You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by Brian Demers <bd...@apache.org> on 2024/01/09 23:09:16 UTC
[VOTE] Release Apache Directory SCIMple 1.0.0-M1
This is a call to vote in favor of releasing Apache Directory SCIMple
version 1.0.0-M1.
This is the initial release since moving the project from
https://github.com/PennState/SCIMple-Identity to the Apache Software
Foundation: https://github.com/apache/directory-scimple
Maven Staging Repo:
https://repository.apache.org/content/repositories/orgapachedirectory-1224
https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip
Dist Staging Repository:
https://dist.apache.org/repos/dist/dev/directory/scimple/1.0.0-M1/
Project website updates:
None - will be updated after successful vote
NOTES: I did notice there are a couple extra checksum files, i.e.:
https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip.asc.sha512
https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip.sha512.sha512
But I don't think that should block the release, and it's tracked
here: https://github.com/apache/directory-scimple/issues/489
Given that this is the first release, please give us your feedback!
Guide to testing staged releases:
http://maven.apache.org/guides/development/guide-testing-releases.html
Vote open for 72 hours.
[ ] +1
[ ] +0
[ ] -1 (please include reasoning)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Release Apache Directory SCIMple 1.0.0-M1
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi,
+1 from me. I've built the code, checked the signature, run the tests.
A "Getting Started" page would be good for new users, maybe a sample
project, if it doesn't exist already.
Colm.
On Tue, Jan 16, 2024 at 10:10 PM Brian Demers <bd...@apache.org> wrote:
>
> Hey All!
>
> Great questions added by Shawn!
>
> Hopefully I hit them all:
>
> > Guide to testing staged releases:
> > http://maven.apache.org/guides/development/guide-testing-releases.html
>
> This is optional, _techniall_ this is a guide explaining how to test
> the convenience binaries that will be deployed to Maven Central.
> I'm assuming most folks will use these binaries, (but officially, the
> ASF releases are source zip files)
> Which can be found:
> > https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip
> > https://dist.apache.org/repos/dist/dev/directory/scimple/1.0.0-M1/
>
> > Will there be a binary distribution?
>
> The source zip will be distributed via the official Apache Mirrors but
> the convenience binaries (jar files) will not be.
>
> > Are all of the transitive dependencies compatible w/ ASLv2 license?
>
> Another great question! I was ready to just say "yes" to this, but...
> there is one potential gray area when it comes to the test library.
> Here are a list of things that I spot checked:
>
> - Transitive "compile" scope dependencies of the client, server, and
> tools module.
> - Ensure no re-packaging happens in the example projects (e.g.
> creation of uber-jars, common for Spring Boot and Quarkus)
> - Checked licenses of jars repackaged in war file example
> - Test Library - SCIMple has a test module "scim-test" has a compile
> dependency on "JUnit", (This library can be used by SCIMple users to
> verify basic SCIM functionality works in their implementation).
>
> Per the ASF 3RD PARTY LICENSE POLICY [1], this seems fine (i'm not a
> lawyer), the EPL doesn't have an attribution clause, JUnit is not
> repackaged or distributed in a binary, and there IS notice in the jar
> in the `META-INF/DEPENDENCIES` file, and in the pom.xml. Consumers of
> this library would also need to explicitly configure those tests to
> run.
>
> We can/should spell this out more once we have a doc page describing
> how to add these tests to a custom project, but I don't think it's a
> problem with this release
>
> This is also similar to the Directory Server test module:
> org.apache.directory.server:apacheds-test-framework
> Though in that case the dependency is marked "provided" [2], and in
> SCIMple, it's "compile"
>
> We can do this in SCIMple too, (I'm happy to make this change[3] and
> re-spin the release if anyone thinks this should block)
>
> [1] - https://www.apache.org/legal/resolved.html#category-b
> [2] - https://github.com/apache/directory-server/blob/bdbec41/test-framework/pom.xml#L76-L79
> [3] - https://github.com/apache/directory-scimple/pull/501
>
> On Sun, Jan 14, 2024 at 6:11 PM Shawn McKinney <sm...@apache.org> wrote:
> >
> >
> >
> > > On Jan 14, 2024, at 10:03 AM, Shawn McKinney <sm...@apache.org> wrote:
> > >
> > > Disregard the dumb question. Pulled down the source, built, ran tests in the usual way.
> > >
> > > Have another dumb question - will there be a binary distribution?
> >
> > Err, dist outside of maven central repo, i.e. via apache mirrors.
> >
> > Assuming the answer is ‘no’.
> >
> > Still looking. Have successfully built, run tests. Verified hash of source distribution. Spot checking source has declared license.
> >
> > Rat should have done that already, so don’t expect to find any issues.
