You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@daffodil.apache.org by "Interrante, John A (GE Research, US)" <Jo...@ge.com> on 2022/03/18 16:06:49 UTC
[VOTE] Release Apache Daffodil 3.3.0-rc1
Hi PMC members,
I'd like to call a vote to release Apache Daffodil 3.3.0-rc1.
All distribution packages, including signatures, digests, etc. can be
found at:
https://dist.apache.org/repos/dist/dev/daffodil/3.3.0-rc1/
Staging artifacts can be found at:
https://repository.apache.org/content/repositories/orgapachedaffodil-1029/
This release has been signed with PGP key 04A735FC1A36AE84, corresponding
to jinterrante@apache.org, which is included in the KEYS file here:
https://downloads.apache.org/daffodil/KEYS
The release candidate has been tagged in git with v3.3.0-rc1.
For reference, here is a list of all closed JIRAs tagged with 3.3.0:
https://s.apache.org/daffodil-issues-3.3.0
For a summary of the changes in this release, see:
https://daffodil.apache.org/releases/3.3.0/
Please review and vote. The vote will be open for at least 72 hours
(Monday, March 21 2022, 12 Noon EST).
[ ] +1 approve
[ ] +0 no opinion
[ ] -1 disapprove (and reason why)
Thanks,
John
Re: [VOTE] Release Apache Daffodil 3.3.0-rc1
Posted by Mike Beckerle <mb...@apache.org>.
I think 2664 is a legit bug with fix. We reverted an earlier change to fix
this.
On Fri, Mar 18, 2022 at 4:34 PM Interrante, John A (GE Research, US) <
John.Interrante@ge.com> wrote:
> I'll remove the "not a bug" issues from the release notes.
>
> Mike identified https://issues.apache.org/jira/browse/DAFFODIL-2618 as a
> "not a bug" and I concur.
>
> I've looked at the other issues; should
> https://issues.apache.org/jira/browse/DAFFODIL-2664 fall into the "not a
> bug" category since it didn't require a change to Daffodil?
>
> John
>
> -----Original Message-----
> From: Mike Beckerle <mb...@apache.org>
> Sent: Friday, March 18, 2022 1:07 PM
> To: dev@daffodil.apache.org
> Subject: EXT: Re: [VOTE] Release Apache Daffodil 3.3.0-rc1
>
> WARNING: This email originated from outside of GE. Please validate the
> sender's email address before clicking on links or attachments as they may
> not be safe.
>
> +1
>
> I ran tests of 60+ regression test schemas which passed. I also tested
> against a few very new schemas that are large and quite complex and they
> passed.
> I reviewed the release notes.
>
> I downloaded all the artifacts and verified the signatures (after
> remembering to import John I's public gpg key) using the script on the
> release-proces page, updated for the new RC1.
>
> One minor thing on the site, not the release, is some of the bugs listed
> as "fixed" were actually closed as "not a bug". I wouldn't normally list
> those. Ex: DAFFODIL-2618.
>
>
>
> On Fri, Mar 18, 2022 at 12:06 PM Interrante, John A (GE Research, US) <
> John.Interrante@ge.com> wrote:
>
> > Hi PMC members,
> >
> > I'd like to call a vote to release Apache Daffodil 3.3.0-rc1.
> >
> > All distribution packages, including signatures, digests, etc. can be
> > found at:
> >
> > https://dist.apache.org/repos/dist/dev/daffodil/3.3.0-rc1/
> >
> > Staging artifacts can be found at:
> >
> > https://repository.apache.org/content/repositories/orgapachedaffodil-1
> > 029/
> >
> > This release has been signed with PGP key 04A735FC1A36AE84,
> > corresponding to jinterrante@apache.org, which is included in the KEYS
> file here:
> >
> > https://downloads.apache.org/daffodil/KEYS
> >
> > The release candidate has been tagged in git with v3.3.0-rc1.
> >
> > For reference, here is a list of all closed JIRAs tagged with 3.3.0:
> >
> > https://s.apache.org/daffodil-issues-3.3.0
> >
> > For a summary of the changes in this release, see:
> >
> > https://daffodil.apache.org/releases/3.3.0/
> >
> > Please review and vote. The vote will be open for at least 72 hours
> > (Monday, March 21 2022, 12 Noon EST).
> >
> > [ ] +1 approve
> > [ ] +0 no opinion
> > [ ] -1 disapprove (and reason why)
> >
> > Thanks,
> > John
> >
>
[VOTE] Release Apache Daffodil 3.3.0-rc1
Posted by "Interrante, John A (GE Research, US)" <Jo...@ge.com>.
I'll remove the "not a bug" issues from the release notes.
Mike identified https://issues.apache.org/jira/browse/DAFFODIL-2618 as a "not a bug" and I concur.
I've looked at the other issues; should https://issues.apache.org/jira/browse/DAFFODIL-2664 fall into the "not a bug" category since it didn't require a change to Daffodil?
John
-----Original Message-----
From: Mike Beckerle <mb...@apache.org>
Sent: Friday, March 18, 2022 1:07 PM
To: dev@daffodil.apache.org
Subject: EXT: Re: [VOTE] Release Apache Daffodil 3.3.0-rc1
WARNING: This email originated from outside of GE. Please validate the sender's email address before clicking on links or attachments as they may not be safe.
