[VOTE] Apache Accumulo 1.9.0-rc1

classic Classic list List threaded Threaded
30 messages Options
12
Reply | Threaded
Open this post in threaded view
|

[VOTE] Apache Accumulo 1.9.0-rc1

Christopher Tubbs-2
Accumulo Developers,

Please consider the following candidate for Apache Accumulo 1.9.0.

Git Commit:
    bca516000bdb54b1e5582f908e0a525634a120f7
Branch:
    1.9.0-rc1

If this vote passes, a gpg-signed tag will be created using:
    git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
    bca516000bdb54b1e5582f908e0a525634a120f7

Staging repo:
https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
Source (official release artifact):
https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
Binary:
https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
(Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
given artifact.)

All artifacts were built and staged with:
    mvn release:prepare && mvn release:perform

Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
(Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)

Release notes (in progress) can be found at:
https://accumulo.apache.org/release/accumulo-1.9.0/

Please vote one of:
[ ] +1 - I have verified and accept...
[ ] +0 - I have reservations, but not strong enough to vote against...
[ ] -1 - Because..., I do not accept...
... these artifacts as the 1.9.0 release of Apache Accumulo.

This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
(Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
Voting continues until the release manager sends an email closing the vote.

Thanks!

P.S. Hint: download the whole staging repo with
    wget -erobots=off -r -l inf -np -nH \

https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
    # note the trailing slash is needed
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Mike Miller-2
Verified sha1, md5 and asc signatures for src and binary tars.
Successfully built using 'mvn clean verify -Psunny' from the extracted
source.

I plan on setting up a cluster for randomwalk on Monday.

On Thu, Apr 12, 2018 at 6:21 PM, Christopher <[hidden email]> wrote:

> Accumulo Developers,
>
> Please consider the following candidate for Apache Accumulo 1.9.0.
>
> Git Commit:
>     bca516000bdb54b1e5582f908e0a525634a120f7
> Branch:
>     1.9.0-rc1
>
> If this vote passes, a gpg-signed tag will be created using:
>     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
>     bca516000bdb54b1e5582f908e0a525634a120f7
>
> Staging repo:
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> Source (official release artifact):
> https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.
> 0/accumulo-1.9.0-src.tar.gz
> Binary:
> https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.
> 0/accumulo-1.9.0-bin.tar.gz
> (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> given artifact.)
>
> All artifacts were built and staged with:
>     mvn release:prepare && mvn release:perform
>
> Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
> (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
>
> Release notes (in progress) can be found at:
> https://accumulo.apache.org/release/accumulo-1.9.0/
>
> Please vote one of:
> [ ] +1 - I have verified and accept...
> [ ] +0 - I have reservations, but not strong enough to vote against...
> [ ] -1 - Because..., I do not accept...
> ... these artifacts as the 1.9.0 release of Apache Accumulo.
>
> This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> Voting continues until the release manager sends an email closing the vote.
>
> Thanks!
>
> P.S. Hint: download the whole staging repo with
>     wget -erobots=off -r -l inf -np -nH \
>
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
>     # note the trailing slash is needed
>
Reply | Threaded
Open this post in threaded view
|

RE: [VOTE] Apache Accumulo 1.9.0-rc1

Ed Coleman
In reply to this post by Christopher Tubbs-2
+1 I verified the md5, sha1 and asc signatures of the artifacts and the git commit sha1, the build passed mvn clean verify -Psunny, and I accept this as a release of Accumulo 1.9.0, pending the successful outcome of cluster testing.

Ed Coleman

-----Original Message-----
From: Christopher [mailto:[hidden email]]
Sent: Thursday, April 12, 2018 6:22 PM
To: accumulo-dev <[hidden email]>
Subject: [VOTE] Apache Accumulo 1.9.0-rc1

Accumulo Developers,

Please consider the following candidate for Apache Accumulo 1.9.0.

Git Commit:
    bca516000bdb54b1e5582f908e0a525634a120f7
Branch:
    1.9.0-rc1

If this vote passes, a gpg-signed tag will be created using:
    git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
    bca516000bdb54b1e5582f908e0a525634a120f7

Staging repo:
https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
Source (official release artifact):
https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
Binary:
https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
(Append ".sha1", ".md5", or ".asc" to download the signature/hash for a given artifact.)

