Hi， +0 Considering we use the Work In Progress Disclaimer, I suggest that we release this version first, and then document these issues and fix them in a later version. If everyone agrees, I will happily modify my vote to +1.
I checked: - incubating in name - signatures and hashes are fine -disclaimer-wip exists Binary package: 1. The binary version needs to include the license of all components required for compilation. If it is a standard AL2, it can be ignored. You can refer to [1] 2. The binary version of NOTICE needs to include the licenses of all dependent third-party components (AFAIK, this is only required when the license of the dependencies is AL2), you can refer to [2] 3. The LICENSE file of the binary version needs to declare which version of the source code your binary version is based on. You can refer to [3] Source package: 1. For the LICENSE file in the source code package, I don't know which specific codes are dependent on the source code, so I can't check whether it is correct or not. I suggest that we list the specific modifications in the license. 2. The license of logo.svg is Font Awesome Free License. I see that Font Awesome Free is free, open source, and GPL friendly. You can use it for commercial projects, open source projects, or really almost whatever you want. This is not allowed to be added to ASF projects. [1] https://github.com/apache/hadoop/tree/trunk/licenses-binary [2] https://github.com/apache/hadoop/blob/trunk/NOTICE-binary [3] https://github.com/apache/hadoop/blob/trunk/LICENSE-binary On Wed, Aug 30, 2023 at 4:10 AM Julian Hyde <jhyde.apa...@gmail.com> wrote: > > -1 (binding) > > Downloaded, checked src-tar contents against git tag [1], checked > LICENSE/NOTICE/README/DISCLAIMER [2], checked signatures/hashes[3], checked > for binaries in src-tar, compiled using OpenJDK 17 and Maven 3.8.1, ran rat. > > Everything that I checked looks good. But I’m voting -1 because of the binary > licensing issues that Calvin reported. Let’s get those issues fixed and do > another RC. > > By the way. I think we should keep the voting period to 3 days (or 4 days > over a weekend). Even though votes may sometimes take a long time, the voters > SHOULD try to vote promptly. If there is a serious issue, we would like to > discover it quickly and move to the next RC in a tempo of days rather than > weeks. > > Julian > > > [1] Git and src-tar mostly match: > > $ diff -r . /tmp/apache-baremaps-0.7.2-incubating-src/ > Only in /tmp/apache-baremaps-0.7.2-incubating-src/baremaps-cli/src: test > Only in /tmp/apache-baremaps-0.7.2-incubating-src/baremaps-ogcapi: target > Only in ./baremaps-renderer: assets > Only in ./baremaps-renderer: declaration.d.ts > Only in ./baremaps-renderer: .gitignore > Only in /tmp/apache-baremaps-0.7.2-incubating-src/baremaps-renderer: > node_modules > Only in ./baremaps-renderer: package.json > Only in ./baremaps-renderer: package-lock.json > Only in ./baremaps-renderer: .prettierignore > Only in ./baremaps-renderer: .prettierrc.json > Only in ./baremaps-renderer: README.md > Only in ./baremaps-renderer: tsconfig.json > Only in > /tmp/apache-baremaps-0.7.2-incubating-src/baremaps-server/src/main/resources: > maputnik > Only in .: basemap > Only in .: examples > Only in .: .git > Only in .: .github > Only in .: .gitignore > Only in .: .min > Only in .: mvnw > Only in .: mvnw.cmd > diff -r ./README /tmp/apache-baremaps-0.7.2-incubating-src/README > 1c1 > < # Apache Baremaps (incubating) ${project.version} > --- > > # Apache Baremaps (incubating) 0.7.2 > diff -r ./scripts/generate-artifacts.sh > /tmp/apache-baremaps-0.7.2-incubating-src/scripts/generate-artifacts.sh > 22c22 > < version=$(./mvnw -q -Dexec.executable=echo -Dexec.args='${project.version}' > --non-recursive exec:exec) > --- > > version=$(./mvnw -q -Dexec.executable=echo -Dexec.args='0.7.2' > > --non-recursive exec:exec) > 35c35 > < for artifact in ./baremaps-$version-incubating-*; do > --- > > for artifact in ./apache-baremaps-$version-incubating-*; do > > Any reason not to include .github/, .gitignore, examples, basemap, and the > various files in baremaps-renderer ? > > [2] In LICENSE, you should remove the "APPENDIX: How to apply the Apache > License to your work” section. > > [3] I received the same error as Calvin did: > > gpg: Good signature from "Bertil Chapuis <bchap...@gmail.com>" [unknown]. > gpg: WARNING: This key is not certified with a trusted signature! > gpg: There is no indication that the signature belongs to the > owner. > > This error can be fixed by Bertil getting his key signed by someone in our > web of trust. This can be done after release, but let’s get it done. > > > > On Aug 29, 2023, at 12:02 PM, Bertil Chapuis <bchap...@gmail.com> wrote: > > > > Hello Calvin, > > > > It would be great if you can list a few actionable items regarding > > licensing. > > > > https://github.com/apache/incubator-baremaps/issues/492 > > > > I did a pass on almost everything before joining the incubator, and had to > > rewrite or find alternatives to all the problematic GPL dependencies. A > > second pass made after joining the incubator revealed a few additional > > issues, but I think we are close from being compliant. In my opinion, the > > main issue is related to datasets (e.g. openstreetmap files) used in the > > tests. We added the DISCLAIMER-WIP to acknowledge these issues in the src > > and binary distributions without blocking the release process. > > > > Best regards, > > > > Bertil > > > >> On 29 Aug 2023, at 18:12, Josh Fischer <j...@joshfischer.io> wrote: > >> > >> Calvin, > >> > >> You made me think of a license question. With Heron, we kept a separate > >> copy of all the licenses that were not ALV2 [1]. Is this something that > >> needs to be done for Baremaps? > >> > >> 1. https://github.com/apache/incubator-heron/tree/master/licenses > >> > >> - Josh > >> > >>> On Aug 29, 2023, at 11:04 AM, Calvin Kirs <k...@apache.org> wrote: > >>> > >>> I'll find time tomorrow to list specific checks. > >>> BTW, we cannot fully rely on rat to indicate whether the license is > >>> compliant. > >>> In addition, regarding the modification of source code dependencies, > >>> we'd better list the specific files in the LICENSE file, otherwise it > >>> is difficult for us to judge whether this part is compliant. > >>> > >>> On Tue, Aug 29, 2023 at 11:31 PM Calvin Kirs <k...@apache.org > >>> <mailto:k...@apache.org>> wrote: > >>>> > >>>> On Tue, Aug 29, 2023 at 10:39 PM Josh Fischer <j...