On 13 May 2016 at 03:18, Josh Elser <els...@apache.org> wrote: > Hey Sean, > > #1 sounds like you're right here. I hadn't done a close enough over the > codebase. I will defer to PMC members with more history than the few weeks I > have... > > #2/3 about the sandbox is intentional. There is code in the sandbox which is > not "fit to be released" (see so previous conversation on this, around rc0 > iirc). > > #4 I had to manually create the xsums, the release process doesn't do it > (and I didn't have any interest in making this work automated). That's why > the format is different (obviously the hashes should still be equal).
The format can be fixed manually if necessary, but it looks OK to me; it should be usable by many hash check programs. What command(s) did you use to create the RC? I just tried: $ mvn deploy -Prelease -Ptest-deploy -DskipTests and the md5 and sha1 files were created alongside the asc files under target/deploy/org/apache/commons/commons-vfs2/2.1-SNAPSHOT However there are only sigs under target/ This is normal behaviour, as Maven only creates hashes as part of deployment. Note that there are hashes on Nexus, e.g. https://repository.apache.org/content/repositories/orgapachecommons-1166/org/apache/commons/commons-vfs2-distribution/2.1/ There is a script to download the non-Maven archives from Nexus (and then delete them) but it does not work for multi-module builds as yet: https://svn.apache.org/repos/asf/commons/scripts/Nexus2DistDev.sh > > Sean Busbey wrote: >> >> -1 (non-binding) >> >> bad: >> >> * LICENSE/NOTICE file is missing a bundled third party reference[1] >> >> maybe fine: >> >> * source artifacts mostly match source tag[2] >> * build / test from source works[3] >> >> fine: >> * verified signatures and checksums[4] >> >> [1]: >> >> >> core/src/test/java/org/apache/commons/vfs2/provider/webdav/test/JcrUtils.java >> >> says it is copied from Apache Jackrabbit 2.4.0, which has a NOTICE.txt >> file. >> >> there is no mention of this in the source repo NOTICE (I would presume the >> related test jar would also be wrong). >> >> [2]: >> >> The source tag contains an additional module 'sandbox' that is not in the >> source artifact. >> >> I am not sure if this is intentional, but it looks like it is. >> >> [3]: >> >> Related to [2], if you run `mvn verify` things are fine, but if you use >> the sandbox profile, >> via `mvn -Pinclude-sandbox verify`, things fall over because the above >> mentioned module >> is missing. >> >> [4]: >> >> everything properly checks out, but the format of the md5 file was >> different for the artifacts in >> dist.apache compared to repository.apache. >> >> On 2016-05-11 20:29, Josh Elser<els...@apache.org> wrote: >>> >>> All, >>> >>> Please consider the following for Apache Commons VFS2 version 2.1 (rc2). >>> >>> Maven repository: >>> https://repository.apache.org/content/repositories/orgapachecommons-1166 >>> Artifacts: https://dist.apache.org/repos/dist/dev/commons/vfs/ r13608 >>> >>> MD5 commons-vfs-distribution-2.1-bin.tar.gz >>> 8cc35a3169e1faee727c5af94c7dd904 >>> SHA1 commons-vfs-distribution-2.1-bin.tar.gz >>> 72b7557c4e8b1789b8aa0a9c1e0cb2c9daecec30 >>> MD5 commons-vfs-distribution-2.1-src.tar.gz >>> a182ac642874e85fbc7d1086f7663482 >>> SHA1 commons-vfs-distribution-2.1-src.tar.gz >>> e42ac2053deb314277213e43f6f1d6b43eff3de9 >>> >>> MD5 commons-vfs-distribution-2.1-bin.zip >>> b512a45c63d824eef826f174fd7a9245 >>> SHA1 commons-vfs-distribution-2.1-bin.zip >>> 886cb5a430da58b3a68e2abf297b6f735d3ffaf0 >>> MD5 commons-vfs-distribution-2.1-src.zip >>> 29645a0ad091c15b2cf76b619c33069f >>> SHA1 commons-vfs-distribution-2.1-src.zip >>> 5824cf4d802865b5e93ff62c90affa58df6c4384 >>> >>> Signed with 4677D66C from >>> https://dist.apache.org/repos/dist/release/commons/KEYS >>> >>> SVN tag is available at >>> >>> https://svn.apache.org/repos/asf/commons/proper/vfs/tags/commons-vfs2-project-2.1-rc2/ >>> r1743451 >>> >>> Staged Maven website: >>> http://home.apache.org/~elserj/commons/commons-vfs-2.1/ >>> >>> All reports are available in the provided staged Maven site (see "Project >>> Reports" at the root-level as well as under each sub-module). >>> JIRA-generated >>> release notes are available in the dist.a.o "Artifacts" repository. Unit >>> tests pass and the RC was built util JDK6. >>> >>> (For Sebb) A direct Clirr link >>> >>> http://home.apache.org/~elserj/commons/commons-vfs-2.1/commons-vfs2/clirr-report.html >>> >>> Changes since rc1: >>> >>> * Fixed more compatibility concerns against 2.0 (thanks, Greg) >>> * Improved release notes (thanks, Sebb) >>> >>> This vote will be open for 72-hours, 2016/05/14 0400 UTC. >>> >>> [ ] +1 Release these artifacts as version 2.1 >>> [ ] 0 OK, but... >>> [ ] -1 I oppose these artifacts as version 2.1 because.. >>> >>> - Josh >>> >>> --------------------------------------------------------------------- >>> To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org >>> For additional commands, e-mail: dev-h...@commons.apache.org >>> >>> >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org >> For additional commands, e-mail: dev-h...@commons.apache.org >> > > --------------------------------------------------------------------- > To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org > For additional commands, e-mail: dev-h...@commons.apache.org > --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mail: dev-h...@commons.apache.org