> >
> > So, far it looks good to me. Unfortunately I’m not well versed in verifying releases but trust that Emmanuel and Colm will adequately check.
> >
> > My outstanding question:
> >
> > Are all of the transitive dependencies compatible w/ ASLv2 license?
> >
> > —
> > Shawn
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: scimple-unsubscribe@directory.apache.org
> > For additional commands, e-mail: scimple-help@directory.apache.org
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
> For additional commands, e-mail: dev-help@directory.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Release Apache Directory SCIMple 1.0.0-M1
Posted by Brian Demers <bd...@apache.org>.
+1 from me
On Wed, Jan 17, 2024 at 1:21 PM Shawn McKinney <sm...@apache.org> wrote:
>
>
>
> > On Jan 16, 2024, at 4:09 PM, Brian Demers <bd...@apache.org> wrote:
> >
> > Hey All!
> >
> > Great questions added by Shawn!
> >
> > Hopefully I hit them all:
> >
> >> Guide to testing staged releases:
> >> http://maven.apache.org/guides/development/guide-testing-releases.html
> >
> > This is optional, _techniall_ this is a guide explaining how to test
> > the convenience binaries that will be deployed to Maven Central.
> > I'm assuming most folks will use these binaries, (but officially, the
> > ASF releases are source zip files)
> > Which can be found:
> >> https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip
> >> https://dist.apache.org/repos/dist/dev/directory/scimple/1.0.0-M1/
> >
> >> Will there be a binary distribution?
> >
> > The source zip will be distributed via the official Apache Mirrors but
> > the convenience binaries (jar files) will not be.
> >
> >> Are all of the transitive dependencies compatible w/ ASLv2 license?
> >
> > Another great question! I was ready to just say "yes" to this, but...
> > there is one potential gray area when it comes to the test library.
> > Here are a list of things that I spot checked:
> >
> > - Transitive "compile" scope dependencies of the client, server, and
> > tools module.
> > - Ensure no re-packaging happens in the example projects (e.g.
> > creation of uber-jars, common for Spring Boot and Quarkus)
> > - Checked licenses of jars repackaged in war file example
> > - Test Library - SCIMple has a test module "scim-test" has a compile
> > dependency on "JUnit", (This library can be used by SCIMple users to
> > verify basic SCIM functionality works in their implementation).
> >
> > Per the ASF 3RD PARTY LICENSE POLICY [1], this seems fine (i'm not a
> > lawyer), the EPL doesn't have an attribution clause, JUnit is not
> > repackaged or distributed in a binary, and there IS notice in the jar
> > in the `META-INF/DEPENDENCIES` file, and in the pom.xml. Consumers of
> > this library would also need to explicitly configure those tests to
> > run.
> >
> > We can/should spell this out more once we have a doc page describing
> > how to add these tests to a custom project, but I don't think it's a
> > problem with this release
> >
> > This is also similar to the Directory Server test module:
> > org.apache.directory.server:apacheds-test-framework
> > Though in that case the dependency is marked "provided" [2], and in
> > SCIMple, it's "compile"
> >
> > We can do this in SCIMple too, (I'm happy to make this change[3] and
> > re-spin the release if anyone thinks this should block)
> >
>
> Fortress has junit scoped to test, perhaps that would work going forward.
>
> But, should be OK for this release.
>
> Thanks for the clarifications. Nice work.
>
> I’m a +1 for this release. Looks good to me.
>
> —
> Shawn
>
> > [1] - https://www.apache.org/legal/resolved.html#category-b
> > [2] - https://github.com/apache/directory-server/blob/bdbec41/test-framework/pom.xml#L76-L79
> > [3] - https://github.com/apache/directory-scimple/pull/501
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Release Apache Directory SCIMple 1.0.0-M1
Posted by Brian Demers <bd...@apache.org>.
+1 from me
On Wed, Jan 17, 2024 at 1:21 PM Shawn McKinney <sm...@apache.org> wrote:
>
>
>
> > On Jan 16, 2024, at 4:09 PM, Brian Demers <bd...@apache.org> wrote:
> >
> > Hey All!
> >
> > Great questions added by Shawn!
> >
> > Hopefully I hit them all:
> >
> >> Guide to testing staged releases:
> >> http://maven.apache.org/guides/development/guide-testing-releases.html
> >
> > This is optional, _techniall_ this is a guide explaining how to test
> > the convenience binaries that will be deployed to Maven Central.
> > I'm assuming most folks will use these binaries, (but officially, the
> > ASF releases are source zip files)
> > Which can be found:
> >> https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip
> >> https://dist.apache.org/repos/dist/dev/directory/scimple/1.0.0-M1/
> >
> >> Will there be a binary distribution?