+1
I ran tests of 60+ regression test schemas which passed. I also tested against a few very new schemas that are large and quite complex and they passed.
I reviewed the release notes.
I downloaded all the artifacts and verified the signatures (after remembering to import John I's public gpg key) using the script on the release-proces page, updated for the new RC1.
One minor thing on the site, not the release, is some of the bugs listed as "fixed" were actually closed as "not a bug". I wouldn't normally list those. Ex: DAFFODIL-2618.
On Fri, Mar 18, 2022 at 12:06 PM Interrante, John A (GE Research, US) < John.Interrante@ge.com> wrote:
> Hi PMC members,
>
> I'd like to call a vote to release Apache Daffodil 3.3.0-rc1.
>
> All distribution packages, including signatures, digests, etc. can be
> found at:
>
> https://dist.apache.org/repos/dist/dev/daffodil/3.3.0-rc1/
>
> Staging artifacts can be found at:
>
> https://repository.apache.org/content/repositories/orgapachedaffodil-1
> 029/
>
> This release has been signed with PGP key 04A735FC1A36AE84,
> corresponding to jinterrante@apache.org, which is included in the KEYS file here:
>
> https://downloads.apache.org/daffodil/KEYS
>
> The release candidate has been tagged in git with v3.3.0-rc1.
>
> For reference, here is a list of all closed JIRAs tagged with 3.3.0:
>
> https://s.apache.org/daffodil-issues-3.3.0
>
> For a summary of the changes in this release, see:
>
> https://daffodil.apache.org/releases/3.3.0/
>
> Please review and vote. The vote will be open for at least 72 hours
> (Monday, March 21 2022, 12 Noon EST).
>
> [ ] +1 approve
> [ ] +0 no opinion
> [ ] -1 disapprove (and reason why)
>
> Thanks,
> John
>
Re: [VOTE] Release Apache Daffodil 3.3.0-rc1
Posted by Mike Beckerle <mb...@apache.org>.
+1
I ran tests of 60+ regression test schemas which passed. I also tested
against a few very new schemas that are large and quite complex and
they passed.
I reviewed the release notes.
I downloaded all the artifacts and verified the signatures (after
remembering to import John I's public gpg key) using the script on the
release-proces page, updated for the new RC1.
One minor thing on the site, not the release, is some of the bugs listed as
"fixed" were actually closed as "not a bug". I wouldn't normally list
those. Ex: DAFFODIL-2618.
On Fri, Mar 18, 2022 at 12:06 PM Interrante, John A (GE Research, US) <
John.Interrante@ge.com> wrote:
> Hi PMC members,
>
> I'd like to call a vote to release Apache Daffodil 3.3.0-rc1.
>
> All distribution packages, including signatures, digests, etc. can be
> found at:
>
> https://dist.apache.org/repos/dist/dev/daffodil/3.3.0-rc1/
>
> Staging artifacts can be found at:
>
> https://repository.apache.org/content/repositories/orgapachedaffodil-1029/
>
> This release has been signed with PGP key 04A735FC1A36AE84, corresponding
> to jinterrante@apache.org, which is included in the KEYS file here:
>
> https://downloads.apache.org/daffodil/KEYS
>
> The release candidate has been tagged in git with v3.3.0-rc1.
>
> For reference, here is a list of all closed JIRAs tagged with 3.3.0:
>
> https://s.apache.org/daffodil-issues-3.3.0
>
> For a summary of the changes in this release, see:
>
> https://daffodil.apache.org/releases/3.3.0/
>
> Please review and vote. The vote will be open for at least 72 hours
> (Monday, March 21 2022, 12 Noon EST).
>
> [ ] +1 approve
> [ ] +0 no opinion
> [ ] -1 disapprove (and reason why)
>
> Thanks,
> John
>
Re: [VOTE] Release Apache Daffodil 3.3.0-rc1
Posted by "Adams, Joshua" <ja...@owlcyberdefense.com>.
+1
I have verified signatures of all packages and gave been using the 3.3.0-SNAPSHOT extensively.
Josh Adams
On Mar 18, 2022 12:07 PM, "Interrante, John A (GE Research, US)" <Jo...@ge.com> wrote:
Hi PMC members,
I'd like to call a vote to release Apache Daffodil 3.3.0-rc1.
All distribution packages, including signatures, digests, etc. can be
found at:
https://dist.apache.org/repos/dist/dev/daffodil/3.3.0-rc1/
Staging artifacts can be found at:
https://repository.apache.org/content/repositories/orgapachedaffodil-1029/
This release has been signed with PGP key 04A735FC1A36AE84, corresponding
to jinterrante@apache.org, which is included in the KEYS file here:
https://downloads.apache.org/daffodil/KEYS
The release candidate has been tagged in git with v3.3.0-rc1.
For reference, here is a list of all closed JIRAs tagged with 3.3.0:
https://s.apache.org/daffodil-issues-3.3.0
For a summary of the changes in this release, see:
https://daffodil.apache.org/releases/3.3.0/
Please review and vote. The vote will be open for at least 72 hours
(Monday, March 21 2022, 12 Noon EST).
[ ] +1 approve
[ ] +0 no opinion
[ ] -1 disapprove (and reason why)
Thanks,
John
Re: [VOTE] Release Apache Daffodil 3.3.0-rc1
Posted by Steve Lawrence <sl...@apache.org>.
