You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@netbeans.apache.org by Eric Barboni <sk...@apache.org> on 2019/11/04 17:54:37 UTC
RE: [DISCUSS] Handling release updates
Hi,
Not sure what the needs exactly.
But If you rebuild a patched NetBeans with a forced version RELEASE112-update1. You can pick the patched nbm you want. And alter pom to put RELEASE112 for dep (you know are were not modified).
Then vote with sources + the limited artefacts RELEASE112-update1 to be able to release them in central
Best Regards
Eric
-----Message d'origine-----
De : Neil C Smith <ne...@apache.org>
Envoyé : mardi 29 octobre 2019 18:42
À : dev <de...@netbeans.apache.org>
Objet : Re: [DISCUSS] Handling release updates
On Tue, 29 Oct 2019 at 15:53, Eric Barboni <sk...@apache.org> wrote:
> You cannot do a RELEASE112.1 in the org.netbeans(api,modules,clusters,external) without rebuild the whole NetBeans stack because every pom will need the RELEASE112.1 version on dependencies nbm being a side artefacts.
> It's not possible to overwrite a released artefacts you cannot do a RELEASE112 again.
Yes, I know artefacts can't be overwritten, so thought as much. Kind of makes it even harder to push a patch release for Maven modules.
Would be good if that was not the case, but I guess it's not a short term (ie. 11.2 update) mechanism. And Maven probably won't get nb-javac module fix, although that's probably not that much of an issue.
Still think it worth considering longer term. Means only one set of NBMs need signing and maintaining, and may remove some issues around using Apache mirrors for the UCs. How feasible is changing the modules to use spec version and RELEASE11X just for overarching POM files?
Best wishes,
Neil
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [DISCUSS] Handling release updates
Posted by Neil C Smith <ne...@apache.org>.
On Fri, 8 Nov 2019, 10:35 Geertjan Wielenga, <ge...@apache.org> wrote:
> How is the signing done for Apache NetBeans during releases and why can't
> that be used for the patch too?
>
Different kinds of signing. The releases and the updates will be signed as
ASF requires with an external .asc file. But the nbms in the release aren't
currently jar signed (ie. internal signature) so will show as unsigned with
a warning in the IDE. You can see this if you uninstall and reinstall
modules in the IDE. This is what we need to sort out.
And yes, you're not the only one to have been confused by this distinction!
;-)
Best wishes,
Neil
>
Re: [DISCUSS] Handling release updates
Posted by Geertjan Wielenga <ge...@apache.org>.
How is the signing done for Apache NetBeans during releases and why can't
that be used for the patch too? Sorry, ignorant on this point and need to
understand this aspect to be able to participate in the discussion,
alternatively those who are familiar with this should take the lead and do
what is needed or what is best under the circumstances.
Gj
On Thu, Nov 7, 2019 at 6:22 PM Neil C Smith <ne...@apache.org> wrote:
> On Thu, 7 Nov 2019 at 17:05, Korney Czukowski <cz...@seznam.cz> wrote:
> > Although even with almost
> > everything in place, there's still this issue with nbm signing, so
> > practically the Update Center cannot be used for now, right (else you
> > would have already used it)? If this is the case, then a (trusted)
> > offline installed could be used as a temporarily and somewhat ugly
> solution.
>
> The UC is useful now, and can be used for things like RCP harness
> building. However, the iDE will show a warning for nbms there.
>
> All binary elements, including the zips and nbms, are already gpg
> signed locally. We just need a temporary solution to (jar) sign the
> updated nbm files as well. The solution you suggest would actually be
> more complicated not less. We still have to sign them! Getting them
> in the existing UC is easy after that.
>
> Thanks,
>
> Neil
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
> For additional commands, e-mail: dev-help@netbeans.apache.org
>
> For further information about the NetBeans mailing lists, visit:
> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>
>
>
>
Re: [DISCUSS] Handling release updates
Posted by Neil C Smith <ne...@apache.org>.
On Thu, 7 Nov 2019 at 17:05, Korney Czukowski <cz...@seznam.cz> wrote:
> Although even with almost
> everything in place, there's still this issue with nbm signing, so
> practically the Update Center cannot be used for now, right (else you
> would have already used it)? If this is the case, then a (trusted)
> offline installed could be used as a temporarily and somewhat ugly solution.
The UC is useful now, and can be used for things like RCP harness
building. However, the iDE will show a warning for nbms there.
