The binary variations would take quite some time to get there… would be possible to - for the first release - limit the scope of the first incubating release to the first step you mentioned (vanilla LICENSE, NOTICE, DISCLAIMER-WIP)?
I’m afraid would take quite a lot to get to the level of details provided by Spark binary variations. I’m also still not 100% sure about container images, what about base image like OS (take Red Hat UBI for example). How to proceed? Thank you again for the clarifications. Regards, Alex On Thu, Oct 10, 2024 at 6:59 PM PJ Fanning <fannin...@gmail.com> wrote: > You could start by adding the vanilla LICENSE, NOTICE, DISLAIMER-WIP > from https://github.com/apache/incubator-kie-tools into each tar.gz. > > Later, you would need to update the LICENSE and NOTICE to comply with > the licenses/notices of any 3rd party source or binaries that appear > in the tar.gz. > > If you look at Apache Spark, they have LICENSE/NOTICE and > LICENSE-binary/NOTICE-binary. > https://github.com/apache/spark > > The LICENSE/NOTICE pair is copied into the source release and includes > details of 3rd party source in the release. > The LICENSE-binary/NOTICE-binary pair is copied into their binary > artifacts and includes details of 3rd party binaries (jars) in those > artifacts. > > On Thu, 10 Oct 2024 at 23:33, Alex Porcelli <porce...@apache.org> wrote: > > > > PJ, > > > > There are about 22 container images that are .tar.gz files, all those > > files were generated with docker export command. My question is it > > really needed to add to those image .tar.gz the LICENSE, NOTICE and > > DISCLAIMER-WIP files? > > > > If yes... is there any example how to write a NOTICE file for container > images? > > > > Thank you for your support! > > > > Regards, > > Alex > > > > On Thu, Oct 10, 2024 at 11:02 AM PJ Fanning <fannin...@apache.org> > wrote: > > > > > > The KIE PPMC will need to vote on the RC3. Usually votes in PPMC > > > happen before the IPMC vote. I'm not 100% sure if there is an absolute > > > requirement that the 2 votes need to be held at different times. > > > Ideally the mentors of the KIE project will get involved in the PPMC > > > vote because they know what to check wrt a valid IPMC release. > > > > > > On Thu, 10 Oct 2024 at 15:24, Jason Porter <lightguar...@apache.org> > wrote: > > > > > > > > PJ, since we're new to doing the release, for RC3 do we need to do > another 72 hour voting period for the KIE PPMC, or do we roll an RC3 and > start a new vote here? > > > > > > > > On 2024/10/09 23:17:48 PJ Fanning wrote: > > > > > Thanks for your explanation. I fully understand where you are > coming from. I don't want to delay you unduly. > > > > > > > > > > For me, if you sort out the names of the release files that would > be the main thing for me. Ideally, you would also use the filename > 'DISCLAIMER-WIP' for the DISCLAIMER file. > > > > > > > > > > For instance, with > > > > > 10.0.0-rc2/incubator-kie-10.0.0-rc2-sources.zip > > > > > > > > > > Could you call the rc3? > > > > > 10.0.0-rc3/apache-kie-10.0.0-incubating-src.zip (or something of > this ilk) > > > > > > > > > > I would also appreciate it if you left it a day or 2 before > creating the RC3 to allow other IPMC members to have a look at the RC2. > > > > > I suspect that you might save a little bit of time getting > feedback now instead of hitting issues with the RC3. > > > > > > > > > > > > > > > On 2024/10/09 23:03:07 Alex Porcelli wrote: > > > > > > Thank you for all the valuable feedback. I appreciate the time > you've > > > > > > taken to review the release candidate so thoroughly. > > > > > > > > > > > > I'd like to provide some context about Apache KIE podling. We're > a > > > > > > mature project with over 15 years of history, and we've been on > the > > > > > > Apache Incubation journey for more than a year now. During this > time, > > > > > > we've made many changes to fit into the Apache Foundation, > including > > > > > > adjusting headers, changing CI, tweaking code, and untangling > > > > > > dependencies and removing legal restricted dependencies. We've > also > > > > > > simplified the structure, going from 23 separate repositories to > just > > > > > > a handful. > > > > > > > > > > > > We understand there are some issues with the current release > > > > > > candidate. We're starting a RC3 now and will make sure to include > > > > > > 'incubating' in the filenames and revise the NOTICE file to > focus on > > > > > > source code rather than binary dependencies. We'll also check > how it's > > > > > > possible to add the LICENSE, NOTICE, and DISCLAIMER-WIP files to > the > > > > > > container image exports (I'm not sure if this is possible, to be > > > > > > honest.. but we'll check). > > > > > > > > > > > > We know that some changes might take more time due to the > project's > > > > > > complexity. We see incubation as a journey and we're committed to > > > > > > improving step by step. Right now, the main goal is to get the > first > > > > > > release out after over a year of hard work, while we keep working > > > > > > towards meeting all Apache standards. We have a large community > of > > > > > > users that are anxious to get access to this release... as this > is the > > > > > > first time in 15 years that we don't have a release in more than > a > > > > > > year. > > > > > > > > > > > > Best, > > > > > > Alex > > > > > > > > > > > > On Wed, Oct 9, 2024 at 6:36 PM PJ Fanning <fannin...@apache.org> > wrote: > > > > > > > > > > > > > > I chose one of the binary artifacts at random. > > > > > > > incubator-kie-10.0.0-rc2-sonataflow-operator-image.tar.gz > > > > > > > > > > > > > > It contains no LICENSE file. I don't think this is right. I > think all > > > > > > > the zips and tar.gz files in the RC folder [1] should contain a > > > > > > > LICENSE, NOTICE and DISCLAIMER-WIP. > > > > > > > > > > > > > > The LICENSE and NOTICE files should be tailored to the > contents of > > > > > > > each zips and tar.gz file. > > > > > > > > > > > > > > [1] > https://dist.apache.org/repos/dist/dev/incubator/kie/10.0.0-rc2/ > > > > > > > > > > > > > > On Wed, 9 Oct 2024 at 23:27, PJ Fanning <fannin...@gmail.com> > wrote: > > > > > > > > > > > > > > > > Incubator PMC members expect to find no jars or zips in > source > > > > > > > > releases. There may be good reasons to have them as test > resources but > > > > > > > > you should document them to make it easier for reviewers. > Many IPMC > > > > > > > > members will use tools like Apache Rat to validate the > release and the > > > > > > > > binary files will be reported as out of the ordinary. > > > > > > > > > > > > > > > > I would also suggest that source release zip should have a > base > > > > > > > > directory that includes everything instead of having the > LICENSE etc > > > > > > > > in the root folder. It makes it easier for reviewers if the > zip > > > > > > > > doesn't unzip files into their working dir. Again, I would > encourage > > > > > > > > you to look at other ASF Incubator or non-Incubator source > releases to > > > > > > > > see what they look like. > > > > > > > > > > > > > > > > I still remain -1 because of the 'incubating' part of the > file name > > > > > > > > not being there. > > > > > > > > > > > > > > > > On Wed, 9 Oct 2024 at 23:20, Alex Porcelli < > porce...@apache.org> wrote: > > > > > > > > > > > > > > > > > > All those `binary` files (jar, zips) are needed for > testing purposes. > > > > > > > > > > > > > > > > > > On Wed, Oct 9, 2024 at 6:16 PM PJ Fanning < > fannin...@gmail.com> wrote: > > > > > > > > > > > > > > > > > > > > The NOTICE in the source release is not valid. It is a > long list of > > > > > > > > > > binary dependencies. NOTICE files in source releases are > about the > > > > > > > > > > source code not about binary dependencies that are > linked and not > > > > > > > > > > included directly in the release. > > > > > > > > > > > > > > > > > > > > There are compiled jars in the source release. This is > not normally allowed. > > > > > > > > > > > > > > > > > > > > > ./incubator-kie-kogito-runtimes/quarkus/integration-tests/integration-tests-quarkus-gradle/integration-tests-quarkus-gradle-project/gradle/wrapper/gradle-wrapper.jar > > > > > > > > > > > ./incubator-kie-kogito-runtimes/.mvn/wrapper/maven-wrapper.jar > > > > > > > > > > > ./incubator-kie-kogito-runtimes/kogito-codegen-modules/kogito-codegen-core/src/test/resources/empty.jar > > > > > > > > > > > ./incubator-kie-tools/packages/stunner-editors/errai-ui/src/test/resources/less.jar > > > > > > > > > > > ./incubator-kie-kogito-apps/.mvn/wrapper/maven-wrapper.jar > > > > > > > > > > > ./incubator-kie-drools/efesto/efesto-core/efesto-common-api/src/test/resources/TestJar.jar > > > > > > > > > > > ./incubator-kie-drools/efesto/efesto-core/efesto-runtime-manager/efesto-runtime-manager-core/src/test/resources/TestJar.jar > > > > > > > > > > > ./incubator-kie-drools/efesto/efesto-core/efesto-common-core/src/test/resources/TestJar.jar > > > > > > > > > > > ./incubator-kie-drools/drools-compiler/src/test/resources/primespoc.jar > > > > > > > > > > > ./incubator-kie-drools/drools-compiler/src/test/resources/eventing-example.jar > > > > > > > > > > > ./incubator-kie-drools/drools-compiler/src/test/resources/KAModelTest.jar > > > > > > > > > > > ./incubator-kie-drools/drools-compiler/src/test/resources/JarWithSourceFiles.jar > > > > > > > > > > > ./incubator-kie-drools/drools-test-coverage/test-compiler-integration/src/test/resources/only-jar-pojo-not-kjar-no-kmodule-1.0.0.jar > > > > > > > > > > > ./incubator-kie-drools/drools-test-coverage/test-compiler-integration/src/test/resources/org/drools/mvel/compiler/compiler/xml/changeset/changeset.jar > > > > > > > > > > > ./incubator-kie-drools/drools-test-coverage/test-compiler-integration/src/test/resources/billasurf.jar > > > > > > > > > > > ./incubator-kie-drools/drools-test-coverage/test-compiler-integration/src/test/resources/kie-project-simple-1.0.0.jar > > > > > > > > > > > ./incubator-kie-drools/drools-test-coverage/test-compiler-integration/src/test/resources/testEnum.jar > > > > > > > > > > > ./incubator-kie-drools/drools-verifier/drools-verifier-drl/src/test/resources/org/drools/verifier/model.jar > > > > > > > > > > > ./incubator-kie-drools/kie-ci/src/test/resources/kjar/kjar-module-before.jar > > > > > > > > > > > ./incubator-kie-drools/kie-ci/src/test/resources/kjar/kjar-module-after.jar > > > > > > > > > > > ./incubator-kie-drools/drools-legacy-test-util/src/test/resources/billasurf.jar > > > > > > > > > > > > > > > > > > > > On Wed, 9 Oct 2024 at 23:11, PJ Fanning < > fannin...@apache.org> wrote: > > > > > > > > > > > > > > > > > > > > > > I guess it's fine to use that key then. Do you have > the pub, uid, sub > > > > > > > > > > > headers though? The KEYS file looks strange without > them. > > > > > > > > > > > > > > > > > > > > > > On Wed, 9 Oct 2024 at 23:08, Alex Porcelli < > porce...@apache.org> wrote: > > > > > > > > > > > > > > > > > > > > > > > > PJ, > > > > > > > > > > > > > > > > > > > > > > > > Apache KIE has a fully automated release (we > followed the requirements > > > > > > > > > > > > from Apache security of reproducible builds etc), so > we are able to > > > > > > > > > > > > use the priv...@kie.apache.org because it was > signed directly by the > > > > > > > > > > > > pipelines. > > > > > > > > > > > > > > > > > > > > > > > > The KEYS file content for the priv...@kie.apache.org > was provided by > > > > > > > > > > > > Apache Infra. > > > > > > > > > > > > > > > > > > > > > > > > On Wed, Oct 9, 2024 at 6:03 PM PJ Fanning < > fannin...@apache.org> wrote: > > > > > > > > > > > > > > > > > > > > > > > > > > May I also enquire about the signing key? It is > usually a personal > > > > > > > > > > > > > signing key not a shared signing key ( > priv...@kie.apache.org). > > > > > > > > > > > > > > > > > > > > > > > > > > The KEYS file is not ideal afaic. It has no header > bit for that > > > > > > > > > > > > > priv...@kie.apache.org key. Can you add that? > > > > > > > > > > > > > https://downloads.apache.org/incubator/kie/KEYS > > > > > > > > > > > > > > > > > > > > > > > > > > I'm talking about the missing pub, uid, sub > headers. > > > > > > > > > > > > > > > > > > > > > > > > > > On Wed, 9 Oct 2024 at 22:55, PJ Fanning < > fannin...