All artifacts were built and staged with:
    mvn release:prepare && mvn release:perform

Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
(Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)

Release notes (in progress) can be found at:
https://accumulo.apache.org/release/accumulo-1.9.0/

Please vote one of:
[ ] +1 - I have verified and accept...
[ ] +0 - I have reservations, but not strong enough to vote against...
[ ] -1 - Because..., I do not accept...
... these artifacts as the 1.9.0 release of Apache Accumulo.

This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018 (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
Voting continues until the release manager sends an email closing the vote.

Thanks!

P.S. Hint: download the whole staging repo with
    wget -erobots=off -r -l inf -np -nH \

https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
    # note the trailing slash is needed

Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Mike Walch-2
In reply to this post by Christopher Tubbs-2
+1

* Verified sha1 & md5 hashes matched
* Verified signatures
* Ran binary tarball locally using Uno
* Ran 'mvn verify' successfully for wikisearch using RC jars

On Thu, Apr 12, 2018 at 6:21 PM, Christopher <[hidden email]> wrote:

> Accumulo Developers,
>
> Please consider the following candidate for Apache Accumulo 1.9.0.
>
> Git Commit:
>     bca516000bdb54b1e5582f908e0a525634a120f7
> Branch:
>     1.9.0-rc1
>
> If this vote passes, a gpg-signed tag will be created using:
>     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
>     bca516000bdb54b1e5582f908e0a525634a120f7
>
> Staging repo:
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> Source (official release artifact):
> https://repository.apache.org/content/repositories/orgapache
> accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> Binary:
> https://repository.apache.org/content/repositories/orgapache
> accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> given artifact.)
>
> All artifacts were built and staged with:
>     mvn release:prepare && mvn release:perform
>
> Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
> (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
>
> Release notes (in progress) can be found at:
> https://accumulo.apache.org/release/accumulo-1.9.0/
>
> Please vote one of:
> [ ] +1 - I have verified and accept...
> [ ] +0 - I have reservations, but not strong enough to vote against...
> [ ] -1 - Because..., I do not accept...
> ... these artifacts as the 1.9.0 release of Apache Accumulo.
>
> This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> Voting continues until the release manager sends an email closing the vote.
>
> Thanks!
>
> P.S. Hint: download the whole staging repo with
>     wget -erobots=off -r -l inf -np -nH \
>
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
>     # note the trailing slash is needed
>
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Mike Drob
-0

please do not publish md5 sums
please add missing sha256 sums

apache release policy:
http://www.apache.org/dev/release-distribution#sigs-and-sums

On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch <[hidden email]> wrote:

> +1
>
> * Verified sha1 & md5 hashes matched
> * Verified signatures
> * Ran binary tarball locally using Uno
> * Ran 'mvn verify' successfully for wikisearch using RC jars
>
> On Thu, Apr 12, 2018 at 6:21 PM, Christopher <[hidden email]> wrote:
>
> > Accumulo Developers,
> >
> > Please consider the following candidate for Apache Accumulo 1.9.0.
> >
> > Git Commit:
> >     bca516000bdb54b1e5582f908e0a525634a120f7
> > Branch:
> >     1.9.0-rc1
> >
> > If this vote passes, a gpg-signed tag will be created using:
> >     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> >     bca516000bdb54b1e5582f908e0a525634a120f7
> >
> > Staging repo:
> >
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> > Source (official release artifact):
> > https://repository.apache.org/content/repositories/orgapache
> >
> accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> > Binary:
> > https://repository.apache.org/content/repositories/orgapache
> >
> accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> > (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> > given artifact.)
> >
> > All artifacts were built and staged with:
> >     mvn release:prepare && mvn release:perform
> >
> > Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
> > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> >
> > Release notes (in progress) can be found at:
> > https://accumulo.apache.org/release/accumulo-1.9.0/
> >
> > Please vote one of:
> > [ ] +1 - I have verified and accept...
> > [ ] +0 - I have reservations, but not strong enough to vote against...
> > [ ] -1 - Because..., I do not accept...
> > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> >
> > This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > Voting continues until the release manager sends an email closing the
> vote.
> >
> > Thanks!
> >
> > P.S. Hint: download the whole staging repo with
> >     wget -erobots=off -r -l inf -np -nH \
> >
> >
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
> >     # note the trailing slash is needed
> >
>
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Christopher Tubbs-2
Mike,

We use stronger checksums (SHA512) in the SVN[1] area and downloads page[2]
after a vote passes. In fact, we're one of the only "perfect projects" in
regards to compliance with this policy[3].

