Thanks Daniel for updating the build scripts. Canceling the vote due to SHA1/MD5 checksums.
Cheers, Fokko Op ma 29 apr. 2019 om 20:14 schreef Driesprong, Fokko <[email protected] >: > Thanks for bringing this up Ismaël. Let me update the checksums. > > Cheers, Fokko > > Op ma 29 apr. 2019 om 19:49 schreef Daniel Kulp <[email protected]>: > >> This should be easily fixed by just adding the relevant sha512, no need >> to completely rebuild unless something else pops up. >> >> I’ve updated the Avro build.sh to generate the sha512 instead of the >> md5/sha1files so if we do need to rebuild, that should be take care of >> now. >> >> Dan >> >> >> > On Apr 29, 2019, at 11:01 AM, Ismaël Mejía <[email protected]> wrote: >> > >> > Thanks a lot Fokko for putting this out, I don't know if this is a >> reason to -1 >> > the vote but we should not supply MD5 or SHA1 checksums, and we should >> add >> > SHA-256 and/or SHA-512 following the Apache distribution policy. >> > >> > https://www.apache.org/dev/release-distribution.html#sigs-and-sums >> > >> > This is a change that happened probably like 1y ago but since it has >> been long >> > since Avro's latest release we need to upgrade the scripts to produce >> the >> > suggested checksums. >> > >> > On Mon, Apr 29, 2019 at 12:57 PM Driesprong, Fokko <[email protected]> >> wrote: >> >> >> >> Hi everyone, >> >> >> >> Since the last release of Apache Avro 1.8.2 on May 31, 2017. Two years >> >> later, >> >> I'm thrilled to propose the following RC to be released as official >> Apache >> >> Avro 1.9.0 release. >> >> >> >> The commit id is 8dbe05a17363a1281482e8611cfead4c04645f47 >> >> * This corresponds to the tag: release-1.9.0-rc2 >> >> * https://github.com/apache/avro/releases/tag/release-1.9.0-rc2/ >> >> >> >> The release tarball, signature, and checksums are here: >> >> * https://dist.apache.org/repos/dist/dev/avro/avro-1.9.0-rc2/ >> >> >> >> You can find the KEYS file here: >> >> * https://dist.apache.org/repos/dist/dev/avro/KEYS >> >> >> >> Binary artifacts for Java are staged in Nexus here: >> >> * >> >> >> https://repository.apache.org/content/groups/staging/org/apache/avro/avro/1.9.0/ >> >> >> >> This release includes 272 Jira issues: >> >> https://issues.apache.org/jira/projects/AVRO/versions/12333394 >> >> * Deprecate Joda-Time in favor of Java8 JSR310 and setting it as >> default >> >> * Remove support for Hadoop 1.x >> >> * Move from Jackson 1.x to 2.9 >> >> * Add ZStandard Codec >> >> * Lots of updates on the dependencies to fix CVE's >> >> * and many, many more! >> >> >> >> Since RC1, two commits have been added: >> >> * https://jira.apache.org/jira/browse/AVRO-2381 >> >> * https://jira.apache.org/jira/browse/AVRO-2383 >> >> >> >> Please download, verify, and test. This vote will remain open for at >> least >> >> 72 hours. Given sufficient votes, I would like to close it on or about >> >> midnight >> >> on Thursday, 2nd of May 2019. >> >> >> >> [ ] +1 Release this as Apache Avro 1.9.0 >> >> [ ] +0 >> >> [ ] -1 Do not release this because... >> >> >> >> Consider this a +1 (non-binding) from my side: >> >> * Compiled the new version of Parquet against the Divolte collector and >> >> Apache Parquet >> >> >> >> Cheers, Fokko Driesprong >> >> -- >> Daniel Kulp >> [email protected] <mailto:[email protected]> - http://dankulp.com/blog < >> http://dankulp.com/blog> >> Talend Community Coder - http://talend.com <http://coders.talend.com/> >> >