@apache.org> wrote: > > > > > > > > > > > > > > > > > > > > > > > > > > > > The names of the files in the RC directory [1] > seem incorrect. > > > > > > > > > > > > > > It is good to include the '-rc2' in the > directory name but the source > > > > > > > > > > > > > > and binary archives should omit the '-rc2' part. > This is because if > > > > > > > > > > > > > > and when the votes passes, you need to release > the files that were > > > > > > > > > > > > > > voted on. This means you can't rename them after > the vote. > > > > > > > > > > > > > > > > > > > > > > > > > > > > -1 binding (fanningpj IPMC) > > > > > > > > > > > > > > because the source release does not have > 'incubating' in the name of > > > > > > > > > > > > > > the file. I know it has incubating but the > requirement is for it to be > > > > > > > > > > > > > > 'incubating'. You have > 'incubator-kie-10.0.0-rc2-sources.zip' > > > > > > > > > > > > > > In fact, it is also the norm to have 'apache' in > the file name too. > > > > > > > > > > > > > > Have a look at the Apache Uniffle candidate [2] > to see the format of > > > > > > > > > > > > > > the filenames. > > > > > > > > > > > > > > > > > > > > > > > > > > > > The rule about 'incubating' in the name appears > in our Release Guide [3] > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > [1] > https://dist.apache.org/repos/dist/dev/incubator/kie/10.0.0-rc2/ > > > > > > > > > > > > > > [2] > https://dist.apache.org/repos/dist/dev/incubator/uniffle/0.9.1-rc1/ > > > > > > > > > > > > > > [3] > https://incubator.apache.org/guides/releasemanagement.html > > > > > > > > > > > > > > > > > > > > > > > > > > > > On Wed, 9 Oct 2024 at 22:40, Alex Porcelli < > porce...@apache.org> wrote: > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Hello everyone, > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > This is a call for the vote to release Apache > KIE(Incubating) v10.0.0-rc2. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > The Apache KIE community has voted and > approved the release of Apache > > > > > > > > > > > > > > > KIE(incubating) v10.0.0-rc2. We now kindly > request the IPMC members > > > > > > > > > > > > > > > review and vote for this release. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Apache KIE(incubating) - The home of the most > popular business > > > > > > > > > > > > > > > automation open-source technologies including > Drools, jBPM, > > > > > > > > > > > > > > > SonataFlow, Optaplanner, Kogito and Tools. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > KIE community vote thread: > > > > > > > > > > > > > > > > https://lists.apache.org/thread/t72b95d3q1qvcyd7lbqkrt8cdx2cgsp2 > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Vote result thread: > > > > > > > > > > > > > > > > https://lists.apache.org/thread/tjbbhlo3bo8dqqxs30f9sbj1wpxgxpyp > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > The release candidate: > > > > > > > > > > > > > > > > https://dist.apache.org/repos/dist/dev/incubator/kie/10.0.0-rc2/ > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > The maven staging repos for this release: > > > > > > > > > > > > > > > - Drools: > https://repository.apache.org/content/repositories/orgapachekie-1046 > > > > > > > > > > > > > > > - Optaplanner: > https://repository.apache.org/content/repositories/orgapachekie-1047 > > > > > > > > > > > > > > > - Kogito Runtimes: > > > > > > > > > > > > > > > > https://repository.apache.org/content/repositories/orgapachekie-1048 > > > > > > > > > > > > > > > - Kogito Apps: > https://repository.apache.org/content/repositories/orgapachekie-1049 > > > > > > > > > > > > > > > - Kogito Apps - JITExecutor Native Linux: > > > > > > > > > > > > > > > > https://repository.apache.org/content/repositories/orgapachekie-1050 > > > > > > > > > > > > > > > - Kogito Apps - JITExecutor Native Windows: > > > > > > > > > > > > > > > > https://repository.apache.org/content/repositories/orgapachekie-1051 > > > > > > > > > > > > > > > - Kogito Apps - JITExecutor Native MacOS: > > > > > > > > > > > > > > > > https://repository.apache.org/content/repositories/orgapachekie-1052 > > > > > > > > > > > > > > > - KIE Tools - JBPM Quarkus DevUI: > > > > > > > > > > > > > > > > https://repository.apache.org/content/repositories/orgapachekie-1053 > > > > > > > > > > > > > > > - KIE Tools - Sonataflow Quarkus DevUI: > > > > > > > > > > > > > > > > https://repository.apache.org/content/repositories/orgapachekie-1054 > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > The artifacts are signed with PGP key > corresponding to > > > > > > > > > > > > > > > [priv...