You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ignite.apache.org by Sergey Evdokimov <se...@gridgain.com> on 2015/01/14 10:40:47 UTC
Signing Ignite artifacts
Hello,
I'm working on Ignite release process.
All release artifacts must be signed. Does we have a key to sign GridGain
artifacts or I should generate it? If I will generate key how to make
public key trusted?
I've created TeamCity configuration that build Nightly builds and upload it
to https://repository.apache.org/content/repositories/snapshots . (TeamCity
configuration:
http://94.72.60.102/viewType.html?buildTypeId=IgniteBuildsAndUploads_IniteNightlyBuild
)
Re: Signing Ignite artifacts
Posted by Konstantin Boudnik <co...@apache.org>.
On Thu, Jan 15, 2015 at 06:31PM, Branko Čibej wrote:
> On 15.01.2015 18:17, Dmitriy Setrakyan wrote:
> > On Thu, Jan 15, 2015 at 2:34 AM, Branko Čibej <br...@apache.org> wrote:
> >> Guys, how can you have a release manager who's not a committer? How did
> >> Sergey even think to begin working on this in the first place?
> > Sergey is not a release manager. He is working on automating binary release
> > build.
>
> In other words, he's contributing to the project.
>
> > I don't want have to pick a release manager yet, until we have
> > something releasable.
>
> You don't have to pick a release manager at all. There's nothing special
> about rolling a release, as long as the process is well documented and
> easily reproducible (and the results conform to ASF requirements).
>
> -- Brane
>
+many
IPMC or ASF isn't usually concerned with binary releases. What constitutes a
release is a source code "snapshot", would it be a git sha1 hash or an SVN
branch. How to get to the release is important. I'd suggest to roll the first
release out pretty much manually and document the process on the Wiki for
everyone to read/add-to. This description will serve as de-facto spec for the
automation of the process. Once the release is fully automated - I don't
really think it is possible as their some manual steps like signing - you can
replace the Wiki description with the pointer to the self-documented release
code.
Cos
Re: Signing Ignite artifacts
Posted by Branko Čibej <br...@apache.org>.
On 15.01.2015 18:17, Dmitriy Setrakyan wrote:
> On Thu, Jan 15, 2015 at 2:34 AM, Branko Čibej <br...@apache.org> wrote:
>> Guys, how can you have a release manager who's not a committer? How did
>> Sergey even think to begin working on this in the first place?
> Sergey is not a release manager. He is working on automating binary release
> build.
In other words, he's contributing to the project.
> I don't want have to pick a release manager yet, until we have
> something releasable.
You don't have to pick a release manager at all. There's nothing special
about rolling a release, as long as the process is well documented and
easily reproducible (and the results conform to ASF requirements).
-- Brane
Re: Signing Ignite artifacts
Posted by Dmitriy Setrakyan <ds...@gridgain.com>.
On Thu, Jan 15, 2015 at 2:34 AM, Branko Čibej <br...@apache.org> wrote:
> On 15.01.2015 11:02, Sergey Evdokimov wrote:
> > To use Apache Code Signing Service we need to appoint one of committer as
> > release manager (https://reference.apache.org/pmc/newcodesigning).
>
> Just to be clear: you don't need the code signing service for source
> releases. For that, you only need PGP signatures from the (current) RM
> and other (P)PMC members. For example, over at Subversion, every PMC
> member who votes for the release artefacts also signs them, so that we
> have more than one signature for any release.
>
> Before worrying too much about publishing convenience binaries, you have
> to get the process for source releases sorted out. Right now, the Ignite
> code is not even close being suitable for release. Not because of
> missing features — we're not concerned with feature sets — but because
> they don't conform to legal requirements:
>
> * Many of the sources do not have the required license headers
> * All Java APIs must be in the org.apache.ignite namespace, right now
> I see 'gridgain' all over the place
> * LICENSE and NOTICE files are missing
>
> and so on. Fixing the above will be a lot of work so I really don't
> recommend worrying about signing convenience binaries at this point.
>
Brane, we are doing many things in parallel, including binary releases and
source code clean up. All the file headers were fixed yesterday. The
repackaging into "org.apache.ignite" will happen over the weekend as we
need other branches to be fully merged for this to happen.
I have created a ticket for LICENSE and NOTICE files (someone will pick it
up):
https://issues.apache.org/jira/browse/IGNITE-97
>
>
> > I'm not
> > a committer. Whose account use to registration on Apache Code Signing
> > Service.
>
> Guys, how can you have a release manager who's not a committer? How did
> Sergey even think to begin working on this in the first place?
>
Sergey is not a release manager. He is working on automating binary release
build. I don't want have to pick a release manager yet, until we have
something releasable.
>
> > P.S. Signing release using that service costs money. Who will decide to
> use
> > it or not?
>
> The PMC, of course. During incubation, that's PPMC+IPMC.