All binary elements, including the zips and nbms, are already gpg
signed locally. We just need a temporary solution to (jar) sign the
updated nbm files as well. The solution you suggest would actually be
more complicated not less. We still have to sign them! Getting them
in the existing UC is easy after that.
Thanks,
Neil
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [DISCUSS] Handling release updates
Posted by Korney Czukowski <cz...@seznam.cz>.
Then I must have misunderstood your earlier comment about issues due to
changes in the build system, my apologies. Although even with almost
everything in place, there's still this issue with nbm signing, so
practically the Update Center cannot be used for now, right (else you
would have already used it)? If this is the case, then a (trusted)
offline installed could be used as a temporarily and somewhat ugly solution.
And yes, I meant generally any release within the quarterly cycle that
is assigned a version number, sorry for not being clear.
Regards!
On 2019/11/07 16:24:54, Neil C Smith <n...@apache.orgwrote:
> On Thu, 7 Nov 2019 at 16:14, Korney Czukowski <cz...@seznam.czwrote:
>> If the Update Center is out of the question for now,
> <snip> it isn't! That bit is not the problem. The only problem to
> delivery at the moment is signing the nbm with a certificate that's
> trusted by the IDE.
>> Of course, both options should be viewed only as a temporary solution
>> for situations where you guys really want to push an update ASAP. IMO,
>> the end goal should be that any module that NetBeans platform can
>> possibly live without, can be installed or updated from the Update
>> Center by default, and the incremental releases with the version numbers
>> would just include the most recent stable versions of those modules.
> That is already the case, although not quite sure what you mean by
> incremental releases - note that 11.2. is not an incremental release.
>
> There is just the issue again that the nbms in that distribution
> update centre are not signed at present.
>
> eg. 11.2 is all at
> https://dist.apache.org/repos/dist/release/netbeans/netbeans/11.2/nbms/
>
> Longer term the Apache mirrors may not be the best way to distribute
> the modules though.
>
> Best wishes,
>
> Neil
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
> For additional commands, e-mail: dev-help@netbeans.apache.org
>
> For further information about the NetBeans mailing lists, visit:
> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [DISCUSS] Handling release updates
Posted by Neil C Smith <ne...@apache.org>.
On Thu, 7 Nov 2019 at 16:14, Korney Czukowski <cz...@seznam.cz> wrote:
> If the Update Center is out of the question for now,
<snip> it isn't! That bit is not the problem. The only problem to
delivery at the moment is signing the nbm with a certificate that's
trusted by the IDE.
> Of course, both options should be viewed only as a temporary solution
> for situations where you guys really want to push an update ASAP. IMO,
> the end goal should be that any module that NetBeans platform can
> possibly live without, can be installed or updated from the Update
> Center by default, and the incremental releases with the version numbers
> would just include the most recent stable versions of those modules.
That is already the case, although not quite sure what you mean by
incremental releases - note that 11.2. is not an incremental release.
There is just the issue again that the nbms in that distribution
update centre are not signed at present.
eg. 11.2 is all at
https://dist.apache.org/repos/dist/release/netbeans/netbeans/11.2/nbms/
Longer term the Apache mirrors may not be the best way to distribute
the modules though.
Best wishes,
Neil
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [DISCUSS] Handling release updates
Posted by Korney Czukowski <cz...@seznam.cz>.
If the Update Center is out of the question for now, maybe it would be
feasible to create an offline update installer consisting only of a
couple of nbms that need to be updated, that would update an existing
NetBeans installation? Then it should be possible to vote for just for
this very limited portion of the sources and avoid issues with early
merging. If the installer is signed, there should not be any trust
issues regarding the content it carries.
If this is hard to do, maybe even just posting the patched nbms
somewhere and instructing the affected users how to replace them
manually could suffice, given the NetBeans userbase profile, it might be
acceptable to many.
Of course, both options should be viewed only as a temporary solution
for situations where you guys really want to push an update ASAP. IMO,
the end goal should be that any module that NetBeans platform can
possibly live without, can be installed or updated from the Update
Center by default, and the incremental releases with the version numbers
would just include the most recent stable versions of those modules.