@kie.apache.org], found in the KEYS > file: > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > https://downloads.apache.org/incubator/kie/KEYS > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > The vote will be open for at least 72 hours > until the necessary number > > > > > > > > > > > > > > > of votes are reached. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Please vote accordingly: > > > > > > > > > > > > > > > [ ] +1 approve > > > > > > > > > > > > > > > [ ] +0 no opinion > > > > > > > > > > > > > > > [ ] -1 disapprove with the reason > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > To learn more about KIE, please see > https://kie.apache.org/ > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Checklist for reference: > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > [ ] Download KIE artifacts are valid. > > > > > > > > > > > > > > > [ ] Checksums and PGP signatures are valid. > > > > > > > > > > > > > > > [ ] Source code distributions have correct > names matching the current release. > > > > > > > > > > > > > > > [ ] LICENSE and NOTICE files are correct. > > > > > > > > > > > > > > > [ ] All files have license headers if > necessary. > > > > > > > > > > > > > > > [ ] No compiled archives bundled in source > archive. > > > > > > > > > > > > > > > [ ] Can compile from source. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > For updated information on how to verify the > release, please refer to: > > > > > > > > > > > > > > > https://kie.apache.org/docs/community/verify > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > For updated information on how to build from > source zip, please refer to: > > > > > > > > > > > > > > > https://kie.apache.org/docs/community/build > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Best, > > > > > > > > > > > > > > > Alex > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > --------------------------------------------------------------------- > > > > > > > > > > > > > > > To unsubscribe, e-mail: > general-unsubscr...@incubator.apache.org > > > > > > > > > > > > > > > For additional commands, e-mail: > general-h...@incubator.apache.org > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > --------------------------------------------------------------------- > > > > > > > > > > To unsubscribe, e-mail: > general-unsubscr...@incubator.apache.org > > > > > > > > > > For additional commands, e-mail: > general-h...@incubator.apache.org > > > > > > > > > > > > > > > > > > > > > > > > > > > > > --------------------------------------------------------------------- > > > > > > > > > To unsubscribe, e-mail: > general-unsubscr...@incubator.apache.org > > > > > > > > > For additional commands, e-mail: > general-h...@incubator.apache.org > > > > > > > > > > > > > > > > > > > > > > --------------------------------------------------------------------- > > > > > > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > > > > > > For additional commands, e-mail: > general-h...@incubator.apache.org > > > > > > > > > > > > > > > > > > > > > > > --------------------------------------------------------------------- > > > > > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > > > > > For additional commands, e-mail: general-h...@incubator.apache.org > > > > > > > > > > > > > > > > > > --------------------------------------------------------------------- > > > > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > > > > For additional commands, e-mail: general-h...@incubator.apache.org > > > > > > > > > > --------------------------------------------------------------------- > > > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > > > For additional commands, e-mail: general-h...@incubator.apache.org > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > > For additional commands, e-mail: general-h...@incubator.apache.org > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org > For additional commands, e-mail: general-h...@incubator.apache.org > >