> >
> > The source zip will be distributed via the official Apache Mirrors but
> > the convenience binaries (jar files) will not be.
> >
> >> Are all of the transitive dependencies compatible w/ ASLv2 license?
> >
> > Another great question! I was ready to just say "yes" to this, but...
> > there is one potential gray area when it comes to the test library.
> > Here are a list of things that I spot checked:
> >
> > - Transitive "compile" scope dependencies of the client, server, and
> > tools module.
> > - Ensure no re-packaging happens in the example projects (e.g.
> > creation of uber-jars, common for Spring Boot and Quarkus)
> > - Checked licenses of jars repackaged in war file example
> > - Test Library - SCIMple has a test module "scim-test" has a compile
> > dependency on "JUnit", (This library can be used by SCIMple users to
> > verify basic SCIM functionality works in their implementation).
> >
> > Per the ASF 3RD PARTY LICENSE POLICY [1], this seems fine (i'm not a
> > lawyer), the EPL doesn't have an attribution clause, JUnit is not
> > repackaged or distributed in a binary, and there IS notice in the jar
> > in the `META-INF/DEPENDENCIES` file, and in the pom.xml. Consumers of
> > this library would also need to explicitly configure those tests to
> > run.
> >
> > We can/should spell this out more once we have a doc page describing
> > how to add these tests to a custom project, but I don't think it's a
> > problem with this release
> >
> > This is also similar to the Directory Server test module:
> > org.apache.directory.server:apacheds-test-framework
> > Though in that case the dependency is marked "provided" [2], and in
> > SCIMple, it's "compile"
> >
> > We can do this in SCIMple too, (I'm happy to make this change[3] and
> > re-spin the release if anyone thinks this should block)
> >
>
> Fortress has junit scoped to test, perhaps that would work going forward.
>
> But, should be OK for this release.
>
> Thanks for the clarifications. Nice work.
>
> I’m a +1 for this release. Looks good to me.
>
> —
> Shawn
>
> > [1] - https://www.apache.org/legal/resolved.html#category-b
> > [2] - https://github.com/apache/directory-server/blob/bdbec41/test-framework/pom.xml#L76-L79
> > [3] - https://github.com/apache/directory-scimple/pull/501
>
---------------------------------------------------------------------
To unsubscribe, e-mail: scimple-unsubscribe@directory.apache.org
For additional commands, e-mail: scimple-help@directory.apache.org
Re: [VOTE] Release Apache Directory SCIMple 1.0.0-M1
Posted by Shawn McKinney <sm...@apache.org>.
> On Jan 16, 2024, at 4:09 PM, Brian Demers <bd...@apache.org> wrote:
>
> Hey All!
>
> Great questions added by Shawn!
>
> Hopefully I hit them all:
>
>> Guide to testing staged releases:
>> http://maven.apache.org/guides/development/guide-testing-releases.html
>
> This is optional, _techniall_ this is a guide explaining how to test
> the convenience binaries that will be deployed to Maven Central.
> I'm assuming most folks will use these binaries, (but officially, the
> ASF releases are source zip files)
> Which can be found:
>> https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip
>> https://dist.apache.org/repos/dist/dev/directory/scimple/1.0.0-M1/
>
>> Will there be a binary distribution?
>
> The source zip will be distributed via the official Apache Mirrors but
> the convenience binaries (jar files) will not be.
>
>> Are all of the transitive dependencies compatible w/ ASLv2 license?
>
> Another great question! I was ready to just say "yes" to this, but...
> there is one potential gray area when it comes to the test library.
> Here are a list of things that I spot checked:
>
> - Transitive "compile" scope dependencies of the client, server, and
> tools module.
> - Ensure no re-packaging happens in the example projects (e.g.
> creation of uber-jars, common for Spring Boot and Quarkus)
> - Checked licenses of jars repackaged in war file example
> - Test Library - SCIMple has a test module "scim-test" has a compile
> dependency on "JUnit", (This library can be used by SCIMple users to
> verify basic SCIM functionality works in their implementation).
>
> Per the ASF 3RD PARTY LICENSE POLICY [1], this seems fine (i'm not a
> lawyer), the EPL doesn't have an attribution clause, JUnit is not
> repackaged or distributed in a binary, and there IS notice in the jar
> in the `META-INF/DEPENDENCIES` file, and in the pom.xml. Consumers of
> this library would also need to explicitly configure those tests to
> run.