The Maven staging area doesn't follow all the "SHOULD" statements, but
that's only because these checksums are automatically generated by
maven-deploy-plugin, and not under our direct control. However, it still
follows all the "MUST" statements, so it is still in compliance with the
cited policy. Unless we're willing to circumvent standard Maven tooling and
risk breaking things which depend on the conventions established by this
tooling (which, to be clear, I think would be a really terribly bad idea),
we simply cannot follow all the "SHOULD" statements for the Maven staging
area.

[1]: https://www.apache.org/dist/accumulo/
[2]: https://accumulo.apache.org/downloads/
[3]: https://checker.apache.org/dist/unsummed.html

On Sat, Apr 14, 2018 at 11:13 PM Mike Drob <[hidden email]> wrote:

> -0
>
> please do not publish md5 sums
> please add missing sha256 sums
>
> apache release policy:
> http://www.apache.org/dev/release-distribution#sigs-and-sums
>
> On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch <[hidden email]> wrote:
>
> > +1
> >
> > * Verified sha1 & md5 hashes matched
> > * Verified signatures
> > * Ran binary tarball locally using Uno
> > * Ran 'mvn verify' successfully for wikisearch using RC jars
> >
> > On Thu, Apr 12, 2018 at 6:21 PM, Christopher <[hidden email]>
> wrote:
> >
> > > Accumulo Developers,
> > >
> > > Please consider the following candidate for Apache Accumulo 1.9.0.
> > >
> > > Git Commit:
> > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > Branch:
> > >     1.9.0-rc1
> > >
> > > If this vote passes, a gpg-signed tag will be created using:
> > >     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > >
> > > Staging repo:
> > >
> >
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> > > Source (official release artifact):
> > > https://repository.apache.org/content/repositories/orgapache
> > >
> >
> accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> > > Binary:
> > > https://repository.apache.org/content/repositories/orgapache
> > >
> >
> accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> > > given artifact.)
> > >
> > > All artifacts were built and staged with:
> > >     mvn release:prepare && mvn release:perform
> > >
> > > Signing keys are available at
> https://www.apache.org/dist/accumulo/KEYS
> > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > >
> > > Release notes (in progress) can be found at:
> > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > >
> > > Please vote one of:
> > > [ ] +1 - I have verified and accept...
> > > [ ] +0 - I have reservations, but not strong enough to vote against...
> > > [ ] -1 - Because..., I do not accept...
> > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > >
> > > This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > Voting continues until the release manager sends an email closing the
> > vote.
> > >
> > > Thanks!
> > >
> > > P.S. Hint: download the whole staging repo with
> > >     wget -erobots=off -r -l inf -np -nH \
> > >
> > >
> >
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
> > >     # note the trailing slash is needed
> > >
> >
>
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Sean Busbey-6
-1 on the RC vote

I agree that in the staged maven repository we should stick to SHOULD guidance until such time that the maven tooling has a supported option to use correct checksums. (Have we verified that the relevant tooling at a minimum has a request in to add it?)

However, I can't verify that the source artifact or any other artifacts that we'll eventually place in dist.a.o/release has correct checksums that meet the current release distribution policy simply because we don't have the relevant bits posted here in the RC.

Why don't we go back to providing both a staged maven repo and an RC directory in the ASF dev part of dist.a.o[4]? Plenty of other projects use that area to stage RCs that have correct checksums.

[4]: https://dist.apache.org/repos/dist/dev/accumulo/

On 2018/04/15 05:35:39, Christopher <[hidden email]> wrote:

