You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by Stefan Seelmann <ma...@stefan-seelmann.de> on 2021/07/18 06:58:32 UTC
[VOTE] Apache Directory Studio 2.0.0.v20210717-M17 release
Hi all,
this is a vote for the next Studio release.
This is mainly a bugfix and security enhancement release. The full
release notes are here:
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310590&version=12349721
Git tag:
https://gitbox.apache.org/repos/asf?p=directory-studio.git;a=shortlog;h=refs/tags/2.0.0.v20210717-M17
https://github.com/apache/directory-studio/tree/2.0.0.v20210717-M17
Nexus staging repository:
https://repository.apache.org/content/repositories/orgapachedirectory-1204/
Distribution packages (source, binary archives and installers, update site):
https://dist.apache.org/repos/dist/dev/directory/studio/2.0.0.v20210717-M17/
User guides:
https://nightlies.apache.org/directory/studio/2.0.0.v20210717-M17/userguide/
Please cast your vote:
[ ] +1 : Yes, release Apache Directory Studio 2.0.0.v20210717-M17
[ ] ± 0 : I don't care
[ ] -1 : No, don't release Apache Directory Studio 2.0.0.v20210717-M17
Kind Regards,
Stefan
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Apache Directory Studio 2.0.0.v20210717-M17 release
Posted by Emmanuel Lécharny <el...@gmail.com>.
Rectification:
https://github.com/apache/sling-parent/blob/3fdb306971308cf471ee85c72fb86b0bc4087d69/sling-parent/pom.xml#L373
This is how Sling did.
On 22/07/2021 02:15, Emmanuel Lécharny wrote:
>
>
> On 21/07/2021 18:47, Stefan Seelmann wrote:
>> On 7/18/21 11:43 PM, Emmanuel Lécharny wrote:
>>> My +1.
>>>
>>> A few remarks:
>>> - your GPG keys does not seem to be trusted (this is when I use the asc
>>> file to check the signature). I typically get:
>>>
>>> $ gpg --verify
>>> ~/Downloads/org.apache.directory.studio.parent-2.0.0.v20210717-M17-source-release.zip.asc
>>>
>>> org.apache.directory.studio.parent-2.0.0.v20210717-M17-source-release.zip
>>>
>>> gpg: Signature made Sat Jul 17 19:59:37 2021 CEST
>>> gpg: using RSA key
>>> 63CE676698B26D3A36D77527223BD93328686142
>>> gpg: Good signature from "Stefan Seelmann (CODE SIGNING KEY)
>>> <se...@apache.org>" [unknown]
>>> gpg: WARNING: This key is not certified with a trusted signature!
>>> gpg: There is no indication that the signature belongs to the
>>> owner.
>>> Primary key fingerprint: 63CE 6766 98B2 6D3A 36D7 7527 223B D933
>>> 2868 6142
>>>
>>> Not sure that is a big deal.
>>
>> I never attended a key signing party with that key, so it's not in the
>> web-of-trust. And you probably also didn't mark my key as trusted (which
>> you shouldn't do). So based on the KEYS file that you imported only the
>> valid signature can be verified. I think it's plain normal and conform
>> to https://infra.apache.org/release-signing.html.
>>
>>> - The packages are signed using asc, SHA1 and MD5. The two last are
>>> deprecated and should be replaced by SHA 256/512
>>
>> Hm, but SHA1 and MD5 are only used for the artifacts in the Maven repo,
>> right? The packages at
>> https://dist.apache.org/repos/dist/dev/directory/studio/2.0.0.v20210717-M17/
>>
>> only use SHA 256 and SHA 512. Is there a way now to also use the
>> stronger hash methods with Maven?
>
> I think it's now supported with maven apache parent 24.
>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
>> For additional commands, e-mail: dev-help@directory.apache.org
>>
>
--
*Emmanuel Lécharny - CTO* 205 Promenade des Anglais – 06200 NICE
T. +33 (0)4 89 97 36 50
P. +33 (0)6 08 33 32 61
emmanuel.lecharny@busit.com https://www.busit.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Apache Directory Studio 2.0.0.v20210717-M17 release
Posted by Emmanuel Lécharny <el...@gmail.com>.
On 21/07/2021 18:47, Stefan Seelmann wrote:
> On 7/18/21 11:43 PM, Emmanuel Lécharny wrote:
>> My +1.