@joshfischer.io> > >>>> wrote: > >>>>> > >>>>> Right now I’m 0. > >>>>> > >>>>> I’ve not run across this before, I’m not sure if it’s an issue for the > >>>>> release. See gpg output below about the key not being certified. This > >>>>> is the reason my vote is 0 at the moment. > >>>>> gpg --verify $FILE.asc $FILE > >>>>> gpg: Signature made Thu Aug 24 07:11:17 2023 CDT > >>>>> gpg: using RSA key > >>>>> 16D7A0B27D5ADD52BD57932971751399FB39CB84 > >>>>> gpg: Good signature from "Bertil Chapuis <bchap...@gmail.com>" [unknown] > >>>>> gpg: WARNING: This key is not certified with a trusted signature! > >>>> > >>>> don't worry, it's ok. > >>>>> > >>>>> I checked: > >>>>> - Downloaded; checked hashes/signatures; checked LICENSE, NOTICE, > >>>>> DISCLAIMER-WIP; compiled and ran tests on OSX, OpenJDK 17, Maven 3.8.4. > >>>>> - Rat check showed 1441 unapproved licenses. However, since we are a > >>>>> WIP and I think this issue is known, so we are good. > >>>>> - I tried to run the example from the tar.gz binary, but the website > >>>>> seems to refer to the repo - not a release. As an example, the > >>>>> openStreet Map example wouldn’t work with one of our binary releases. > >>>>> This isn’t a blocker by any means, just a developer experience idea > >>>>> that I thought about while checking the release. > >>>>> > >>>>> $ cd examples/openstreetmap > >>>>> $ baremaps workflow execute --file workflow.json > >>>>> > >>>>> Because the “examples” folder wasn’t in the binary release I wasn’t > >>>>> sure how to run the example. > >>>>> > >>>>> - Josh > >>>>> > >>>>>> On Aug 28, 2023, at 3:20 PM, Bertil Chapuis <bchap...@gmail.com> wrote: > >>>>>> > >>>>>> Thank you Josh and Julian. There is no hurry, especially if we can > >>>>>> increase the duration of the vote. > >>>>>> > >>>>>> As we all have busy schedule, I will probably extend future release > >>>>>> votes to one week in the future. > >>>>>> > >>>>>> Best, > >>>>>> > >>>>>> Bertil > >>>>>> > >>>>>>> On 28 Aug 2023, at 19:07, Julian Hyde <jhyde.apa...@gmail.com> wrote: > >>>>>>> > >>>>>>> What Josh said. I’ll review & vote today. Apologies. > >>>>>>> > >>>>>>>> On Aug 28, 2023, at 7:42 AM, Josh Fischer <j...@joshfischer.io> > >>>>>>>> wrote: > >>>>>>>> > >>>>>>>> I apologize for my absence. I will spend some time looking at it in > >>>>>>>> the next 24 hours. > >>>>>>>> > >>>>>>>> This is one of the fun and challenging parts of working through the > >>>>>>>> incubator. I’ve had votes go over two weeks before. Our best bet is > >>>>>>>> to get as many binding (preferably 3) votes on the dev@baremaps > >>>>>>>> list. It’s often harder to get votes on general@a.o > >>>>>>>> <mailto:general@a.o>. > >>>>>>>> > >>>>>>>> > >>>>>>>> Let’s wait a few more days to get binding votes. Open-source moves > >>>>>>>> at the speed of open-source, fun! > >>>>>>>> > >>>>>>>>> On Aug 28, 2023, at 9:10 AM, Bertil Chapuis <bchap...@gmail.com> > >>>>>>>>> wrote: > >>>>>>>>> > >>>>>>>>> Hello Everyone, > >>>>>>>>> > >>>>>>>>> We don’t have enough vote for publishing our release. Can we extend > >>>>>>>>> the deadline or should we start a new vote? > >>>>>>>>> > >>>>>>>>> I see that some projects, such as Apache Pekko, ask the incubator > >>>>>>>>> mailing-list to vote for their releases. Should we try to do the > >>>>>>>>> same? > >>>>>>>>> > >>>>>>>>> Best regards, > >>>>>>>>> > >>>>>>>>> Bertil > >>>>>>>>> > >>>>>>>>> > >>>>>>>>>> On 24 Aug 2023, at 14:52, Bertil Chapuis <bchap...