>
> -- Brane
>
> > On Wed, Jan 14, 2015 at 12:40 PM, Sergey Evdokimov <
> sevdokimov@gridgain.com>
> > wrote:
> >
> >> Hello,
> >>
> >> I'm working on Ignite release process.
> >>
> >> All release artifacts must be signed. Does we have a key to sign
> GridGain
> >> artifacts or I should generate it? If I will generate key how to make
> >> public key trusted?
> >>
> >> I've created TeamCity configuration that build Nightly builds and upload
> >> it to https://repository.apache.org/content/repositories/snapshots .
> >> (TeamCity configuration:
> >>
> http://94.72.60.102/viewType.html?buildTypeId=IgniteBuildsAndUploads_IniteNightlyBuild
> >> )
> >>
>
>
Re: Signing Ignite artifacts
Posted by Branko Čibej <br...@apache.org>.
On 15.01.2015 11:02, Sergey Evdokimov wrote:
> To use Apache Code Signing Service we need to appoint one of committer as
> release manager (https://reference.apache.org/pmc/newcodesigning).
Just to be clear: you don't need the code signing service for source
releases. For that, you only need PGP signatures from the (current) RM
and other (P)PMC members. For example, over at Subversion, every PMC
member who votes for the release artefacts also signs them, so that we
have more than one signature for any release.
Before worrying too much about publishing convenience binaries, you have
to get the process for source releases sorted out. Right now, the Ignite
code is not even close being suitable for release. Not because of
missing features — we're not concerned with feature sets — but because
they don't conform to legal requirements:
* Many of the sources do not have the required license headers
* All Java APIs must be in the org.apache.ignite namespace, right now
I see 'gridgain' all over the place
* LICENSE and NOTICE files are missing
and so on. Fixing the above will be a lot of work so I really don't
recommend worrying about signing convenience binaries at this point.
> I'm not
> a committer. Whose account use to registration on Apache Code Signing
> Service.
Guys, how can you have a release manager who's not a committer? How did
Sergey even think to begin working on this in the first place?
> P.S. Signing release using that service costs money. Who will decide to use
> it or not?
The PMC, of course. During incubation, that's PPMC+IPMC.
-- Brane
> On Wed, Jan 14, 2015 at 12:40 PM, Sergey Evdokimov <se...@gridgain.com>
> wrote:
>
>> Hello,
>>
>> I'm working on Ignite release process.
>>
>> All release artifacts must be signed. Does we have a key to sign GridGain
>> artifacts or I should generate it? If I will generate key how to make
>> public key trusted?
>>
>> I've created TeamCity configuration that build Nightly builds and upload
>> it to https://repository.apache.org/content/repositories/snapshots .
>> (TeamCity configuration:
>> http://94.72.60.102/viewType.html?buildTypeId=IgniteBuildsAndUploads_IniteNightlyBuild
>> )
>>
Re: Signing Ignite artifacts
Posted by Sergey Evdokimov <se...@gridgain.com>.
To use Apache Code Signing Service we need to appoint one of committer as
release manager (https://reference.apache.org/pmc/newcodesigning). I'm not
a committer. Whose account use to registration on Apache Code Signing
Service.
P.S. Signing release using that service costs money. Who will decide to use
it or not?
On Wed, Jan 14, 2015 at 12:40 PM, Sergey Evdokimov <se...@gridgain.com>
wrote:
> Hello,
>
> I'm working on Ignite release process.
>
> All release artifacts must be signed. Does we have a key to sign GridGain
> artifacts or I should generate it? If I will generate key how to make
> public key trusted?
>
> I've created TeamCity configuration that build Nightly builds and upload
> it to https://repository.apache.org/content/repositories/snapshots .
> (TeamCity configuration:
> http://94.72.60.102/viewType.html?buildTypeId=IgniteBuildsAndUploads_IniteNightlyBuild
> )
>
Re: Signing Ignite artifacts
Posted by Konstantin Boudnik <co...@apache.org>.
What Brane said. Also, you can just use your own GPG key, but it'd be good to
have signed by others with trusted keys.
Perhaps some of the mentors key sign your published keys. Considering how
spread the community is we can perhaps do a key-signing over the video call.
But using the ASF service would be most straight forward way, I think
Cos
On Wed, Jan 14, 2015 at 02:20PM, Branko Čibej wrote:
> On 14.01.2015 10:40, Sergey Evdokimov wrote:
> > Hello,
> >
> > I'm working on Ignite release process.
> >
> > All release artifacts must be signed. Does we have a key to sign GridGain
> > artifacts or I should generate it? If I will generate key how to make
> > public key trusted?