>
> We can/should spell this out more once we have a doc page describing
> how to add these tests to a custom project, but I don't think it's a
> problem with this release
>
> This is also similar to the Directory Server test module:
> org.apache.directory.server:apacheds-test-framework
> Though in that case the dependency is marked "provided" [2], and in
> SCIMple, it's "compile"
>
> We can do this in SCIMple too, (I'm happy to make this change[3] and
> re-spin the release if anyone thinks this should block)
>
Fortress has junit scoped to test, perhaps that would work going forward.
But, should be OK for this release.
Thanks for the clarifications. Nice work.
I’m a +1 for this release. Looks good to me.
—
Shawn
> [1] - https://www.apache.org/legal/resolved.html#category-b
> [2] - https://github.com/apache/directory-server/blob/bdbec41/test-framework/pom.xml#L76-L79
> [3] - https://github.com/apache/directory-scimple/pull/501
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Release Apache Directory SCIMple 1.0.0-M1
Posted by Shawn McKinney <sm...@apache.org>.
> On Jan 16, 2024, at 4:09 PM, Brian Demers <bd...@apache.org> wrote:
>
> Hey All!
>
> Great questions added by Shawn!
>
> Hopefully I hit them all:
>
>> Guide to testing staged releases:
>> http://maven.apache.org/guides/development/guide-testing-releases.html
>
> This is optional, _techniall_ this is a guide explaining how to test
> the convenience binaries that will be deployed to Maven Central.
> I'm assuming most folks will use these binaries, (but officially, the
> ASF releases are source zip files)
> Which can be found:
>> https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip
>> https://dist.apache.org/repos/dist/dev/directory/scimple/1.0.0-M1/
>
>> Will there be a binary distribution?
>
> The source zip will be distributed via the official Apache Mirrors but
> the convenience binaries (jar files) will not be.
>
>> Are all of the transitive dependencies compatible w/ ASLv2 license?
>
> Another great question! I was ready to just say "yes" to this, but...
> there is one potential gray area when it comes to the test library.
> Here are a list of things that I spot checked:
>
> - Transitive "compile" scope dependencies of the client, server, and
> tools module.
> - Ensure no re-packaging happens in the example projects (e.g.
> creation of uber-jars, common for Spring Boot and Quarkus)
> - Checked licenses of jars repackaged in war file example
> - Test Library - SCIMple has a test module "scim-test" has a compile
> dependency on "JUnit", (This library can be used by SCIMple users to
> verify basic SCIM functionality works in their implementation).
>
> Per the ASF 3RD PARTY LICENSE POLICY [1], this seems fine (i'm not a
> lawyer), the EPL doesn't have an attribution clause, JUnit is not
> repackaged or distributed in a binary, and there IS notice in the jar
> in the `META-INF/DEPENDENCIES` file, and in the pom.xml. Consumers of
> this library would also need to explicitly configure those tests to
> run.
>
> We can/should spell this out more once we have a doc page describing
> how to add these tests to a custom project, but I don't think it's a
> problem with this release
>
> This is also similar to the Directory Server test module:
> org.apache.directory.server:apacheds-test-framework
> Though in that case the dependency is marked "provided" [2], and in
> SCIMple, it's "compile"
>
> We can do this in SCIMple too, (I'm happy to make this change[3] and
> re-spin the release if anyone thinks this should block)
>
Fortress has junit scoped to test, perhaps that would work going forward.
But, should be OK for this release.
Thanks for the clarifications. Nice work.
I’m a +1 for this release. Looks good to me.
—
Shawn
> [1] - https://www.apache.org/legal/resolved.html#category-b
> [2] - https://github.com/apache/directory-server/blob/bdbec41/test-framework/pom.xml#L76-L79
> [3] - https://github.com/apache/directory-scimple/pull/501
---------------------------------------------------------------------
To unsubscribe, e-mail: scimple-unsubscribe@directory.apache.org
For additional commands, e-mail: scimple-help@directory.apache.org
Re: [VOTE] Release Apache Directory SCIMple 1.0.0-M1
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi,
+1 from me. I've built the code, checked the signature, run the tests.
A "Getting Started" page would be good for new users, maybe a sample
project, if it doesn't exist already.
Colm.
On Tue, Jan 16, 2024 at 10:10 PM Brian Demers <bd...@apache.org> wrote:
>
> Hey All!
>
> Great questions added by Shawn!
>
> Hopefully I hit them all:
>
> > Guide to testing staged releases:
> > http://maven.apache.org/guides/development/guide-testing-releases.html
>
> This is optional, _techniall_ this is a guide explaining how to test
> the convenience binaries that will be deployed to Maven Central.
> I'm assuming most folks will use these binaries, (but officially, the
> ASF releases are source zip files)
> Which can be found:
> > https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip
> > https://dist.apache.org/repos/dist/dev/directory/scimple/1.0.0-M1/
>
> > Will there be a binary distribution?