+1 (binding)
I checked:
[OK] hashes and signatures of source and helper binaries are correct
[OK] signature of git tag is correct
[OK] source release matches git tag (minus KEYS file)
[OK] source compiles and all tests pass (both en_US and de_DE) (minor
exception with DAFFODIL-2612 and -2599)
[OK] helper tgz/zip/msi/rpm all contain the same content except where
expected
[OK] jars in helper binaries and the repository are exactly the same
[OK] jars built from source are exactly the same as helper binary jars
[OK] distributed dependencies in helper binaries are same as from maven
[OK] src, binaries, and jars include correct LICENSE/NOTICE
[OK] RAT check passes
[OK] no unexpected binaries in source
[OK] rpm and msi install and run with basic usage
[OK] ~60 public and private DFDL schema projects pass tests
[OK] No issues found in JavaDoc and ScalaDoc
[OK] No open CVE's found using sbt-dependency-check plugin
[OK] Daffodil NiFi processor builds and tests pass with new version
On 3/18/22 12:06 PM, Interrante, John A (GE Research, US) wrote:
> Hi PMC members,
>
> I'd like to call a vote to release Apache Daffodil 3.3.0-rc1.
>
> All distribution packages, including signatures, digests, etc. can be
> found at:
>
> https://dist.apache.org/repos/dist/dev/daffodil/3.3.0-rc1/
>
> Staging artifacts can be found at:
>
> https://repository.apache.org/content/repositories/orgapachedaffodil-1029/
>
> This release has been signed with PGP key 04A735FC1A36AE84, corresponding
> to jinterrante@apache.org, which is included in the KEYS file here:
>
> https://downloads.apache.org/daffodil/KEYS
>
> The release candidate has been tagged in git with v3.3.0-rc1.
>
> For reference, here is a list of all closed JIRAs tagged with 3.3.0:
>
> https://s.apache.org/daffodil-issues-3.3.0
>
> For a summary of the changes in this release, see:
>
> https://daffodil.apache.org/releases/3.3.0/
>
> Please review and vote. The vote will be open for at least 72 hours
> (Monday, March 21 2022, 12 Noon EST).
>
> [ ] +1 approve
> [ ] +0 no opinion
> [ ] -1 disapprove (and reason why)
>
> Thanks,
> John
RE: [VOTE] Release Apache Daffodil 3.3.0-rc1
Posted by "Thompson, Dave" <dt...@owlcyberdefense.com>.
+1
- Ran all sbt test suites on Java 8.
- Ran all sbt test suites on Java 17.
- Compiled nightly test suite schemas and executed test suite on Java 8.
- Compiled nightly test suite schemas and executed test suite on Java 17.
- Ran dfdl-schema sbt tests without issue.
- Successfully installed from apache-daffodil-3.3.0-1.noarch.rpm.
- Successfully installed on Windows from apache-daffodil-3.3.0-bin.msi.
-----Original Message-----
From: Interrante, John A (GE Research, US)
Sent: Friday, March 18, 2022 12:07 PM
To: dev@daffodil.apache.org
Subject: [VOTE] Release Apache Daffodil 3.3.0-rc1
Hi PMC members,
I'd like to call a vote to release Apache Daffodil 3.3.0-rc1.
All distribution packages, including signatures, digests, etc. can be found at:
https://dist.apache.org/repos/dist/dev/daffodil/3.3.0-rc1/
Staging artifacts can be found at:
https://repository.apache.org/content/repositories/orgapachedaffodil-1029/
This release has been signed with PGP key 04A735FC1A36AE84, corresponding to jinterrante@apache.org, which is included in the KEYS file here:
https://downloads.apache.org/daffodil/KEYS
The release candidate has been tagged in git with v3.3.0-rc1.
For reference, here is a list of all closed JIRAs tagged with 3.3.0:
https://s.apache.org/daffodil-issues-3.3.0
For a summary of the changes in this release, see:
https://daffodil.apache.org/releases/3.3.0/
Please review and vote. The vote will be open for at least 72 hours (Monday, March 21 2022, 12 Noon EST).
[ ] +1 approve
[ ] +0 no opinion
[ ] -1 disapprove (and reason why)
Thanks,
John
Re: [VOTE] Release Apache Daffodil 3.3.0-rc1
Posted by Olabusayo Kilo <ok...@owlcyberdefense.com>.
+1
I checked:
[OK] links in email are correct
[OK] verified Summary of Changes pages (maven, sbt, download and dnf)
[OK] verified download of binary
[OK] Successfully used apache-daffodil-3.3.0-bin.tgz
[OK] JavaDoc and ScalaDoc are correct
[OK] RAT check passes
On 3/18/22 12:06, Interrante, John A (GE Research, US) wrote:
> Hi PMC members,
>
> I'd like to call a vote to release Apache Daffodil 3.3.0-rc1.
>
> All distribution packages, including signatures, digests, etc. can be
> found at:
>
> https://dist.apache.org/repos/dist/dev/daffodil/3.3.0-rc1/
>
> Staging artifacts can be found at:
>
> https://repository.apache.org/content/repositories/orgapachedaffodil-1029/
>
> This release has been signed with PGP key 04A735FC1A36AE84, corresponding
> to jinterrante@apache.org, which is included in the KEYS file here:
>
> https://downloads.apache.org/daffodil/KEYS
>
> The release candidate has been tagged in git with v3.3.0-rc1.
