Hi Penghui,
Thanks for your great work!
I found two problems with this candidate, I'm not sure whether it will
block this release.
- There are some CVEs in this candidate. Please refer to:
https://github.com/apache/pulsar/runs/6854904384?check_suite_focus=true
- When I import `pulsar-broker` and `managed-ledger` into my
project, I found the project build failed with the following
exceptions.
```
[ERROR] Failed to execute goal on project test_pulsar_lib: Could not
resolve dependencies for project
org.example:test_pulsar_lib:jar:1.0-SNAPSHOT: Failed to collect
dependencies for org.example:test_pulsar_lib:jar:1.0-SNAPSHOT: Could
not resolve version conflict among
[org.apache.pulsar:pulsar-broker:jar:2.10.1 ->
org.apache.pulsar:pulsar-zookeeper-utils:jar:2.10.1 ->
org.apache.bookkeeper:stream-storage-server:jar:4.14.5 ->
org.apache.bookkeeper:stream-storage-java-client:jar:4.14.5 ->
io.grpc:grpc-core:jar:1.42.1,
org.apache.pulsar:pulsar-broker:jar:2.10.1 ->
org.apache.pulsar:pulsar-zookeeper-utils:jar:2.10.1 ->
org.apache.bookkeeper:stream-storage-server:jar:4.14.5 ->
org.apache.bookkeeper:stream-storage-java-client:jar:4.14.5 ->
io.grpc:grpc-testing:jar:1.42.1 ->
io.grpc:grpc-core:jar:[1.42.1,1.42.1],
org.apache.pulsar:pulsar-broker:jar:2.10.1 ->
org.apache.pulsar:pulsar-zookeeper-utils:jar:2.10.1 ->
io.grpc:grpc-all:jar:1.45.1 -> io.grpc:grpc-core:jar:[1.45.1,1.45.1],
org.apache.pulsar:pulsar-broker:jar:2.10.1 ->
org.apache.pulsar:pulsar-zookeeper-utils:jar:2.10.1 ->
io.grpc:grpc-all:jar:1.45.1 -> io.grpc:grpc-grpclb:jar:1.45.1 ->
io.grpc:grpc-core:jar:[1.45.1,1.45.1],
org.apache.pulsar:pulsar-broker:jar:2.10.1 ->
org.apache.pulsar:pulsar-zookeeper-utils:jar:2.10.1 ->
io.grpc:grpc-all:jar:1.45.1 -> io.grpc:grpc-netty:jar:1.45.1 ->
io.grpc:grpc-core:jar:[1.45.1,1.45.1],
org.apache.pulsar:pulsar-broker:jar:2.10.1 ->
org.apache.pulsar:pulsar-zookeeper-utils:jar:2.10.1 ->
io.grpc:grpc-all:jar:1.45.1 -> io.grpc:grpc-rls:jar:1.45.1 ->
io.grpc:grpc-core:jar:[1.45.1,1.45.1],
org.apache.pulsar:pulsar-broker:jar:2.10.1 ->
org.apache.pulsar:pulsar-zookeeper-utils:jar:2.10.1 ->
io.grpc:grpc-all:jar:1.45.1 -> io.grpc:grpc-services:jar:1.45.1 ->
io.grpc:grpc-core:jar:[1.45.1,1.45.1],
org.apache.pulsar:pulsar-broker:jar:2.10.1 ->
org.apache.pulsar:pulsar-zookeeper-utils:jar:2.10.1 ->
io.grpc:grpc-all:jar:1.45.1 -> io.grpc:grpc-xds:jar:1.45.1 ->
io.grpc:grpc-core:jar:1.45.1,
org.apache.pulsar:pulsar-broker:jar:2.10.1 ->
org.apache.pulsar:pulsar-zookeeper-utils:jar:2.10.1 ->
io.grpc:grpc-all:jar:1.45.1 -> io.grpc:grpc-xds:jar:1.45.1 ->
io.grpc:grpc-netty-shaded:jar:[1.45.1,1.45.1] ->
io.grpc:grpc-core:jar:[1.45.1,1.45.1],
org.apache.pulsar:managed-ledger:jar:2.10.1 ->
org.apache.pulsar:pulsar-metadata:jar:2.10.1 ->
io.etcd:jetcd-core:jar:0.5.11 -> io.etcd:jetcd-common:jar:0.5.11 ->
io.grpc:grpc-core:jar:1.41.0,
org.apache.pulsar:managed-ledger:jar:2.10.1 ->
org.apache.pulsar:pulsar-metadata:jar:2.10.1 ->
io.etcd:jetcd-core:jar:0.5.11 -> io.grpc:grpc-core:jar:1.41.0] ->
[Help 1]
```
Thanks,
Hang
PengHui Li <peng...@apache.org> 于2022年6月27日周一 08:51写道：
>
> Hi all,
>
> Thanks for all your verification for 2.10.1
>
> We currently have 2 (+1) bindings and 5 (+1) non-bindings.
> We need one more (+1) binding to unblock the 2.10.1 release.
> Please help validate.