On 2019/11/07 10:56:49, Neil C Smith <n....@apache.org> wrote:
> On Thu, 7 Nov 2019 at 10:43, Geertjan Wielenga <ge...@apache.org>
wrote:>
> > Can someone -- preferably Eric, Neil, Laszlo, Jan, or Matthias,
suggest a>
> > way forward to get an update out, i.e., we could even call it 11.2.1,>
> > maybe, if we can't figure out how to release the two modules (what
would be>
> > the problem with doing it as Laszlo did for Gradle)?>
>
> We can't do it as Laszlo did for Gradle because of changes in the>
> build system. And in many respects this should be simpler.>
>
> We need to>
>
> * merge the relevant PRs to master and test. (perhaps provide nbms via>
> temporary UC?)>
> * (ideally) cherry pick locally and open new PRs on top of release112>
> (better than pushing to release branch IMO because of Travis, etc.)>
> * Merge to release branch.>
> * write the hash into the release JSON file (probably 11.2-patch1) and>
> trigger a build.>
> * ***somehow*** sign the relevant nbms.>
> * vote on source zip and required nbms.>
>
> There is one more potential PR for the patch update. They all have>
> Cherry Pick labels on them.>
>
>
https://github.com/apache/netbeans/pulls?q=is%3Apr+is%3Aopen+label%3A%22Cherry+Pick%22>
>
> I'm happy to RM the process from point 3, but I'd rather the current>
> PR authors handled steps 1 and 2. If I do, add me as a reviewer on>
> the step 2 PR when they're ready.>
>
> And we still need an answer for the signing part for 11.2 updates ->
> perhaps the web signing via Apache is the way, but I'll need to follow>
> up with infra. Few suggestions for 11.3+ are great there but don't>
> help us with this update.>
>
> Best wishes,>
>
> Neil>
>
> --------------------------------------------------------------------->
> To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org>
> For additional commands, e-mail: dev-help@netbeans.apache.org>
>
> For further information about the NetBeans mailing lists, visit:>
> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [DISCUSS] Handling release updates
Posted by Neil C Smith <ne...@apache.org>.
On Thu, 7 Nov 2019 at 10:43, Geertjan Wielenga <ge...@apache.org> wrote:
> Can someone -- preferably Eric, Neil, Laszlo, Jan, or Matthias, suggest a
> way forward to get an update out, i.e., we could even call it 11.2.1,
> maybe, if we can't figure out how to release the two modules (what would be
> the problem with doing it as Laszlo did for Gradle)?
We can't do it as Laszlo did for Gradle because of changes in the
build system. And in many respects this should be simpler.
We need to
* merge the relevant PRs to master and test. (perhaps provide nbms via
temporary UC?)
* (ideally) cherry pick locally and open new PRs on top of release112
(better than pushing to release branch IMO because of Travis, etc.)
* Merge to release branch.
* write the hash into the release JSON file (probably 11.2-patch1) and
trigger a build.
* ***somehow*** sign the relevant nbms.
* vote on source zip and required nbms.
There is one more potential PR for the patch update. They all have
Cherry Pick labels on them.
https://github.com/apache/netbeans/pulls?q=is%3Apr+is%3Aopen+label%3A%22Cherry+Pick%22
I'm happy to RM the process from point 3, but I'd rather the current
PR authors handled steps 1 and 2. If I do, add me as a reviewer on
the step 2 PR when they're ready.
And we still need an answer for the signing part for 11.2 updates -
perhaps the web signing via Apache is the way, but I'll need to follow
up with infra. Few suggestions for 11.3+ are great there but don't
help us with this update.
Best wishes,
Neil
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [DISCUSS] Handling release updates
Posted by Geertjan Wielenga <ge...@apache.org>.
Can someone -- preferably Eric, Neil, Laszlo, Jan, or Matthias, suggest a
way forward to get an update out, i.e., we could even call it 11.2.1,
maybe, if we can't figure out how to release the two modules (what would be
the problem with doing it as Laszlo did for Gradle)?
Gj
On Thu, Nov 7, 2019 at 11:05 AM Geertjan Wielenga <ge...@apache.org>
wrote:
> There appear to be two issues that would be best to make available as
> updates as soon as we can -- relating to nb-javac and HTML parsing.
>
> What would be the problem with voting on the sources of those two modules
> and then making them available via the plugin portal?
>
> Gj
>
> On Mon, Nov 4, 2019 at 6:54 PM Eric Barboni <sk...@apache.org> wrote:
>
>> Hi,
>> Not sure what the needs exactly.