>
> For reference, here is a list of all closed JIRAs tagged with 3.3.0:
>
> https://s.apache.org/daffodil-issues-3.3.0
>
> For a summary of the changes in this release, see:
>
> https://daffodil.apache.org/releases/3.3.0/
>
> Please review and vote. The vote will be open for at least 72 hours
> (Monday, March 21 2022, 12 Noon EST).
>
> [ ] +1 approve
> [ ] +0 no opinion
> [ ] -1 disapprove (and reason why)
>
> Thanks,
> John
--
Best Regards,
Lola K.
[VOTE] Release Apache Daffodil 3.3.0-rc1
Posted by "Interrante, John A (GE Research, US)" <Jo...@ge.com>.
I agree; I'll close the vote thread, release Apache Daffodil 3.3.0, and fix our NOTICE as a bug fix immediately afterwards. Thanks for the link to the licensing how-to, Steve. I see it also says we don't need to modify our LICENSE or include each NOTICE in its entirety, only everything before and after the line "This product includes software developed at the Apache Software Foundation..." (see excerpts below).
John
Bundling an Apache 2-0-licensed dependency
Assuming that the bundled dependency itself contains no bundled sub-components under other licenses, so the ALv2 applies uniformly to all files, there is no need to modify LICENSE. However, for completeness it is useful to list the products and their versions, as is done for products under other licenses.
If the dependency supplies a NOTICE file, its contents must be analyzed and the relevant portions bubbled up into the top-level NOTICE file.
Bundling other ASF products
It is not necessary to duplicate the line "This product includes software developed at the Apache Software Foundation...", though the ASF copyright line and any other portions of NOTICE must be considered for propagation.
-----Original Message-----
From: Steve Lawrence <sl...@apache.org>
Sent: Monday, March 21, 2022 10:24 AM
To: dev@daffodil.apache.org
Subject: EXT: Re: [VOTE] Release Apache Daffodil 3.3.0-rc1
WARNING: This email originated from outside of GE. Please validate the sender's email address before clicking on links or attachments as they may not be safe.
This page mentions LICENSE and NOTICE files for binary distributions:
https://infra.apache.org/licensing-howto.html#binary
If they are distributed in the convenience binary, no matter how many levels of transitive dependencies, the LICENSE/NOTICE information needs to be included.
That said, considering these all Apache licenses with standard notices, I'm okay keeping my vote a +1, as long as we ensure they are added in the next release.
On 3/21/22 12:47 PM, Interrante, John A (GE Research, US) wrote:
> I downloaded the helper binaries for each new dependency (except xmlresolver on which I'd already done due diligence as a direct dependency of Saxon-HE - the rest of those dependencies are dependencies of xmlresolver itself so I'd missed them) and checked LICENSE/NOTICE files. What is the rule we follow for incorporating such doubly indirect transitive dependencies' NOTICE files into our NOTICE file? Is the rule "If you find a NOTICE file, you must include it in its entirety into your NOTICE file"? If that is the rule, do people think we need to cancel the vote and generate a second release candidate with these NOTICE files added to our NOTICE file, or do it as a bug fix after releasing 3.3.0?
>
> I also noticed that xmlresolver is not using the latest versions of each and every dependency (oh well).
>
> Here's commons-codec-1.11/NOTICE.txt (the most recent version is 1.15):
>
> ---
> Apache Commons Codec
> Copyright 2002-2017 The Apache Software Foundation
>
> This product includes software developed at The Apache Software
> Foundation (http://www.apache.org/).
>
> src/test/org/apache/commons/codec/language/DoubleMetaphoneTest.java
> contains test data from http://aspell.net/test/orig/batch0.tab.
> Copyright (C) 2002 Kevin Atkinson (kevina@gnu.org)
>
> ======================================================================
> =========
>
> The content of package org.apache.commons.codec.language.bm has been
> translated from the original php source code available at
> http://stevemorse.org/phoneticinfo.htm
> with permission from the original authors.
> Original source copyright:
> Copyright (c) 2008 Alexander Beider & Stephen P. Morse.
> ---
>
> Here's commons-logging-1.2/NOTICE.txt:
>
> ---
> Apache Commons Logging
> Copyright 2003-2014 The Apache Software Foundation
>
> This product includes software developed at The Apache Software
> Foundation (http://www.apache.org/).
> ---
>
> Here is httpcomponents-client-4.5.13/NOTICE.txt (the most recent version is 5.1.3):
>
> ---
> Apache HttpComponents Client
> Copyright 1999-2020 The Apache Software Foundation
>
> This product includes software developed at The Apache Software
> Foundation (http://www.apache.org/).
> ---
>
> Here is httpcomponents-core-4.4.15/NOTICE.txt (the most recent version is 5.1.3):
>
> ---
> Apache HttpComponents Core
> Copyright 2005-2020 The Apache Software Foundation
>
> This product includes software developed at The Apache Software
> Foundation (http://www.apache.org/).
> ---
>
> All LICENSES are Apache 2.0.
>
> John
>
> -----Original Message-----
> From: Steve Lawrence <sl...@apache.org>
> Sent: Monday, March 21, 2022 9:06 AM
> To: dev@daffodil.apache.org
> Subject: EXT: Re: [VOTE] Release Apache Daffodil 3.3.0-rc1
>
> WARNING: This email originated from outside of GE. Please validate the sender's email address before clicking on links or attachments as they may not be safe.