>
> Thanks,
> Penghui
>
> On Thu, Jun 16, 2022 at 12:43 PM Shusuke Tsuda <shust...@yahoo-corp.jp>
> wrote:
>
> > +1 (non-binding)
> >
> > - verified checksums and signatures
> > - build from source
> > - verified pub/sub and java functions
> > - verified stateful functions
> >
> > Thanks,
> > Shusuke Tsuda
> >
> > -----Original Message-----
> > From: PengHui Li <peng...@apache.org>
> > Sent: Monday, June 13, 2022 8:43 PM
> > To: Dev <dev@pulsar.apache.org>
> > Subject: [VOTE] Pulsar Release 2.10.1 Candidate 1
> >
> > This is the first release candidate for Apache Pulsar 2.10.1
> >
> > It fixes the following issues:
> >
> > https://github.com/apache/pulsar/pulls?q=is%3Amerged+is%3Apr+label%3Arelease%2F2.10.1+
> >
> > *** Please download, test and vote on this release. This vote will stay
> > open for at least 72 hours ***
> >
> > Note that we are voting upon the source (tag), binaries are provided for
> > convenience.
> >
> > Source and binary files:
> >
> > https://jpn01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdist.apache.org%2Frepos%2Fdist%2Fdev%2Fpulsar%2Fpulsar-2.10.1-candidate-1%2F&data=05%7C01%7Cshustsud%40yahoo-corp.jp%7C5ddcaa29fc224b6f09e608da4d31e6a8%7Ca208d369cd4e4f87b11998eaf31df2c3%7C1%7C0%7C637907173959452192%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=MlMhzU4P7GzFXx%2BNQ9DYh09Z4%2BJWzqWe%2BXbhO5pOGBo%3D&reserved=0
> >
> > SHA-512 checksums:
> >
> >
> > 87045067cf123574b2b7d578f020efd177b0d9ff12a75d9f738e135cde35a034000c03e21cc8a264a6ef9e2b1df2c4493ffa3b9170b0f368d7424f1160df38cb
> > ./apache-pulsar-2.10.1-bin.tar.gz
> >
> >
> > 19c078f65b9105728adda3926a9a1527d6498f0e2337d37497a6d965a38acf94e217e58939bc5b0a8b8166511ae9ee176ee3d0c764d4777e285b7bcaeb2731e1
> > ./apache-pulsar-2.10.1-src.tar.gz
> >
> > Maven staging repo:
> >
> > https://jpn01.safelinks.protection.outlook.com/?url=https%3A%2F%2Frepository.apache.org%2Fcontent%2Frepositories%2Forgapachepulsar-1156%2F&data=05%7C01%7Cshustsud%40yahoo-corp.jp%7C5ddcaa29fc224b6f09e608da4d31e6a8%7Ca208d369cd4e4f87b11998eaf31df2c3%7C1%7C0%7C637907173959452192%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=7881wtcvkkKTYpcJUDaaP1kD7L25hmJyWYnAsa7H1iw%3D&reserved=0
> >
> > The tag to be voted upon:
> > v2.10.1-candidate-1 (0702b51ce09cc99044f4110e6bf98e82a0e86283)
> > https://github.com/apache/pulsar/releases/tag/v2.10.1-candidate-1
> >
> > Pulsar's KEYS file containing PGP keys we use to sign the release:
> >
> > https://jpn01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdist.apache.org%2Frepos%2Fdist%2Fdev%2Fpulsar%2FKEYS&data=05%7C01%7Cshustsud%40yahoo-corp.jp%7C5ddcaa29fc224b6f09e608da4d31e6a8%7Ca208d369cd4e4f87b11998eaf31df2c3%7C1%7C0%7C637907173959452192%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=PTTqkrOKzXpW9I14aQRcSHl1swE8tCua%2Bo%2BTIkP%2F8jM%3D&reserved=0
> >
> > Docker images:
> >
> >
> > https://jpn01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhub.docker.com%2Flayers%2F233293315%2Flph890127%2Fpulsar%2F2.10.1-rc1%2Fimages%2Fsha256-4a952b3c662b94247ffc4ff17be16ef176c293baaf346db13a095970f43adfd6%3Fcontext%3Drepo&data=05%7C01%7Cshustsud%40yahoo-corp.jp%7C5ddcaa29fc224b6f09e608da4d31e6a8%7Ca208d369cd4e4f87b11998eaf31df2c3%7C1%7C0%7C637907173959452192%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Td0nWB8YQIgPrC0252vtyyEqokUQLCTZ9MYJbIxuhQU%3D&reserved=0
> >
> >
> > https://jpn01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhub.docker.com%2Flayers%2F233303469%2Flph890127%2Fpulsar-all%2F2.10.1-rc1%2Fimages%2Fsha256-ac8180f4ba796291e961581821a1318437e49b0fa684597f5b67265a502822ee%3Fcontext%3Drepo&data=05%7C01%7Cshustsud%40yahoo-corp.jp%7C5ddcaa29fc224b6f09e608da4d31e6a8%7Ca208d369cd4e4f87b11998eaf31df2c3%7C1%7C0%7C637907173959452192%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=7kiKT%2BK7T%2BkJSTSAER%2BF8aFyLTXHKrjEMa%2BP0AOxiSk%3D&reserved=0
> >
> > Please download the source package, and follow the Release Candidate
> > Validation[1] to validate the release
> >
> > [1] https://github.com/apache/pulsar/wiki/Release-Candidate-Validation
> >
> > Thanks,
> > Penghui
> >