> Mike,
>
> We use stronger checksums (SHA512) in the SVN[1] area and downloads page[2]
> after a vote passes. In fact, we're one of the only "perfect projects" in
> regards to compliance with this policy[3].
>
> The Maven staging area doesn't follow all the "SHOULD" statements, but
> that's only because these checksums are automatically generated by
> maven-deploy-plugin, and not under our direct control. However, it still
> follows all the "MUST" statements, so it is still in compliance with the
> cited policy. Unless we're willing to circumvent standard Maven tooling and
> risk breaking things which depend on the conventions established by this
> tooling (which, to be clear, I think would be a really terribly bad idea),
> we simply cannot follow all the "SHOULD" statements for the Maven staging
> area.
>
> [1]: https://www.apache.org/dist/accumulo/
> [2]: https://accumulo.apache.org/downloads/
> [3]: https://checker.apache.org/dist/unsummed.html
>
> On Sat, Apr 14, 2018 at 11:13 PM Mike Drob <[hidden email]> wrote:
>
> > -0
> >
> > please do not publish md5 sums
> > please add missing sha256 sums
> >
> > apache release policy:
> > http://www.apache.org/dev/release-distribution#sigs-and-sums
> >
> > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch <[hidden email]> wrote:
> >
> > > +1
> > >
> > > * Verified sha1 & md5 hashes matched
> > > * Verified signatures
> > > * Ran binary tarball locally using Uno
> > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > >
> > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher <[hidden email]>
> > wrote:
> > >
> > > > Accumulo Developers,
> > > >
> > > > Please consider the following candidate for Apache Accumulo 1.9.0.
> > > >
> > > > Git Commit:
> > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > Branch:
> > > >     1.9.0-rc1
> > > >
> > > > If this vote passes, a gpg-signed tag will be created using:
> > > >     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > >
> > > > Staging repo:
> > > >
> > >
> > https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> > > > Source (official release artifact):
> > > > https://repository.apache.org/content/repositories/orgapache
> > > >
> > >
> > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> > > > Binary:
> > > > https://repository.apache.org/content/repositories/orgapache
> > > >
> > >
> > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> > > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> > > > given artifact.)
> > > >
> > > > All artifacts were built and staged with:
> > > >     mvn release:prepare && mvn release:perform
> > > >
> > > > Signing keys are available at
> > https://www.apache.org/dist/accumulo/KEYS
> > > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > > >
> > > > Release notes (in progress) can be found at:
> > > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > > >
> > > > Please vote one of:
> > > > [ ] +1 - I have verified and accept...
> > > > [ ] +0 - I have reservations, but not strong enough to vote against...
> > > > [ ] -1 - Because..., I do not accept...
> > > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > > >
> > > > This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> > > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > > Voting continues until the release manager sends an email closing the
> > > vote.
> > > >
> > > > Thanks!
> > > >
> > > > P.S. Hint: download the whole staging repo with
> > > >     wget -erobots=off -r -l inf -np -nH \
> > > >
> > > >
> > >
> > https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
> > > >     # note the trailing slash is needed
> > > >
> > >
> >
>
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Sean Busbey-6
sorry, that should have been "staged maven repository should stick to MUST guidance"



On 2018/04/15 14:11:43, Sean Busbey <[hidden email]> wrote:

> -1 on the RC vote
>
> I agree that in the staged maven repository we should stick to SHOULD guidance until such time that the maven tooling has a supported option to use correct checksums. (Have we verified that the relevant tooling at a minimum has a request in to add it?)
>
> However, I can't verify that the source artifact or any other artifacts that we'll eventually place in dist.a.o/release has correct checksums that meet the current release distribution policy simply because we don't have the relevant bits posted here in the RC.
>
> Why don't we go back to providing both a staged maven repo and an RC directory in the ASF dev part of dist.a.o[4]? Plenty of other projects use that area to stage RCs that have correct checksums.
>
> [4]: https://dist.apache.org/repos/dist/dev/accumulo/
>
> On 2018/04/15 05:35:39, Christopher <[hidden email]> wrote:
> > Mike,
> >
> > We use stronger checksums (SHA512) in the SVN[1] area and downloads page[2]
> > after a vote passes. In fact, we're one of the only "perfect projects" in
> > regards to compliance with this policy[3].
> >
> > The Maven staging area doesn't follow all the "SHOULD" statements, but
> > that's only because these checksums are automatically generated by
> > maven-deploy-plugin, and not under our direct control. However, it still
> > follows all the "MUST" statements, so it is still in compliance with the
> > cited policy. Unless we're willing to circumvent standard Maven tooling and
> > risk breaking things which depend on the conventions established by this
> > tooling (which, to be clear, I think would be a really terribly bad idea),
> > we simply cannot follow all the "SHOULD" statements for the Maven staging
> > area.
> >
> > [1]: https://www.apache.org/dist/accumulo/
> > [2]: https://accumulo.apache.org/downloads/
> > [3]: https://checker.apache.org/dist/unsummed.html
> >
> > On Sat, Apr 14, 2018 at 11:13 PM Mike Drob <[hidden email]> wrote:
> >
> > > -0
> > >
> > > please do not publish md5 sums
> > > please add missing sha256 sums
> > >
> > > apache release policy:
> > > http://www.apache.org/dev/release-distribution#sigs-and-sums
> > >
> > > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch <[hidden email]> wrote:
> > >
> > > > +1
> > > >
> > > > * Verified sha1 & md5 hashes matched
> > > > * Verified signatures
> > > > * Ran binary tarball locally using Uno
> > > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > > >
> > > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher <[hidden email]>
> > > wrote:
> > > >
> > > > > Accumulo Developers,
> > > > >
> > > > > Please consider the following candidate for Apache Accumulo 1.9.0.
> > > > >
> > > > > Git Commit:
> > > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > Branch:
> > > > >     1.9.0-rc1
> > > > >
> > > > > If this vote passes, a gpg-signed tag will be created using:
> > > > >     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > >
> > > > > Staging repo:
> > > > >
> > > >
> > > https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> > > > > Source (official release artifact):
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> > > > > Binary:
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> > > > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> > > > > given artifact.)
> > > > >
> > > > > All artifacts were built and staged with:
> > > > >     mvn release:prepare && mvn release:perform
> > > > >
> > > > > Signing keys are available at
> > > https://www.apache.org/dist/accumulo/KEYS
> > > > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > > > >
> > > > > Release notes (in progress) can be found at:
> > > > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > > > >
> > > > > Please vote one of:
> > > > > [ ] +1 - I have verified and accept...
> > > > > [ ] +0 - I have reservations, but not strong enough to vote against...
> > > > > [ ] -1 - Because..., I do not accept...
> > > > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > > > >
> > > > > This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> > > > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > > > Voting continues until the release manager sends an email closing the
> > > > vote.
> > > > >
> > > > > Thanks!
> > > > >
> > > > > P.S. Hint: download the whole staging repo with
> > > > >     wget -erobots=off -r -l inf -np -nH \
> > > > >
> > > > >
> > > >
> > > https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
> > > > >     # note the trailing slash is needed
> > > > >
> > > >
> > >
> >
>
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Mike Walch-2
I am trying to understand what you are looking for with your -1.

It sounds like you want following files created in
https://dist.apache.org/repos/dist/dev/accumulo/1.9.0 for each release
candidate:

accumulo-1.9.0-bin.tar.gz
accumulo-1.9.0-bin.tar.gz.asc
accumulo-1.9.0-bin.tar.gz.sha512
accumulo-1.9.0-src.tar.gz
accumulo-1.9.0-src.tar.gz.asc
accumulo-1.9.0-src.tar.gz.sha512

This will require the release manager to copy the tarballs and asc files
from the maven repo to SVN dev directory and create the sha512 files for
each candidate, correct?

If this is going to be a new requirement for releases, it should be
documented with step by step instructions at https://accumulo.apache.org/
contributor/making-release

On Sun, Apr 15, 2018 at 10:12 AM, Sean Busbey <[hidden email]> wrote:

> sorry, that should have been "staged maven repository should stick to MUST
> guidance"
>
>
>
> On 2018/04/15 14:11:43, Sean Busbey <[hidden email]> wrote:
> > -1 on the RC vote
> >
> > I agree that in the staged maven repository we should stick to SHOULD
> guidance until such time that the maven tooling has a supported option to
> use correct checksums. (Have we verified that the relevant tooling at a
> minimum has a request in to add it?)
> >
> > However, I can't verify that the source artifact or any other artifacts
> that we'll eventually place in dist.a.o/release has correct checksums that
> meet the current release distribution policy simply because we don't have
> the relevant bits posted here in the RC.
> >
> > Why don't we go back to providing both a staged maven repo and an RC
> directory in the ASF dev part of dist.a.o[4]? Plenty of other projects use
> that area to stage RCs that have correct checksums.
> >
> > [4]: https://dist.apache.org/repos/dist/dev/accumulo/
> >
> > On 2018/04/15 05:35:39, Christopher <[hidden email]> wrote:
> > > Mike,
> > >
> > > We use stronger checksums (SHA512) in the SVN[1] area and downloads
> page[2]
> > > after a vote passes. In fact, we're one of the only "perfect projects"
> in
> > > regards to compliance with this policy[3].
> > >
> > > The Maven staging area doesn't follow all the "SHOULD" statements, but
> > > that's only because these checksums are automatically generated by
> > > maven-deploy-plugin, and not under our direct control. However, it
> still
> > > follows all the "MUST" statements, so it is still in compliance with
> the
> > > cited policy. Unless we're willing to circumvent standard Maven
> tooling and
> > > risk breaking things which depend on the conventions established by
> this
> > > tooling (which, to be clear, I think would be a really terribly bad
> idea),
> > > we simply cannot follow all the "SHOULD" statements for the Maven
> staging
> > > area.
> > >
> > > [1]: https://www.apache.org/dist/accumulo/
> > > [2]: https://accumulo.apache.org/downloads/
> > > [3]: https://checker.apache.org/dist/unsummed.html
> > >
> > > On Sat, Apr 14, 2018 at 11:13 PM Mike Drob <[hidden email]> wrote:
> > >
> > > > -0
> > > >
> > > > please do not publish md5 sums
> > > > please add missing sha256 sums
> > > >
> > > > apache release policy:
> > > > http://www.apache.org/dev/release-distribution#sigs-and-sums
> > > >
> > > > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch <[hidden email]>
> wrote:
> > > >
> > > > > +1
> > > > >
> > > > > * Verified sha1 & md5 hashes matched
> > > > > * Verified signatures
> > > > > * Ran binary tarball locally using Uno
> > > > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > > > >
> > > > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher <[hidden email]>
> > > > wrote:
> > > > >
> > > > > > Accumulo Developers,
> > > > > >
> > > > > > Please consider the following candidate for Apache Accumulo
> 1.9.0.
> > > > > >
> > > > > > Git Commit:
> > > > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > > Branch:
> > > > > >     1.9.0-rc1
> > > > > >
> > > > > > If this vote passes, a gpg-signed tag will be created using:
> > > > > >     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > >
> > > > > > Staging repo:
> > > > > >
> > > > >
> > > > https://repository.apache.org/content/repositories/orgapache
> accumulo-1070
> > > > > > Source (official release artifact):
> > > > > > https://repository.apache.org/content/repositories/orgapache
> > > > > >
> > > > >
> > > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.
> 9.0-src.tar.gz
> > > > > > Binary:
> > > > > > https://repository.apache.org/content/repositories/orgapache
> > > > > >
> > > > >
> > > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.
> 9.0-bin.tar.gz
> > > > > > (Append ".sha1", ".md5", or ".asc" to download the
> signature/hash for a
> > > > > > given artifact.)
> > > > > >
> > > > > > All artifacts were built and staged with:
> > > > > >     mvn release:prepare && mvn release:perform
> > > > > >
> > > > > > Signing keys are available at
> > > > https://www.apache.org/dist/accumulo/KEYS
> > > > > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > > > > >
> > > > > > Release notes (in progress) can be found at:
> > > > > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > > > > >
> > > > > > Please vote one of:
> > > > > > [ ] +1 - I have verified and accept...
> > > > > > [ ] +0 - I have reservations, but not strong enough to vote
> against...
> > > > > > [ ] -1 - Because..., I do not accept...
> > > > > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > > > > >
> > > > > > This vote will remain open until at least Sun Apr 15 22:30:00
> UTC 2018
> > > > > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > > > > Voting continues until the release manager sends an email
> closing the
> > > > > vote.
> > > > > >
> > > > > > Thanks!
> > > > > >
> > > > > > P.S. Hint: download the whole staging repo with
> > > > > >     wget -erobots=off -r -l inf -np -nH \
> > > > > >
> > > > > >
> > > > >
> > > > https://repository.apache.org/content/repositories/orgapache
> accumulo-1070/
> > > > > >     # note the trailing slash is needed
> > > > > >
> > > > >
> > > >
> > >
> >
>
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Mike Drob
In reply to this post by Christopher Tubbs-2
I am strongly against generating and publishing checksum information after
a vote because that ostensibly means it hasn't been verified and voted on.