>
> The source zip will be distributed via the official Apache Mirrors but
> the convenience binaries (jar files) will not be.
>
> > Are all of the transitive dependencies compatible w/ ASLv2 license?
>
> Another great question! I was ready to just say "yes" to this, but...
> there is one potential gray area when it comes to the test library.
> Here are a list of things that I spot checked:
>
> - Transitive "compile" scope dependencies of the client, server, and
> tools module.
> - Ensure no re-packaging happens in the example projects (e.g.
> creation of uber-jars, common for Spring Boot and Quarkus)
> - Checked licenses of jars repackaged in war file example
> - Test Library - SCIMple has a test module "scim-test" has a compile
> dependency on "JUnit", (This library can be used by SCIMple users to
> verify basic SCIM functionality works in their implementation).
>
> Per the ASF 3RD PARTY LICENSE POLICY [1], this seems fine (i'm not a
> lawyer), the EPL doesn't have an attribution clause, JUnit is not
> repackaged or distributed in a binary, and there IS notice in the jar
> in the `META-INF/DEPENDENCIES` file, and in the pom.xml. Consumers of
> this library would also need to explicitly configure those tests to
> run.
>
> We can/should spell this out more once we have a doc page describing
> how to add these tests to a custom project, but I don't think it's a
> problem with this release
>
> This is also similar to the Directory Server test module:
> org.apache.directory.server:apacheds-test-framework
> Though in that case the dependency is marked "provided" [2], and in
> SCIMple, it's "compile"
>
> We can do this in SCIMple too, (I'm happy to make this change[3] and
> re-spin the release if anyone thinks this should block)
>
> [1] - https://www.apache.org/legal/resolved.html#category-b
> [2] - https://github.com/apache/directory-server/blob/bdbec41/test-framework/pom.xml#L76-L79
> [3] - https://github.com/apache/directory-scimple/pull/501
>
> On Sun, Jan 14, 2024 at 6:11 PM Shawn McKinney <sm...@apache.org> wrote:
> >
> >
> >
> > > On Jan 14, 2024, at 10:03 AM, Shawn McKinney <sm...@apache.org> wrote:
> > >
> > > Disregard the dumb question. Pulled down the source, built, ran tests in the usual way.
> > >
> > > Have another dumb question - will there be a binary distribution?
> >
> > Err, dist outside of maven central repo, i.e. via apache mirrors.
> >
> > Assuming the answer is ‘no’.
> >
> > Still looking. Have successfully built, run tests. Verified hash of source distribution. Spot checking source has declared license.
> >
> > Rat should have done that already, so don’t expect to find any issues.
> >
> > So, far it looks good to me. Unfortunately I’m not well versed in verifying releases but trust that Emmanuel and Colm will adequately check.
> >
> > My outstanding question:
> >
> > Are all of the transitive dependencies compatible w/ ASLv2 license?
> >
> > —
> > Shawn
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: scimple-unsubscribe@directory.apache.org
> > For additional commands, e-mail: scimple-help@directory.apache.org
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
> For additional commands, e-mail: dev-help@directory.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: scimple-unsubscribe@directory.apache.org
For additional commands, e-mail: scimple-help@directory.apache.org
Re: [VOTE] Release Apache Directory SCIMple 1.0.0-M1
Posted by Brian Demers <bd...@apache.org>.
Hey All!
Great questions added by Shawn!
Hopefully I hit them all:
> Guide to testing staged releases:
> http://maven.apache.org/guides/development/guide-testing-releases.html
This is optional, _techniall_ this is a guide explaining how to test
the convenience binaries that will be deployed to Maven Central.
I'm assuming most folks will use these binaries, (but officially, the
ASF releases are source zip files)
Which can be found:
> https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip
> https://dist.apache.org/repos/dist/dev/directory/scimple/1.0.0-M1/
> Will there be a binary distribution?
The source zip will be distributed via the official Apache Mirrors but
the convenience binaries (jar files) will not be.
> Are all of the transitive dependencies compatible w/ ASLv2 license?
Another great question! I was ready to just say "yes" to this, but...
there is one potential gray area when it comes to the test library.
Here are a list of things that I spot checked:
- Transitive "compile" scope dependencies of the client, server, and
tools module.
- Ensure no re-packaging happens in the example projects (e.g.
creation of uber-jars, common for Spring Boot and Quarkus)
- Checked licenses of jars repackaged in war file example
- Test Library - SCIMple has a test module "scim-test" has a compile
dependency on "JUnit", (This library can be used by SCIMple users to
verify basic SCIM functionality works in their implementation).