>
> They will not be GridGain artefacts, that's for sure. :)
>
> > I've created TeamCity configuration that build Nightly builds and upload it
> > to https://repository.apache.org/content/repositories/snapshots . (TeamCity
> > configuration:
> > http://94.72.60.102/viewType.html?buildTypeId=IgniteBuildsAndUploads_IniteNightlyBuild
> > )
>
> The ASF recently started a code-signing service, however, I'm fairly
> sure that one of the prerequisites is that the artefacts are built on
> ASF infrastructure, not just anywhere.
>
> Here's the forwarded announcement:
>
> ---------- Forwarded message ----------
> From: *Mark Thomas* <markt@apache.org <ma...@apache.org>>
> Date: Mon, Nov 17, 2014 at 6:30 AM
> Subject: Code signing service now available
> To: "infrastructure@apache.org <ma...@apache.org>"
> <infrastructure@apache.org <ma...@apache.org>>
>
>
> The ASF Infrastructure team is pleased to announce the availability of a
> new code signing service for Java, Windows and Android applications.
> This service is available to any Apache project to use to sign their
> releases.
>
> After a great deal of research, we have chosen Symantec's Secure App
> Service offering to provide code signing service. This allows us to
> granularly permit access; and each PMC will have their own
> certificate(s) for signing. The per-project nature of certificate
> issuance allows us to revoke a signature without disrupting other projects.
>
> This service will permit projects to sign artifacts either via a web GUI
> or a SOAP API. In addition a Java client and an ant task for signing
> have been written and a maven plugin is under development.
>
> This service results in a 'pay for what you use' scenario, so PMCs are
> asked to use the service responsibly. To that end, projects will have
> access to a test environment to ensure that they have their process
> working correctly before consuming actual credits.
>
> Thus far, we've had two projects who have helped testing this and
> working out process for which we are very grateful. Those projects,
> Commons and Tomcat, have successfully released signed artifacts
> recently. (Commons Daemon 1.0.15 and Tomcat 8.0.15)
>
> Projects that wish to use this service should open an Infra JIRA ticket
> under the Codesigning component.
>
> If you have any questions about this new service then feel free to ask
> them on the infrastructure mailing list. This week is also an
> opportunity to discuss this new service face-to-face with the
> Infrastructure Team at ApacheCon EU. Come along to one of the infra
> presentations or find one of us during one of the breaks.
>
> Mark
> on behalf of the ASF Infrastructure Team
>
Re: Signing Ignite artifacts
Posted by Branko Čibej <br...@apache.org>.
On 14.01.2015 10:40, Sergey Evdokimov wrote:
> Hello,
>
> I'm working on Ignite release process.
>
> All release artifacts must be signed. Does we have a key to sign GridGain
> artifacts or I should generate it? If I will generate key how to make
> public key trusted?
They will not be GridGain artefacts, that's for sure. :)
> I've created TeamCity configuration that build Nightly builds and upload it
> to https://repository.apache.org/content/repositories/snapshots . (TeamCity
> configuration:
> http://94.72.60.102/viewType.html?buildTypeId=IgniteBuildsAndUploads_IniteNightlyBuild
> )
The ASF recently started a code-signing service, however, I'm fairly
sure that one of the prerequisites is that the artefacts are built on
ASF infrastructure, not just anywhere.
Here's the forwarded announcement:
---------- Forwarded message ----------
From: *Mark Thomas* <markt@apache.org <ma...@apache.org>>
Date: Mon, Nov 17, 2014 at 6:30 AM
Subject: Code signing service now available
To: "infrastructure@apache.org <ma...@apache.org>"
<infrastructure@apache.org <ma...@apache.org>>
The ASF Infrastructure team is pleased to announce the availability of a
new code signing service for Java, Windows and Android applications.
This service is available to any Apache project to use to sign their
releases.
After a great deal of research, we have chosen Symantec's Secure App
Service offering to provide code signing service. This allows us to
granularly permit access; and each PMC will have their own
certificate(s) for signing. The per-project nature of certificate
issuance allows us to revoke a signature without disrupting other projects.
This service will permit projects to sign artifacts either via a web GUI
or a SOAP API. In addition a Java client and an ant task for signing
have been written and a maven plugin is under development.
This service results in a 'pay for what you use' scenario, so PMCs are
asked to use the service responsibly. To that end, projects will have
access to a test environment to ensure that they have their process
working correctly before consuming actual credits.
Thus far, we've had two projects who have helped testing this and
working out process for which we are very grateful. Those projects,
Commons and Tomcat, have successfully released signed artifacts
recently. (Commons Daemon 1.0.15 and Tomcat 8.0.15)
Projects that wish to use this service should open an Infra JIRA ticket
under the Codesigning component.
If you have any questions about this new service then feel free to ask
them on the infrastructure mailing list. This week is also an
opportunity to discuss this new service face-to-face with the
Infrastructure Team at ApacheCon EU. Come along to one of the infra
presentations or find one of us during one of the breaks.
Mark
on behalf of the ASF Infrastructure Team