>
> Hmm, I missed those new dependencies. Do we need to update our LICENSE/NOTICE files in daffodil-cli?
>
> Looks like we already have xmlresolver mentioned, but we have nothing for the other dependencies?
>
>
> On 3/21/22 12:00 PM, Interrante, John A (GE Research, US) wrote:
>> +1
>>
>> FYI, apache-daffodil-3.3.0-bin/lib has 6 new jars in it. Those new
>> jars are new transitive dependencies added by the bump of Saxon-HE
>> from 10.6 to 11.2. Their names are:
>>
>> commons-codec.commons-codec-1.11.jar
>> commons-logging.commons-logging-1.2.jar
>> org.apache.httpcomponents.httpclient-4.5.13.jar
>> org.apache.httpcomponents.httpcore-4.4.13.jar
>> org.xmlresolver.xmlresolver-4.2.0-data.jar
>> org.xmlresolver.xmlresolver-4.2.0.jar
>>
>> Otherwise, the helper binaries look normal.
>>
>> I checked the following:
>>
>> [OK] verified signature of git tag
>> [OK] verified signatures of source and helper binaries [OK] verified
>> signatures use key in KEYS with apache email address [OK] verified
>> source has no unexpected binary files [OK] verified source and git
>> tag are same minus KEYS file [OK] verified source and helper binaries
>> include LICENSE/NOTICE/README [OK] verified LICENSE/NOTICE/README
>> look correct [OK] verified online JavaDoc and ScalaDoc docs look
>> correct [OK] compiled source and ran all tests & ratCheck [OK]
>> verified jars built from source have same content as helper binary
>> jars
>>
>> John
>>
>> -----Original Message-----
>> From: Interrante, John A (GE Research, US) <Jo...@ge.com>
>> Sent: Friday, March 18, 2022 9:07 AM
>> To: dev@daffodil.apache.org
>> Subject: EXT: [VOTE] Release Apache Daffodil 3.3.0-rc1
>>
>> Hi PMC members,
>>
>> I'd like to call a vote to release Apache Daffodil 3.3.0-rc1.
>>
>> All distribution packages, including signatures, digests, etc. can be found at:
>>
>> https://dist.apache.org/repos/dist/dev/daffodil/3.3.0-rc1/
>>
>> Staging artifacts can be found at:
>>
>> https://repository.apache.org/content/repositories/orgapachedaffodil-
>> 1029/
>>
>> This release has been signed with PGP key 04A735FC1A36AE84, corresponding to jinterrante@apache.org, which is included in the KEYS file here:
>>
>> https://downloads.apache.org/daffodil/KEYS
>>
>> The release candidate has been tagged in git with v3.3.0-rc1.
>>
>> For reference, here is a list of all closed JIRAs tagged with 3.3.0:
>>
>> https://s.apache.org/daffodil-issues-3.3.0
>>
>> For a summary of the changes in this release, see:
>>
>> https://daffodil.apache.org/releases/3.3.0/
>>
>> Please review and vote. The vote will be open for at least 72 hours (Monday, March 21 2022, 12 Noon EST).
>>
>> [ ] +1 approve
>> [ ] +0 no opinion
>> [ ] -1 disapprove (and reason why)
>>
>> Thanks,
>> John
>
Re: [VOTE] Release Apache Daffodil 3.3.0-rc1
Posted by Steve Lawrence <sl...@apache.org>.
This page mentions LICENSE and NOTICE files for binary distributions:
https://infra.apache.org/licensing-howto.html#binary
If they are distributed in the convenience binary, no matter how many
levels of transitive dependencies, the LICENSE/NOTICE information needs
to be included.
That said, considering these all Apache licenses with standard notices,
I'm okay keeping my vote a +1, as long as we ensure they are added in
the next release.
On 3/21/22 12:47 PM, Interrante, John A (GE Research, US) wrote:
> I downloaded the helper binaries for each new dependency (except xmlresolver on which I'd already done due diligence as a direct dependency of Saxon-HE - the rest of those dependencies are dependencies of xmlresolver itself so I'd missed them) and checked LICENSE/NOTICE files. What is the rule we follow for incorporating such doubly indirect transitive dependencies' NOTICE files into our NOTICE file? Is the rule "If you find a NOTICE file, you must include it in its entirety into your NOTICE file"? If that is the rule, do people think we need to cancel the vote and generate a second release candidate with these NOTICE files added to our NOTICE file, or do it as a bug fix after releasing 3.3.0?
>
> I also noticed that xmlresolver is not using the latest versions of each and every dependency (oh well).
>
> Here's commons-codec-1.11/NOTICE.txt (the most recent version is 1.15):
>
> ---
> Apache Commons Codec
> Copyright 2002-2017 The Apache Software Foundation
>
> This product includes software developed at
> The Apache Software Foundation (http://www.apache.org/).
>
> src/test/org/apache/commons/codec/language/DoubleMetaphoneTest.java
> contains test data from http://aspell.net/test/orig/batch0.tab.
> Copyright (C) 2002 Kevin Atkinson (kevina@gnu.org)
>
> ===============================================================================
>
> The content of package org.apache.commons.codec.language.bm has been translated
> from the original php source code available at http://stevemorse.org/phoneticinfo.htm
> with permission from the original authors.