Per the ASF 3RD PARTY LICENSE POLICY [1], this seems fine (i'm not a
lawyer), the EPL doesn't have an attribution clause, JUnit is not
repackaged or distributed in a binary, and there IS notice in the jar
in the `META-INF/DEPENDENCIES` file, and in the pom.xml. Consumers of
this library would also need to explicitly configure those tests to
run.
We can/should spell this out more once we have a doc page describing
how to add these tests to a custom project, but I don't think it's a
problem with this release
This is also similar to the Directory Server test module:
org.apache.directory.server:apacheds-test-framework
Though in that case the dependency is marked "provided" [2], and in
SCIMple, it's "compile"
We can do this in SCIMple too, (I'm happy to make this change[3] and
re-spin the release if anyone thinks this should block)
[1] - https://www.apache.org/legal/resolved.html#category-b
[2] - https://github.com/apache/directory-server/blob/bdbec41/test-framework/pom.xml#L76-L79
[3] - https://github.com/apache/directory-scimple/pull/501
On Sun, Jan 14, 2024 at 6:11 PM Shawn McKinney <sm...@apache.org> wrote:
>
>
>
> > On Jan 14, 2024, at 10:03 AM, Shawn McKinney <sm...@apache.org> wrote:
> >
> > Disregard the dumb question. Pulled down the source, built, ran tests in the usual way.
> >
> > Have another dumb question - will there be a binary distribution?
>
> Err, dist outside of maven central repo, i.e. via apache mirrors.
>
> Assuming the answer is ‘no’.
>
> Still looking. Have successfully built, run tests. Verified hash of source distribution. Spot checking source has declared license.
>
> Rat should have done that already, so don’t expect to find any issues.
>
> So, far it looks good to me. Unfortunately I’m not well versed in verifying releases but trust that Emmanuel and Colm will adequately check.
>
> My outstanding question:
>
> Are all of the transitive dependencies compatible w/ ASLv2 license?
>
> —
> Shawn
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: scimple-unsubscribe@directory.apache.org
> For additional commands, e-mail: scimple-help@directory.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: scimple-unsubscribe@directory.apache.org
For additional commands, e-mail: scimple-help@directory.apache.org
Re: [VOTE] Release Apache Directory SCIMple 1.0.0-M1
Posted by Brian Demers <bd...@apache.org>.
Hey All!
Great questions added by Shawn!
Hopefully I hit them all:
> Guide to testing staged releases:
> http://maven.apache.org/guides/development/guide-testing-releases.html
This is optional, _techniall_ this is a guide explaining how to test
the convenience binaries that will be deployed to Maven Central.
I'm assuming most folks will use these binaries, (but officially, the
ASF releases are source zip files)
Which can be found:
> https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip
> https://dist.apache.org/repos/dist/dev/directory/scimple/1.0.0-M1/
> Will there be a binary distribution?
The source zip will be distributed via the official Apache Mirrors but
the convenience binaries (jar files) will not be.
> Are all of the transitive dependencies compatible w/ ASLv2 license?
Another great question! I was ready to just say "yes" to this, but...
there is one potential gray area when it comes to the test library.
Here are a list of things that I spot checked:
- Transitive "compile" scope dependencies of the client, server, and
tools module.
- Ensure no re-packaging happens in the example projects (e.g.
creation of uber-jars, common for Spring Boot and Quarkus)
- Checked licenses of jars repackaged in war file example
- Test Library - SCIMple has a test module "scim-test" has a compile
dependency on "JUnit", (This library can be used by SCIMple users to
verify basic SCIM functionality works in their implementation).
Per the ASF 3RD PARTY LICENSE POLICY [1], this seems fine (i'm not a
lawyer), the EPL doesn't have an attribution clause, JUnit is not
repackaged or distributed in a binary, and there IS notice in the jar
in the `META-INF/DEPENDENCIES` file, and in the pom.xml. Consumers of
this library would also need to explicitly configure those tests to
run.
We can/should spell this out more once we have a doc page describing
how to add these tests to a custom project, but I don't think it's a
problem with this release
This is also similar to the Directory Server test module:
org.apache.directory.server:apacheds-test-framework
Though in that case the dependency is marked "provided" [2], and in
SCIMple, it's "compile"
We can do this in SCIMple too, (I'm happy to make this change[3] and
re-spin the release if anyone thinks this should block)
[1] - https://www.apache.org/legal/resolved.html#category-b
[2] - https://github.com/apache/directory-server/blob/bdbec41/test-framework/pom.xml#L76-L79
[3] - https://github.com/apache/directory-scimple/pull/501
On Sun, Jan 14, 2024 at 6:11 PM Shawn McKinney <sm...@apache.org> wrote:
>
>
>
> > On Jan 14, 2024, at 10:03 AM, Shawn McKinney <sm...@apache.org> wrote:
> >
> > Disregard the dumb question. Pulled down the source, built, ran tests in the usual way.
