Hi Vincent, Thanks for your work in preparing this release!
On Wed, Jun 20, 2018 at 11:16 PM Vincent S Hou <s...@us.ibm.com> wrote: > ...There are totally 13 OpenWhisk projects within this release.... As mentioned earlier I don't think it is a good idea to release multiple modules in your first Incubator release: if a single module has a problem the whole release will fail, and it's not convenient for Incubator PMC reviewers (who might not be very familiar with your code) to review multiple modules in one go. I'm not sure if the Incubator PMC would even accept voting on multiple artifacts with a single vote. I recommend releasing one module first, to validate the release voting process and to get feedback that's probably applicable for other modules as well. With this in mind I have just looked at openwhisk-0.9.0-incubating-sources.tar.gz so far, here are my comments: 1) The digests match. 2) The 22CC20CC key used to sign the release is not available at https://dist.apache.org/repos/dist/release/incubator/openwhisk/KEYS (that file doesn't exist) nor at https://people.apache.org/keys/group/openwhisk.asc 3) I don't find build instructions in the README (which is also at https://github.com/apache/incubator-openwhisk), for convenience I'm not very familiar with gradle, tried this: ./gradlew tasks doesn't show anything specific to OpenWhisk IIUC ./gradlew tasks --all shows many tasks, it's unclear where to start I usually expect to see clear build instructions in such a release archive, but maybe I missed something. 4) LICENSE, DISCLAIMER, NOTICE look good to me 5) The .scala code files are in whisk.* packages, that should be org.apache.openwhisk.* for an Apache project. 6) I suppose you used Apache Rat to validate the license headers, I don't see instructions on how to run it to make those checks myself. 7) There's an RSA private key in the source archive, if it's for testing purposes it should be clearly identified as such (ideally named test- something) to reassure people that it's not problematic to distribute it (./ansible/roles/nginx/files/openwhisk-server-key.pem). 8) I don't see binary files in the release archive which is good, except for ./gradle/wrapper/gradle-wrapper.jar which I think is acceptable - but its digest should be kept track of, maybe in a jira ticket so people can validate it if they want. Those are the types of comments that you might get when the Incubator PMC validates releases, I suppose many of them apply to multiple projects so it's easier to start with just one module, fix or clarify these things and then do the rest. -Bertrand (with my incubation mentor hat on)