Re: [VOTE]: Release Apache Dubbo (Incubating) 2.6.6 [RC1]

[Huxing Zhang <hu...@apache.org>]

Hi,

I vote with:
-1 don’t release the software because the release file does not match with Tag.

I check the following:

 Are release files in correct location? OK

wget https://dist.apache.org/repos/dist/dev/incubator/dubbo/2.6.6/apache-dubbo-incubating-2.6.6-source-release.zip

 Do release files have the word incubating in their name? OK

ls | grep -c incubating

 Are the digital signature and hashes correct? OK

shasum -c apache-dubbo-incubating-2.6.6-source-release.zip.sha512
shasum -c apache-dubbo-incubating-2.6.6-bin-release.zip.sha512
gpg --verify apache-dubbo-incubating-2.6.6-source-release.zip.asc
apache-dubbo-incubating-2.6.6-source-release.zip
gpg --verify apache-dubbo-incubating-2.6.6-bin-release.zip.asc
apache-dubbo-incubating-2.6.6-bin-release.zip

 Does DISCLAIMER file exist? OK
 Do LICENSE and NOTICE files exists? OK
 Is the LICENSE and NOTICE text correct? OK
 Is the NOTICE year correct? OK
 Un-included software dependencies are not mentioned in LICENSE or NOTICE? OK
 License information is not mentioned in NOTICE? OK
Is there any 3rd party code contained inside the release? If so:

 Does the software have a compatible license?  OK
 Are all software licenses mentioned in LICENSE? OK
 Is the full text of the licenses (or pointers to it) in LICENSE?  OK
Is any of this code Apache licensed? Do they have NOTICE files? If so:
 Have relevant parts of those NOTICE files been added to this NOTICE file? OK

 Do all source files have ASF headers?

mvn clean verify -Drat.skip=false

 Do the contents of the release match with what's tagged in version control?

No. There is lots of difference when I run:
diff -r ~/Downloads/apache-dubbo-incubating-2.6.6-source-release incubator-dubbo

But all look good when I run:
diff -r ~/Downloads/apache-dubbo-incubating-2.6.6-source-release
incubator-dubbo --strip-trailing-cr

I guess something went wrong with the line ends.

I pick the root pom file, the shasum is different with Github tag.

shasum -a 512 ~/Downloads/apache-dubbo-incubating-2.6.6-source-release/pom.xml
17f436f5c6d772d9e1ccfc86a3f94a5a2d2e8cea1c1e668814a1daaef453914b51af9d6fefd44afc34472dacb70bf996ee375cd04536324073c825fb4a491a64
 /Users/wangtao/Downloads/apache-dubbo-incubating-2.6.6-source-release/pom.xml

shasum -a 512 incubator-dubbo/pom.xml
6a9ae847cd672c9d6e9a24602460cd768237b8799aa4c48743428fa5853b797df76ca3040821baa70df1ab932aeb6ad9fa071cd18547ae99602528d1bc60e78f
 incubator-dubbo/pom.xml

 Are there any unexpected binary files in the release? No.
 Can you compile from source? Are the instruction clear? Yes.
mvn clean pacakge

Is the issue minor?  No
 Yes  No  Unsure
Could it possibly be fixed in the next release? Yes
 Yes  No  Unsure


On Thu, Feb 28, 2019 at 6:52 PM Minxuan Zhuang <z8...@gmail.com> wrote:
>
> Hello Dubbo Community,
>
> This is a call for vote to release Apache Dubbo (Incubating) version 2.6.6.
>
> The release candidates (RC1):
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/2.6.6
>
> Git tag for the release (RC1):
> https://github.com/apache/incubator-dubbo/tree/dubbo-2.6.6
>
> Hash for the release tag:
> ba7f6f38c36675268ba64f21e97d02bda7a731dc
>
> Release Notes:
> https://github.com/apache/incubator-dubbo/blob/dubbo-2.6.6/CHANGES.md
>
> The artifacts have been signed with Key : DA2108479B0C1E71, which can be
> found in the keys file:
> https://dist.apache.org/repos/dist/dev/incubator/dubbo/KEYS
>
> The vote will be open for at least 72 hours or until necessary number of
> votes are reached.
>
> Please vote accordingly:
>
> [ ] +1 approve
> [ ] +0 no opinion
> [ ] -1 disapprove with the reason
>
> Thanks,
> The Apache Dubbo (Incubating) Team



--
Best Regards！
Huxing