> >
> > Have another dumb question - will there be a binary distribution?
>
> Err, dist outside of maven central repo, i.e. via apache mirrors.
>
> Assuming the answer is ‘no’.
>
> Still looking. Have successfully built, run tests. Verified hash of source distribution. Spot checking source has declared license.
>
> Rat should have done that already, so don’t expect to find any issues.
>
> So, far it looks good to me. Unfortunately I’m not well versed in verifying releases but trust that Emmanuel and Colm will adequately check.
>
> My outstanding question:
>
> Are all of the transitive dependencies compatible w/ ASLv2 license?
>
> —
> Shawn
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: scimple-unsubscribe@directory.apache.org
> For additional commands, e-mail: scimple-help@directory.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Release Apache Directory SCIMple 1.0.0-M1
Posted by Shawn McKinney <sm...@apache.org>.
> On Jan 14, 2024, at 10:03 AM, Shawn McKinney <sm...@apache.org> wrote:
>
> Disregard the dumb question. Pulled down the source, built, ran tests in the usual way.
>
> Have another dumb question - will there be a binary distribution?
Err, dist outside of maven central repo, i.e. via apache mirrors.
Assuming the answer is ‘no’.
Still looking. Have successfully built, run tests. Verified hash of source distribution. Spot checking source has declared license.
Rat should have done that already, so don’t expect to find any issues.
So, far it looks good to me. Unfortunately I’m not well versed in verifying releases but trust that Emmanuel and Colm will adequately check.
My outstanding question:
Are all of the transitive dependencies compatible w/ ASLv2 license?
—
Shawn
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Release Apache Directory SCIMple 1.0.0-M1
Posted by Shawn McKinney <sm...@apache.org>.
> On Jan 14, 2024, at 10:03 AM, Shawn McKinney <sm...@apache.org> wrote:
>
> Disregard the dumb question. Pulled down the source, built, ran tests in the usual way.
>
> Have another dumb question - will there be a binary distribution?
Err, dist outside of maven central repo, i.e. via apache mirrors.
Assuming the answer is ‘no’.
Still looking. Have successfully built, run tests. Verified hash of source distribution. Spot checking source has declared license.
Rat should have done that already, so don’t expect to find any issues.
So, far it looks good to me. Unfortunately I’m not well versed in verifying releases but trust that Emmanuel and Colm will adequately check.
My outstanding question:
Are all of the transitive dependencies compatible w/ ASLv2 license?
—
Shawn
---------------------------------------------------------------------
To unsubscribe, e-mail: scimple-unsubscribe@directory.apache.org
For additional commands, e-mail: scimple-help@directory.apache.org
Re: [VOTE] Release Apache Directory SCIMple 1.0.0-M1
Posted by Shawn McKinney <sm...@apache.org>.
> On Jan 14, 2024, at 9:03 AM, Shawn McKinney <sm...@apache.org> wrote:
>
> Hi Brian,
>
> Usually when testing a release I’ll create a VM and delete it when finished.
>
> So, I don’t care about such things as clearing out repos.
>
> So, I’m confused reading the testing release guides directions to change repo config, setup archiva, etc. Is this required?
>
> Typically, pull down the source either by commit tag or from a staged repo and build it, which runs the tests. Next, check signatures, make sure the proper license and notifications are in place. Review the libs to ensure they’re Apache2 compatibls and call it good.
>
> Sorry, for the ramble. Call me a newbie on Scimple. Again, just need the simplest means to pull down source, build and run the tests.
>
Disregard the dumb question. Pulled down the source, built, ran tests in the usual way.
Have another dumb question - will there be a binary distribution?
> Thanks
---------------------------------------------------------------------
To unsubscribe, e-mail: scimple-unsubscribe@directory.apache.org
For additional commands, e-mail: scimple-help@directory.apache.org
Re: [VOTE] Release Apache Directory SCIMple 1.0.0-M1
Posted by Shawn McKinney <sm...@apache.org>.
> On Jan 14, 2024, at 9:03 AM, Shawn McKinney <sm...@apache.org> wrote:
>
> Hi Brian,
>
> Usually when testing a release I’ll create a VM and delete it when finished.
>
> So, I don’t care about such things as clearing out repos.
>
> So, I’m confused reading the testing release guides directions to change repo config, setup archiva, etc. Is this required?
>
> Typically, pull down the source either by commit tag or from a staged repo and build it, which runs the tests. Next, check signatures, make sure the proper license and notifications are in place. Review the libs to ensure they’re Apache2 compatibls and call it good.