> Original source copyright:
> Copyright (c) 2008 Alexander Beider & Stephen P. Morse.
> ---
>
> Here's commons-logging-1.2/NOTICE.txt:
>
> ---
> Apache Commons Logging
> Copyright 2003-2014 The Apache Software Foundation
>
> This product includes software developed at
> The Apache Software Foundation (http://www.apache.org/).
> ---
>
> Here is httpcomponents-client-4.5.13/NOTICE.txt (the most recent version is 5.1.3):
>
> ---
> Apache HttpComponents Client
> Copyright 1999-2020 The Apache Software Foundation
>
> This product includes software developed at
> The Apache Software Foundation (http://www.apache.org/).
> ---
>
> Here is httpcomponents-core-4.4.15/NOTICE.txt (the most recent version is 5.1.3):
>
> ---
> Apache HttpComponents Core
> Copyright 2005-2020 The Apache Software Foundation
>
> This product includes software developed at
> The Apache Software Foundation (http://www.apache.org/).
> ---
>
> All LICENSES are Apache 2.0.
>
> John
>
> -----Original Message-----
> From: Steve Lawrence <sl...@apache.org>
> Sent: Monday, March 21, 2022 9:06 AM
> To: dev@daffodil.apache.org
> Subject: EXT: Re: [VOTE] Release Apache Daffodil 3.3.0-rc1
>
> WARNING: This email originated from outside of GE. Please validate the sender's email address before clicking on links or attachments as they may not be safe.
>
> Hmm, I missed those new dependencies. Do we need to update our LICENSE/NOTICE files in daffodil-cli?
>
> Looks like we already have xmlresolver mentioned, but we have nothing for the other dependencies?
>
>
> On 3/21/22 12:00 PM, Interrante, John A (GE Research, US) wrote:
>> +1
>>
>> FYI, apache-daffodil-3.3.0-bin/lib has 6 new jars in it. Those new
>> jars are new transitive dependencies added by the bump of Saxon-HE
>> from 10.6 to 11.2. Their names are:
>>
>> commons-codec.commons-codec-1.11.jar
>> commons-logging.commons-logging-1.2.jar
>> org.apache.httpcomponents.httpclient-4.5.13.jar
>> org.apache.httpcomponents.httpcore-4.4.13.jar
>> org.xmlresolver.xmlresolver-4.2.0-data.jar
>> org.xmlresolver.xmlresolver-4.2.0.jar
>>
>> Otherwise, the helper binaries look normal.
>>
>> I checked the following:
>>
>> [OK] verified signature of git tag
>> [OK] verified signatures of source and helper binaries
>> [OK] verified signatures use key in KEYS with apache email address
>> [OK] verified source has no unexpected binary files
>> [OK] verified source and git tag are same minus KEYS file
>> [OK] verified source and helper binaries include LICENSE/NOTICE/README
>> [OK] verified LICENSE/NOTICE/README look correct
>> [OK] verified online JavaDoc and ScalaDoc docs look correct
>> [OK] compiled source and ran all tests & ratCheck
>> [OK] verified jars built from source have same content as helper binary jars
>>
>> John
>>
>> -----Original Message-----
>> From: Interrante, John A (GE Research, US) <Jo...@ge.com>
>> Sent: Friday, March 18, 2022 9:07 AM
>> To: dev@daffodil.apache.org
>> Subject: EXT: [VOTE] Release Apache Daffodil 3.3.0-rc1
>>
>> Hi PMC members,
>>
>> I'd like to call a vote to release Apache Daffodil 3.3.0-rc1.
>>
>> All distribution packages, including signatures, digests, etc. can be found at:
>>
>> https://dist.apache.org/repos/dist/dev/daffodil/3.3.0-rc1/
>>
>> Staging artifacts can be found at:
>>
>> https://repository.apache.org/content/repositories/orgapachedaffodil-1029/
>>
>> This release has been signed with PGP key 04A735FC1A36AE84, corresponding to jinterrante@apache.org, which is included in the KEYS file here:
>>
>> https://downloads.apache.org/daffodil/KEYS
>>
>> The release candidate has been tagged in git with v3.3.0-rc1.
>>
>> For reference, here is a list of all closed JIRAs tagged with 3.3.0:
>>
>> https://s.apache.org/daffodil-issues-3.3.0
>>
>> For a summary of the changes in this release, see:
>>
>> https://daffodil.apache.org/releases/3.3.0/
>>
>> Please review and vote. The vote will be open for at least 72 hours (Monday, March 21 2022, 12 Noon EST).
>>
>> [ ] +1 approve
>> [ ] +0 no opinion
>> [ ] -1 disapprove (and reason why)
>>
>> Thanks,
>> John
>
[VOTE] Release Apache Daffodil 3.3.0-rc1
Posted by "Interrante, John A (GE Research, US)" <Jo...@ge.com>.
I downloaded the helper binaries for each new dependency (except xmlresolver on which I'd already done due diligence as a direct dependency of Saxon-HE - the rest of those dependencies are dependencies of xmlresolver itself so I'd missed them) and checked LICENSE/NOTICE files. What is the rule we follow for incorporating such doubly indirect transitive dependencies' NOTICE files into our NOTICE file? Is the rule "If you find a NOTICE file, you must include it in its entirety into your NOTICE file"? If that is the rule, do people think we need to cancel the vote and generate a second release candidate with these NOTICE files added to our NOTICE file, or do it as a bug fix after releasing 3.3.0?