>>
>> A few remarks:
>> - your GPG keys does not seem to be trusted (this is when I use the asc
>> file to check the signature). I typically get:
>>
>> $ gpg --verify
>> ~/Downloads/org.apache.directory.studio.parent-2.0.0.v20210717-M17-source-release.zip.asc
>> org.apache.directory.studio.parent-2.0.0.v20210717-M17-source-release.zip
>> gpg: Signature made Sat Jul 17 19:59:37 2021 CEST
>> gpg: using RSA key 63CE676698B26D3A36D77527223BD93328686142
>> gpg: Good signature from "Stefan Seelmann (CODE SIGNING KEY)
>> <se...@apache.org>" [unknown]
>> gpg: WARNING: This key is not certified with a trusted signature!
>> gpg: There is no indication that the signature belongs to the
>> owner.
>> Primary key fingerprint: 63CE 6766 98B2 6D3A 36D7 7527 223B D933 2868 6142
>>
>> Not sure that is a big deal.
>
> I never attended a key signing party with that key, so it's not in the
> web-of-trust. And you probably also didn't mark my key as trusted (which
> you shouldn't do). So based on the KEYS file that you imported only the
> valid signature can be verified. I think it's plain normal and conform
> to https://infra.apache.org/release-signing.html.
>
>> - The packages are signed using asc, SHA1 and MD5. The two last are
>> deprecated and should be replaced by SHA 256/512
>
> Hm, but SHA1 and MD5 are only used for the artifacts in the Maven repo,
> right? The packages at
> https://dist.apache.org/repos/dist/dev/directory/studio/2.0.0.v20210717-M17/
> only use SHA 256 and SHA 512. Is there a way now to also use the
> stronger hash methods with Maven?
I think it's now supported with maven apache parent 24.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
> For additional commands, e-mail: dev-help@directory.apache.org
>
--
*Emmanuel Lécharny - CTO* 205 Promenade des Anglais – 06200 NICE
T. +33 (0)4 89 97 36 50
P. +33 (0)6 08 33 32 61
emmanuel.lecharny@busit.com https://www.busit.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Apache Directory Studio 2.0.0.v20210717-M17 release
Posted by Stefan Seelmann <ma...@stefan-seelmann.de>.
On 7/18/21 11:43 PM, Emmanuel Lécharny wrote:
> My +1.
>
> A few remarks:
> - your GPG keys does not seem to be trusted (this is when I use the asc
> file to check the signature). I typically get:
>
> $ gpg --verify
> ~/Downloads/org.apache.directory.studio.parent-2.0.0.v20210717-M17-source-release.zip.asc
> org.apache.directory.studio.parent-2.0.0.v20210717-M17-source-release.zip
> gpg: Signature made Sat Jul 17 19:59:37 2021 CEST
> gpg: using RSA key 63CE676698B26D3A36D77527223BD93328686142
> gpg: Good signature from "Stefan Seelmann (CODE SIGNING KEY)
> <se...@apache.org>" [unknown]
> gpg: WARNING: This key is not certified with a trusted signature!
> gpg: There is no indication that the signature belongs to the
> owner.
> Primary key fingerprint: 63CE 6766 98B2 6D3A 36D7 7527 223B D933 2868 6142
>
> Not sure that is a big deal.
I never attended a key signing party with that key, so it's not in the
web-of-trust. And you probably also didn't mark my key as trusted (which
you shouldn't do). So based on the KEYS file that you imported only the
valid signature can be verified. I think it's plain normal and conform
to https://infra.apache.org/release-signing.html.
> - The packages are signed using asc, SHA1 and MD5. The two last are
> deprecated and should be replaced by SHA 256/512
Hm, but SHA1 and MD5 are only used for the artifacts in the Maven repo,
right? The packages at
https://dist.apache.org/repos/dist/dev/directory/studio/2.0.0.v20210717-M17/
only use SHA 256 and SHA 512. Is there a way now to also use the
stronger hash methods with Maven?
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Apache Directory Studio 2.0.0.v20210717-M17 release
Posted by Emmanuel Lécharny <el...@gmail.com>.
My +1.
A few remarks:
- your GPG keys does not seem to be trusted (this is when I use the asc
file to check the signature). I typically get:
$ gpg --verify
~/Downloads/org.apache.directory.studio.parent-2.0.0.v20210717-M17-source-release.zip.asc
org.apache.directory.studio.parent-2.0.0.v20210717-M17-source-release.zip
gpg: Signature made Sat Jul 17 19:59:37 2021 CEST
gpg: using RSA key 63CE676698B26D3A36D77527223BD93328686142
gpg: Good signature from "Stefan Seelmann (CODE SIGNING KEY)
<se...@apache.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the
owner.
Primary key fingerprint: 63CE 6766 98B2 6D3A 36D7 7527 223B D933 2868 6142
Not sure that is a big deal.
- The packages are signed using asc, SHA1 and MD5. The two last are
deprecated and should be replaced by SHA 256/512
None blocker, though.