@gmail.com> > >>>>>>>>>> wrote: > >>>>>>>>>> > >>>>>>>>>> Hello Everyone, > >>>>>>>>>> > >>>>>>>>>> Following our online release party (thank you Leonard and > >>>>>>>>>> Perdjesk), we have created a build for Apache Baremaps > >>>>>>>>>> (incubating) 0.7.2, release candidate 1. > >>>>>>>>>> > >>>>>>>>>> Thanks to everyone who has contributed to this release. > >>>>>>>>>> > >>>>>>>>>> You can read the release notes here: > >>>>>>>>>> https://github.com/apache/incubator-baremaps/releases/tag/v0.7.2-rc1 > >>>>>>>>>> > >>>>>>>>>> The commit to be voted upon: > >>>>>>>>>> https://github.com/apache/incubator-baremaps/tree/v0.7.2-rc1 > >>>>>>>>>> > >>>>>>>>>> Its hash is e917d5b02fdb64c3f715afd449bb1fe9ca5c2f58. > >>>>>>>>>> > >>>>>>>>>> Its tag is v0.7.2-rc1. > >>>>>>>>>> > >>>>>>>>>> The artifacts to be voted on are located here: > >>>>>>>>>> https://dist.apache.org/repos/dist/dev/incubator/baremaps/0.7.2-rc1/ > >>>>>>>>>> > >>>>>>>>>> The hashes of the artifacts are as follows: > >>>>>>>>>> d910b50ebed4200d0ef6f0c1ee3e4db0cd95ea005fe54fca66dfc4ec4dca73e96edc8913654c85c73539d6a9d27481157fea9f456a9f3aa451c178a811a89ea0 > >>>>>>>>>> ./apache-baremaps-0.7.2-incubating-src.tar.gz > >>>>>>>>>> fda00056b9785bbbb7f966e92cf7e118071f5b6d44f9652176a4626cec38c5b0738933b24e23efef423eafba2111bc6a22e6f00a67fda2f10b0011f9c22f3208 > >>>>>>>>>> ./apache-baremaps-0.7.2-incubating-bin.tar.gz > >>>>>>>>>> > >>>>>>>>>> Release artifacts are signed with the following key: > >>>>>>>>>> http://people.apache.org/keys/committer/bchapuis.asc > >>>>>>>>>> https://downloads.apache.org/incubator/baremaps/KEYS > >>>>>>>>>> > >>>>>>>>>> The README file for the src distribution contains instructions for > >>>>>>>>>> building and testing the release. > >>>>>>>>>> > >>>>>>>>>> Please vote on releasing this package as Apache Baremaps 0.7.2. > >>>>>>>>>> > >>>>>>>>>> The vote is open for the next 72 hours and passes if a majority of > >>>>>>>>>> at least three +1 PMC votes are cast. > >>>>>>>>>> > >>>>>>>>>> [ ] +1 Release this package as Apache Baremaps <version> > >>>>>>>>>> [ ] 0 I don't feel strongly about it, but I'm okay with the release > >>>>>>>>>> [ ] -1 Do not release this package because... > >>>>>>>>>> > >>>>>>>>>> Here is my vote: > >>>>>>>>>> > >>>>>>>>>> +1 (binding): I checked the signatures and the checksums; I built > >>>>>>>>>> the project from its sources; and checked the binary distribution. > >>>>>>>>>> > >>>>>>>>>> Best regards, > >>>>>>>>>> > >>>>>>>>>> Bertil Chapuis > >>>>>>>>> > >>>>>>>> > >>>>>>> > >>>>>>> > >>>>>>> --------------------------------------------------------------------- > >>>>>>> To unsubscribe, e-mail: dev-unsubscr...@baremaps.apache.org > >>>>>>> For additional commands, e-mail: dev-h...@baremaps.apache.org > >>>>>>> > >>>>>> > >>>>> > >>>> > >>>> > >>>> -- > >>>> Best wishes！ > >>>> CalvinKirs > >>> > >>> > >>> > >>> -- > >>> Best wishes！ > >>> CalvinKirs > >>> > >>> --------------------------------------------------------------------- > >>> To unsubscribe, e-mail: dev-unsubscr...@baremaps.apache.org > >>> <mailto:dev-unsubscr...@baremaps.apache.org> > >>> For additional commands, e-mail: dev-h...@baremaps.apache.org > >>> <mailto:dev-h...@baremaps.apache.org> > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: dev-unsubscr...@baremaps.apache.org > For additional commands, e-mail: dev-h...@baremaps.apache.org > -- Best wishes！ CalvinKirs --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@baremaps.apache.org For additional commands, e-mail: dev-h...@baremaps.apache.org