>
> Sorry, for the ramble. Call me a newbie on Scimple. Again, just need the simplest means to pull down source, build and run the tests.
>
Disregard the dumb question. Pulled down the source, built, ran tests in the usual way.
Have another dumb question - will there be a binary distribution?
> Thanks
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Release Apache Directory SCIMple 1.0.0-M1
Posted by Shawn McKinney <sm...@apache.org>.
> On Jan 9, 2024, at 5:09 PM, Brian Demers <bd...@apache.org> wrote:
>
> This is a call to vote in favor of releasing Apache Directory SCIMple
> version 1.0.0-M1.
>
> This is the initial release since moving the project from
> https://github.com/PennState/SCIMple-Identity to the Apache Software
> Foundation: https://github.com/apache/directory-scimple
>
> Maven Staging Repo:
> https://repository.apache.org/content/repositories/orgapachedirectory-1224
> https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip
>
> Dist Staging Repository:
> https://dist.apache.org/repos/dist/dev/directory/scimple/1.0.0-M1/
>
> Project website updates:
> None - will be updated after successful vote
>
> NOTES: I did notice there are a couple extra checksum files, i.e.:
> https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip.asc.sha512
> https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip.sha512.sha512
> But I don't think that should block the release, and it's tracked
> here: https://github.com/apache/directory-scimple/issues/489
>
> Given that this is the first release, please give us your feedback!
>
> Guide to testing staged releases:
> http://maven.apache.org/guides/development/guide-testing-releases.html
>
Hi Brian,
Usually when testing a release I’ll create a VM and delete it when finished.
So, I don’t care about such things as clearing out repos.
So, I’m confused reading the testing release guides directions to change repo config, setup archiva, etc. Is this required?
Typically, pull down the source either by commit tag or from a staged repo and build it, which runs the tests. Next, check signatures, make sure the proper license and notifications are in place. Review the libs to ensure they’re Apache2 compatibls and call it good.
Sorry, for the ramble. Call me a newbie on Scimple. Again, just need the simplest means to pull down source, build and run the tests.
Thanks
—
Shawn
> Vote open for 72 hours.
>
> [ ] +1
> [ ] +0
> [ ] -1 (please include reasoning)
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: scimple-unsubscribe@directory.apache.org
> For additional commands, e-mail: scimple-help@directory.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org
Re: [VOTE] Release Apache Directory SCIMple 1.0.0-M1
Posted by Shawn McKinney <sm...@apache.org>.
> On Jan 9, 2024, at 5:09 PM, Brian Demers <bd...@apache.org> wrote:
>
> This is a call to vote in favor of releasing Apache Directory SCIMple
> version 1.0.0-M1.
>
> This is the initial release since moving the project from
> https://github.com/PennState/SCIMple-Identity to the Apache Software
> Foundation: https://github.com/apache/directory-scimple
>
> Maven Staging Repo:
> https://repository.apache.org/content/repositories/orgapachedirectory-1224
> https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip
>
> Dist Staging Repository:
> https://dist.apache.org/repos/dist/dev/directory/scimple/1.0.0-M1/
>
> Project website updates:
> None - will be updated after successful vote
>
> NOTES: I did notice there are a couple extra checksum files, i.e.:
> https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip.asc.sha512
> https://repository.apache.org/service/local/repositories/orgapachedirectory-1224/content/org/apache/directory/scimple/scimple/1.0.0-M1/scimple-1.0.0-M1-source-release.zip.sha512.sha512
> But I don't think that should block the release, and it's tracked
> here: https://github.com/apache/directory-scimple/issues/489
>
> Given that this is the first release, please give us your feedback!
>
> Guide to testing staged releases:
> http://maven.apache.org/guides/development/guide-testing-releases.html
>
Hi Brian,
Usually when testing a release I’ll create a VM and delete it when finished.
So, I don’t care about such things as clearing out repos.
So, I’m confused reading the testing release guides directions to change repo config, setup archiva, etc. Is this required?
Typically, pull down the source either by commit tag or from a staged repo and build it, which runs the tests. Next, check signatures, make sure the proper license and notifications are in place. Review the libs to ensure they’re Apache2 compatibls and call it good.
Sorry, for the ramble. Call me a newbie on Scimple. Again, just need the simplest means to pull down source, build and run the tests.
Thanks
—
Shawn
> Vote open for 72 hours.
>
> [ ] +1
> [ ] +0
> [ ] -1 (please include reasoning)
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: scimple-unsubscribe@directory.apache.org
> For additional commands, e-mail: scimple-help@directory.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: scimple-unsubscribe@directory.apache.org
For additional commands, e-mail: scimple-help@directory.apache.org