juneau-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Stian Soiland-Reyes <st...@apache.org>
Subject Re: [VOTE] Release Apache Juneau 8.1.3 RC1
Date Mon, 13 Jan 2020 09:51:38 GMT
My vote is unfortunately: -1

I am not sure how I missed this before, but juneau-doc in the src
release seems to include tools.jar binary from Oracle JDK 1.7, which
(in addition to its copyright and license missing) cannot be released
under Apache License 2.0. 

It is also dubious if it's legal to redistribute tools.jar without also
redistributing the rest of JRE.

> The limited set of files and directories from the JDK listed below may
> be included in vendor redistributions of the Java Runtime Environment
> (JRE). They cannot be redistributed separately, and must accompany a
> JRE distribution.

I don't know why it should be necessary to include tools.jar to
generate Javadocs as it is included in all JDK distributions.

There is also juneau-doc/juneau-doc.jar which includes some binaries
    1823  Defl:N      969  47% 01-12-2020 10:30 eedf49f6  org/apache/juneau/doc/internal/DocGenerator$Topics.class
   11006  Defl:N     4855  56% 01-12-2020 10:30 fe85af9d  org/apache/juneau/doc/internal/DocGenerator.class

This jar is also missing LICENSE/NOTICE but looks like it has been
generated by this very same build. Could this perhaps instead be a
Maven dependency from a previous release of Juneau?

It is also a convention that ASF source releases should not include
software binaries.

This is a blocking matter so I am afraid my vote is negative.

[+] git commit vs tag
[+] sha512 checksums correct
[+] git vs src zip  (excess .DS_Store in git, now removed)
[+] mvn apache-rat:rat
[-] binaries in src distribution?  (juneau-doc/tools.jar - what license?)
[ ] mvn clean install
[ ] bin vs built 
[ ] mvn repo vs bin
[ ] mvn repo vs src

Tested with:

(base) stain@biggie:~$ lsb_release -d
Description:	Ubuntu 18.04.3 LTS

(base) stain@biggie:~$ mvn --versionon
Apache Maven 3.6.0 (97c98ec64a1fdfee7767ce5ffb20918da4f719f3; 2018-10-24T19:41:47+01:00)
Maven home: /home/stain/software/maven
Java version: 11.0.5, vendor: Private Build, runtime: /usr/lib/jvm/java-11-openjdk-amd64
Default locale: en_GB, platform encoding: UTF-8
OS name: "linux", version: "4.15.0-74-generic", arch: "amd64", family: "unix"

On Sun, 12 Jan 2020 13:24:53 -0500, James Bognar <jamesbognar@apache.org> wrote:
> I am pleased to be calling this vote for the source release of Apache
> Juneau 8.1.3 RC1.
> The binaries are available at:
> https://dist.apache.org/repos/dist/dev/juneau/binaries/juneau-8.1.3-RC1/
> The release candidate to be voted over is available at:
> https://dist.apache.org/repos/dist/dev/juneau/source/juneau-8.1.3-RC1/
> SHA-512 checksums:
> apache-juneau-8.1.3-src.zip:
>                              48C13039 9573BD18 B4C11FB5 13AE8E9F 16D9AC16
>                              450BCDEF AC2C1E51 E5E1EFD8 75ED0EAC 80398902
>                              981C2846 56029A81 AC4BBF9D 7EB2AA8E 4D4B68F5
>                              B682399A
> apache-juneau-8.1.3-bin.zip:
>                              78B63158 C556EB9B ED405BF0 7002C572 F8DA055A
>                              407A198F FA7AEE3E 0C91F4CE 54F14260 99F478A4
>                              B12E122A 2C95C145 DBD4D49A AC277ECF 4860F5C3
>                              A5D3C0BD
> Build the release candidate using:
> mvn clean install
> The release candidate is signed with a GPG key available at:
> https://dist.apache.org/repos/dist/release/juneau/KEYS
> A staged Maven repository is available for review at:
> https://repository.apache.org/content/repositories/orgapachejuneau-1030/
> The Git commit for this release is...
> https://gitbox.apache.org/repos/asf?p=juneau.git;a=commit;h=d83c0392a39392717e32a491ee34edd2353f5446
> Please vote on releasing this package as:
> Apache Juneau 8.1.3
> This vote will be open until 16-Jan-2020 9:00am and passes if a
> majority of at least three +1 Apache Juneau PMC votes are cast.
> [ ] +1 Release this package
> [ ] 0 I don't feel strongly about it, but don't object
> [ ] -1 Do not release this package because...
> Anyone can participate in testing and voting, not just committers,
> please feel free to try out the release candidate and provide your
> votes.

View raw message