>> But If you rebuild a patched NetBeans with a forced version
>> RELEASE112-update1. You can pick the patched nbm you want. And alter pom to
>> put RELEASE112 for dep (you know are were not modified).
>>
>> Then vote with sources + the limited artefacts RELEASE112-update1 to be
>> able to release them in central
>>
>> Best Regards
>> Eric
>>
>>
>>
>>
>> -----Message d'origine-----
>> De : Neil C Smith <ne...@apache.org>
>> Envoyé : mardi 29 octobre 2019 18:42
>> À : dev <de...@netbeans.apache.org>
>> Objet : Re: [DISCUSS] Handling release updates
>>
>> On Tue, 29 Oct 2019 at 15:53, Eric Barboni <sk...@apache.org> wrote:
>> > You cannot do a RELEASE112.1 in the
>> org.netbeans(api,modules,clusters,external) without rebuild the whole
>> NetBeans stack because every pom will need the RELEASE112.1 version on
>> dependencies nbm being a side artefacts.
>> > It's not possible to overwrite a released artefacts you cannot do a
>> RELEASE112 again.
>>
>> Yes, I know artefacts can't be overwritten, so thought as much. Kind of
>> makes it even harder to push a patch release for Maven modules.
>> Would be good if that was not the case, but I guess it's not a short term
>> (ie. 11.2 update) mechanism. And Maven probably won't get nb-javac module
>> fix, although that's probably not that much of an issue.
>>
>> Still think it worth considering longer term. Means only one set of NBMs
>> need signing and maintaining, and may remove some issues around using
>> Apache mirrors for the UCs. How feasible is changing the modules to use
>> spec version and RELEASE11X just for overarching POM files?
>>
>> Best wishes,
>>
>> Neil
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
>> For additional commands, e-mail: dev-help@netbeans.apache.org
>>
>> For further information about the NetBeans mailing lists, visit:
>> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>>
>>
>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
>> For additional commands, e-mail: dev-help@netbeans.apache.org
>>
>> For further information about the NetBeans mailing lists, visit:
>> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>>
>>
>>
>>
Re: [DISCUSS] Handling release updates
Posted by Geertjan Wielenga <ge...@apache.org>.
There appear to be two issues that would be best to make available as
updates as soon as we can -- relating to nb-javac and HTML parsing.
What would be the problem with voting on the sources of those two modules
and then making them available via the plugin portal?
Gj
On Mon, Nov 4, 2019 at 6:54 PM Eric Barboni <sk...@apache.org> wrote:
> Hi,
> Not sure what the needs exactly.
> But If you rebuild a patched NetBeans with a forced version
> RELEASE112-update1. You can pick the patched nbm you want. And alter pom to
> put RELEASE112 for dep (you know are were not modified).
>
> Then vote with sources + the limited artefacts RELEASE112-update1 to be
> able to release them in central
>
> Best Regards
> Eric
>
>
>
>
> -----Message d'origine-----
> De : Neil C Smith <ne...@apache.org>
> Envoyé : mardi 29 octobre 2019 18:42
> À : dev <de...@netbeans.apache.org>
> Objet : Re: [DISCUSS] Handling release updates
>
> On Tue, 29 Oct 2019 at 15:53, Eric Barboni <sk...@apache.org> wrote:
> > You cannot do a RELEASE112.1 in the
> org.netbeans(api,modules,clusters,external) without rebuild the whole
> NetBeans stack because every pom will need the RELEASE112.1 version on
> dependencies nbm being a side artefacts.
> > It's not possible to overwrite a released artefacts you cannot do a
> RELEASE112 again.
>
> Yes, I know artefacts can't be overwritten, so thought as much. Kind of
> makes it even harder to push a patch release for Maven modules.
> Would be good if that was not the case, but I guess it's not a short term
> (ie. 11.2 update) mechanism. And Maven probably won't get nb-javac module
> fix, although that's probably not that much of an issue.
>
> Still think it worth considering longer term. Means only one set of NBMs
> need signing and maintaining, and may remove some issues around using
> Apache mirrors for the UCs. How feasible is changing the modules to use
> spec version and RELEASE11X just for overarching POM files?
>
> Best wishes,
>
> Neil
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
> For additional commands, e-mail: dev-help@netbeans.apache.org
>
> For further information about the NetBeans mailing lists, visit:
> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
> For additional commands, e-mail: dev-help@netbeans.apache.org
>
> For further information about the NetBeans mailing lists, visit:
> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>
>
>
>