I also noticed that xmlresolver is not using the latest versions of each and every dependency (oh well).
Here's commons-codec-1.11/NOTICE.txt (the most recent version is 1.15):
---
Apache Commons Codec
Copyright 2002-2017 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
src/test/org/apache/commons/codec/language/DoubleMetaphoneTest.java
contains test data from http://aspell.net/test/orig/batch0.tab.
Copyright (C) 2002 Kevin Atkinson (kevina@gnu.org)
===============================================================================
The content of package org.apache.commons.codec.language.bm has been translated
from the original php source code available at http://stevemorse.org/phoneticinfo.htm
with permission from the original authors.
Original source copyright:
Copyright (c) 2008 Alexander Beider & Stephen P. Morse.
---
Here's commons-logging-1.2/NOTICE.txt:
---
Apache Commons Logging
Copyright 2003-2014 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
---
Here is httpcomponents-client-4.5.13/NOTICE.txt (the most recent version is 5.1.3):
---
Apache HttpComponents Client
Copyright 1999-2020 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
---
Here is httpcomponents-core-4.4.15/NOTICE.txt (the most recent version is 5.1.3):
---
Apache HttpComponents Core
Copyright 2005-2020 The Apache Software Foundation
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
---
All LICENSES are Apache 2.0.
John
-----Original Message-----
From: Steve Lawrence <sl...@apache.org>
Sent: Monday, March 21, 2022 9:06 AM
To: dev@daffodil.apache.org
Subject: EXT: Re: [VOTE] Release Apache Daffodil 3.3.0-rc1
WARNING: This email originated from outside of GE. Please validate the sender's email address before clicking on links or attachments as they may not be safe.
Hmm, I missed those new dependencies. Do we need to update our LICENSE/NOTICE files in daffodil-cli?
Looks like we already have xmlresolver mentioned, but we have nothing for the other dependencies?
On 3/21/22 12:00 PM, Interrante, John A (GE Research, US) wrote:
> +1
>
> FYI, apache-daffodil-3.3.0-bin/lib has 6 new jars in it. Those new
> jars are new transitive dependencies added by the bump of Saxon-HE
> from 10.6 to 11.2. Their names are:
>
> commons-codec.commons-codec-1.11.jar
> commons-logging.commons-logging-1.2.jar
> org.apache.httpcomponents.httpclient-4.5.13.jar
> org.apache.httpcomponents.httpcore-4.4.13.jar
> org.xmlresolver.xmlresolver-4.2.0-data.jar
> org.xmlresolver.xmlresolver-4.2.0.jar
>
> Otherwise, the helper binaries look normal.
>
> I checked the following:
>
> [OK] verified signature of git tag
> [OK] verified signatures of source and helper binaries
> [OK] verified signatures use key in KEYS with apache email address
> [OK] verified source has no unexpected binary files
> [OK] verified source and git tag are same minus KEYS file
> [OK] verified source and helper binaries include LICENSE/NOTICE/README
> [OK] verified LICENSE/NOTICE/README look correct
> [OK] verified online JavaDoc and ScalaDoc docs look correct
> [OK] compiled source and ran all tests & ratCheck
> [OK] verified jars built from source have same content as helper binary jars
>
> John
>
> -----Original Message-----
> From: Interrante, John A (GE Research, US) <Jo...@ge.com>
> Sent: Friday, March 18, 2022 9:07 AM
> To: dev@daffodil.apache.org
> Subject: EXT: [VOTE] Release Apache Daffodil 3.3.0-rc1
>
> Hi PMC members,
>
> I'd like to call a vote to release Apache Daffodil 3.3.0-rc1.
>
> All distribution packages, including signatures, digests, etc. can be found at:
>
> https://dist.apache.org/repos/dist/dev/daffodil/3.3.0-rc1/
>
> Staging artifacts can be found at:
>
> https://repository.apache.org/content/repositories/orgapachedaffodil-1029/
>
> This release has been signed with PGP key 04A735FC1A36AE84, corresponding to jinterrante@apache.org, which is included in the KEYS file here:
>
> https://downloads.apache.org/daffodil/KEYS
>
> The release candidate has been tagged in git with v3.3.0-rc1.
>
> For reference, here is a list of all closed JIRAs tagged with 3.3.0:
>
> https://s.apache.org/daffodil-issues-3.3.0
>
> For a summary of the changes in this release, see:
>
> https://daffodil.apache.org/releases/3.3.0/
>
> Please review and vote. The vote will be open for at least 72 hours (Monday, March 21 2022, 12 Noon EST).
>
> [ ] +1 approve
> [ ] +0 no opinion
> [ ] -1 disapprove (and reason why)
>
> Thanks,
> John
Re: [VOTE] Release Apache Daffodil 3.3.0-rc1
Posted by Steve Lawrence <sl...@apache.org>.
Hmm, I missed those new dependencies. Do we need to update our
LICENSE/NOTICE files in daffodil-cli?
Looks like we already have xmlresolver mentioned, but we have nothing
for the other dependencies?