Many thanks Stefan !
On 18/07/2021 08:58, Stefan Seelmann wrote:
> Hi all,
>
> this is a vote for the next Studio release.
>
> This is mainly a bugfix and security enhancement release. The full
> release notes are here:
> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310590&version=12349721
>
> Git tag:
> https://gitbox.apache.org/repos/asf?p=directory-studio.git;a=shortlog;h=refs/tags/2.0.0.v20210717-M17
> https://github.com/apache/directory-studio/tree/2.0.0.v20210717-M17
>
> Nexus staging repository:
> https://repository.apache.org/content/repositories/orgapachedirectory-1204/
>
> Distribution packages (source, binary archives and installers, update site):
> https://dist.apache.org/repos/dist/dev/directory/studio/2.0.0.v20210717-M17/
>
> User guides:
> https://nightlies.apache.org/directory/studio/2.0.0.v20210717-M17/userguide/
>
> Please cast your vote:
> [ ] +1 : Yes, release Apache Directory Studio 2.0.0.v20210717-M17
> [ ] ± 0 : I don't care
> [ ] -1 : No, don't release Apache Directory Studio 2.0.0.v20210717-M17
>
> Kind Regards,
> Stefan
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
> For additional commands, e-mail: dev-help@directory.apache.org
>
--
*Emmanuel Lécharny - CTO* 205 Promenade des Anglais – 06200 NICE
T. +33 (0)4 89 97 36 50
P. +33 (0)6 08 33 32 61
emmanuel.lecharny@busit.com https://www.busit.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Apache Directory Studio 2.0.0.v20210717-M17 release
Posted by Shawn McKinney <sm...@apache.org>.
+1, downloaded bin, verified sigs, running as my default studio instance.
Also built from source but had to stop the tests as it overpowers the cpu on my dev vm.
Next time I may download to a beefier vm.
—
Shawn
> On Jul 18, 2021, at 1:58 AM, Stefan Seelmann <ma...@stefan-seelmann.de> wrote:
>
> Hi all,
>
> this is a vote for the next Studio release.
>
> This is mainly a bugfix and security enhancement release. The full
> release notes are here:
> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310590&version=12349721
>
> Git tag:
> https://gitbox.apache.org/repos/asf?p=directory-studio.git;a=shortlog;h=refs/tags/2.0.0.v20210717-M17
> https://github.com/apache/directory-studio/tree/2.0.0.v20210717-M17
>
> Nexus staging repository:
> https://repository.apache.org/content/repositories/orgapachedirectory-1204/
>
> Distribution packages (source, binary archives and installers, update site):
> https://dist.apache.org/repos/dist/dev/directory/studio/2.0.0.v20210717-M17/
>
> User guides:
> https://nightlies.apache.org/directory/studio/2.0.0.v20210717-M17/userguide/
>
> Please cast your vote:
> [ ] +1 : Yes, release Apache Directory Studio 2.0.0.v20210717-M17
> [ ] ± 0 : I don't care
> [ ] -1 : No, don't release Apache Directory Studio 2.0.0.v20210717-M17
>
> Kind Regards,
> Stefan
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
> For additional commands, e-mail: dev-help@directory.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
[RESULT][VOTE] Apache Directory Studio 2.0.0.v20210717-M17 release
Posted by Stefan Seelmann <ma...@stefan-seelmann.de>.
Closing with 3 binding votes from Shawn, Emmanuel and me.
On 7/18/21 8:58 AM, Stefan Seelmann wrote:
> Hi all,
>
> this is a vote for the next Studio release.
>
> This is mainly a bugfix and security enhancement release. The full
> release notes are here:
> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310590&version=12349721
>
> Git tag:
> https://gitbox.apache.org/repos/asf?p=directory-studio.git;a=shortlog;h=refs/tags/2.0.0.v20210717-M17
> https://github.com/apache/directory-studio/tree/2.0.0.v20210717-M17
>
> Nexus staging repository:
> https://repository.apache.org/content/repositories/orgapachedirectory-1204/
>
> Distribution packages (source, binary archives and installers, update site):
> https://dist.apache.org/repos/dist/dev/directory/studio/2.0.0.v20210717-M17/
>
> User guides:
> https://nightlies.apache.org/directory/studio/2.0.0.v20210717-M17/userguide/
>
> Please cast your vote:
> [ ] +1 : Yes, release Apache Directory Studio 2.0.0.v20210717-M17
> [ ] ± 0 : I don't care
> [ ] -1 : No, don't release Apache Directory Studio 2.0.0.v20210717-M17
>
> Kind Regards,
> Stefan
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
> For additional commands, e-mail: dev-help@directory.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org