

This one doesn't include source package either.

>
>     (The bundle can be tested by unzipping it,
>      and running start.sh from the bin directory,
>      then navigating to http://localhost:8080/pluto
>      and login as pluto/pluto.)
>
> 3) maven archetypes:
> https://repository.apache.org/content/repositories/orgapacheportals-1020

These ones have source packages (e.g,
bean-portlet-archetype-3.0.1-source-release.zip) to build in
https://repository.apache.org/content/repositories/orgapacheportals-1020/org/apache/portals/pluto/archetype/bean-portlet-archetype/3.0.1/.
It should have been mentioned in this VOTE E-Mail message with either
the specific staging maven repo link or distribution links in
https://dist.apache.org/repos/dist/dev/portals/... (note /dev/, not
/release/ in pre-official-release steps) after copying those to the
directory in the release process, IMO.
But I notice that this step is missing in [2] too as a pre-voting
step. It has a post-vote step to copy those though. I believe it's
better to copy those source package zip file and signature files in
https://dist.apache.org/repos/dist/dev/... when proposing votes
because we need to validate each source package builds properly, has
been signed properly, etc.

[2] https://github.com/apache/portals-pluto/blob/master/RELEASE-PROCEDURE.txt

I believe we should fix the two problems before proceeding: (a)
include source artifacts in portlet-api and pluto-poartal components,
(b) include source artifacts in pluto+tomcat bundle.
Solution would be just either adding apache release maven profile in
those projects or using it in the release process.

Please let me know if I miss anything.

Regards,

Woonsan


>
> The Release Notes are available here:
> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=10560&version=12338908
>
> The KEYS file to verify the release artifacts signature can be found here:
>
> https://dist.apache.org/repos/dist/release/portals/pluto/KEYS
>
> Please review the release candidates and vote on releasing Apache Portals
> Pluto 3.0.1
>
> Seeing as how I am sending this on a Friday, the normal vote of 72 hours
> seems unreasonable. Therefore I would like to extend the vote to 96 hours.
>
> Please cast your vote:
>
> [ ] +1 for Release
> [ ]  0  for Don't care
> [ ] -1 Don't release (do provide a reason then)
>
>
> Best Regards to all,
>
> Neil