On 3/21/22 12:00 PM, Interrante, John A (GE Research, US) wrote:
> +1
>
> FYI, apache-daffodil-3.3.0-bin/lib has 6 new jars in it. Those new
> jars are new transitive dependencies added by the bump of Saxon-HE
> from 10.6 to 11.2. Their names are:
>
> commons-codec.commons-codec-1.11.jar
> commons-logging.commons-logging-1.2.jar
> org.apache.httpcomponents.httpclient-4.5.13.jar
> org.apache.httpcomponents.httpcore-4.4.13.jar
> org.xmlresolver.xmlresolver-4.2.0-data.jar
> org.xmlresolver.xmlresolver-4.2.0.jar
>
> Otherwise, the helper binaries look normal.
>
> I checked the following:
>
> [OK] verified signature of git tag
> [OK] verified signatures of source and helper binaries
> [OK] verified signatures use key in KEYS with apache email address
> [OK] verified source has no unexpected binary files
> [OK] verified source and git tag are same minus KEYS file
> [OK] verified source and helper binaries include LICENSE/NOTICE/README
> [OK] verified LICENSE/NOTICE/README look correct
> [OK] verified online JavaDoc and ScalaDoc docs look correct
> [OK] compiled source and ran all tests & ratCheck
> [OK] verified jars built from source have same content as helper binary jars
>
> John
>
> -----Original Message-----
> From: Interrante, John A (GE Research, US) <Jo...@ge.com>
> Sent: Friday, March 18, 2022 9:07 AM
> To: dev@daffodil.apache.org
> Subject: EXT: [VOTE] Release Apache Daffodil 3.3.0-rc1
>
> Hi PMC members,
>
> I'd like to call a vote to release Apache Daffodil 3.3.0-rc1.
>
> All distribution packages, including signatures, digests, etc. can be found at:
>
> https://dist.apache.org/repos/dist/dev/daffodil/3.3.0-rc1/
>
> Staging artifacts can be found at:
>
> https://repository.apache.org/content/repositories/orgapachedaffodil-1029/
>
> This release has been signed with PGP key 04A735FC1A36AE84, corresponding to jinterrante@apache.org, which is included in the KEYS file here:
>
> https://downloads.apache.org/daffodil/KEYS
>
> The release candidate has been tagged in git with v3.3.0-rc1.
>
> For reference, here is a list of all closed JIRAs tagged with 3.3.0:
>
> https://s.apache.org/daffodil-issues-3.3.0
>
> For a summary of the changes in this release, see:
>
> https://daffodil.apache.org/releases/3.3.0/
>
> Please review and vote. The vote will be open for at least 72 hours (Monday, March 21 2022, 12 Noon EST).
>
> [ ] +1 approve
> [ ] +0 no opinion
> [ ] -1 disapprove (and reason why)
>
> Thanks,
> John
RE: [VOTE] Release Apache Daffodil 3.3.0-rc1
Posted by "Interrante, John A (GE Research, US)" <Jo...@ge.com>.
+1
FYI, apache-daffodil-3.3.0-bin/lib has 6 new jars in it. Those new
jars are new transitive dependencies added by the bump of Saxon-HE
from 10.6 to 11.2. Their names are:
commons-codec.commons-codec-1.11.jar
commons-logging.commons-logging-1.2.jar
org.apache.httpcomponents.httpclient-4.5.13.jar
org.apache.httpcomponents.httpcore-4.4.13.jar
org.xmlresolver.xmlresolver-4.2.0-data.jar
org.xmlresolver.xmlresolver-4.2.0.jar
Otherwise, the helper binaries look normal.
I checked the following:
[OK] verified signature of git tag
[OK] verified signatures of source and helper binaries
[OK] verified signatures use key in KEYS with apache email address
[OK] verified source has no unexpected binary files
[OK] verified source and git tag are same minus KEYS file
[OK] verified source and helper binaries include LICENSE/NOTICE/README
[OK] verified LICENSE/NOTICE/README look correct
[OK] verified online JavaDoc and ScalaDoc docs look correct
[OK] compiled source and ran all tests & ratCheck
[OK] verified jars built from source have same content as helper binary jars
John
-----Original Message-----
From: Interrante, John A (GE Research, US) <Jo...@ge.com>
Sent: Friday, March 18, 2022 9:07 AM
To: dev@daffodil.apache.org
Subject: EXT: [VOTE] Release Apache Daffodil 3.3.0-rc1
Hi PMC members,
I'd like to call a vote to release Apache Daffodil 3.3.0-rc1.
All distribution packages, including signatures, digests, etc. can be found at:
https://dist.apache.org/repos/dist/dev/daffodil/3.3.0-rc1/
Staging artifacts can be found at:
https://repository.apache.org/content/repositories/orgapachedaffodil-1029/
This release has been signed with PGP key 04A735FC1A36AE84, corresponding to jinterrante@apache.org, which is included in the KEYS file here:
https://downloads.apache.org/daffodil/KEYS
The release candidate has been tagged in git with v3.3.0-rc1.
For reference, here is a list of all closed JIRAs tagged with 3.3.0:
https://s.apache.org/daffodil-issues-3.3.0
For a summary of the changes in this release, see:
https://daffodil.apache.org/releases/3.3.0/
Please review and vote. The vote will be open for at least 72 hours (Monday, March 21 2022, 12 Noon EST).
[ ] +1 approve
[ ] +0 no opinion
[ ] -1 disapprove (and reason why)
Thanks,
John