On Sun, Apr 15, 2018 at 12:35 AM, Christopher <[hidden email]> wrote:

> Mike,
>
> We use stronger checksums (SHA512) in the SVN[1] area and downloads page[2]
> after a vote passes. In fact, we're one of the only "perfect projects" in
> regards to compliance with this policy[3].
>
> The Maven staging area doesn't follow all the "SHOULD" statements, but
> that's only because these checksums are automatically generated by
> maven-deploy-plugin, and not under our direct control. However, it still
> follows all the "MUST" statements, so it is still in compliance with the
> cited policy. Unless we're willing to circumvent standard Maven tooling and
> risk breaking things which depend on the conventions established by this
> tooling (which, to be clear, I think would be a really terribly bad idea),
> we simply cannot follow all the "SHOULD" statements for the Maven staging
> area.
>
> [1]: https://www.apache.org/dist/accumulo/
> [2]: https://accumulo.apache.org/downloads/
> [3]: https://checker.apache.org/dist/unsummed.html
>
> On Sat, Apr 14, 2018 at 11:13 PM Mike Drob <[hidden email]> wrote:
>
> > -0
> >
> > please do not publish md5 sums
> > please add missing sha256 sums
> >
> > apache release policy:
> > http://www.apache.org/dev/release-distribution#sigs-and-sums
> >
> > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch <[hidden email]> wrote:
> >
> > > +1
> > >
> > > * Verified sha1 & md5 hashes matched
> > > * Verified signatures
> > > * Ran binary tarball locally using Uno
> > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > >
> > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher <[hidden email]>
> > wrote:
> > >
> > > > Accumulo Developers,
> > > >
> > > > Please consider the following candidate for Apache Accumulo 1.9.0.
> > > >
> > > > Git Commit:
> > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > Branch:
> > > >     1.9.0-rc1
> > > >
> > > > If this vote passes, a gpg-signed tag will be created using:
> > > >     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > >
> > > > Staging repo:
> > > >
> > >
> > https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070
> > > > Source (official release artifact):
> > > > https://repository.apache.org/content/repositories/orgapache
> > > >
> > >
> > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/
> accumulo-1.9.0-src.tar.gz
> > > > Binary:
> > > > https://repository.apache.org/content/repositories/orgapache
> > > >
> > >
> > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/
> accumulo-1.9.0-bin.tar.gz
> > > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash
> for a
> > > > given artifact.)
> > > >
> > > > All artifacts were built and staged with:
> > > >     mvn release:prepare && mvn release:perform
> > > >
> > > > Signing keys are available at
> > https://www.apache.org/dist/accumulo/KEYS
> > > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > > >
> > > > Release notes (in progress) can be found at:
> > > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > > >
> > > > Please vote one of:
> > > > [ ] +1 - I have verified and accept...
> > > > [ ] +0 - I have reservations, but not strong enough to vote
> against...
> > > > [ ] -1 - Because..., I do not accept...
> > > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > > >
> > > > This vote will remain open until at least Sun Apr 15 22:30:00 UTC
> 2018
> > > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > > Voting continues until the release manager sends an email closing the
> > > vote.
> > > >
> > > > Thanks!
> > > >
> > > > P.S. Hint: download the whole staging repo with
> > > >     wget -erobots=off -r -l inf -np -nH \
> > > >
> > > >
> > >
> > https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070/
> > > >     # note the trailing slash is needed
> > > >
> > >
> >
>
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

J. Mark Owens
+1

* verified hashes and signature
* build passed mvn clean verify -Psunny
* build passed all unit testing
* ran an accumulo instance using Uno
* verified basic functionality via the accumulo shell command

On Sun, Apr 15, 2018 at 1:24 PM, Mike Drob <[hidden email]> wrote:

> I am strongly against generating and publishing checksum information after
> a vote because that ostensibly means it hasn't been verified and voted on.
>
> On Sun, Apr 15, 2018 at 12:35 AM, Christopher <[hidden email]> wrote:
>
> > Mike,
> >
> > We use stronger checksums (SHA512) in the SVN[1] area and downloads
> page[2]
> > after a vote passes. In fact, we're one of the only "perfect projects" in
> > regards to compliance with this policy[3].
> >
> > The Maven staging area doesn't follow all the "SHOULD" statements, but
> > that's only because these checksums are automatically generated by
> > maven-deploy-plugin, and not under our direct control. However, it still
> > follows all the "MUST" statements, so it is still in compliance with the
> > cited policy. Unless we're willing to circumvent standard Maven tooling
> and
> > risk breaking things which depend on the conventions established by this
> > tooling (which, to be clear, I think would be a really terribly bad
> idea),
> > we simply cannot follow all the "SHOULD" statements for the Maven staging
> > area.
> >
> > [1]: https://www.apache.org/dist/accumulo/
> > [2]: https://accumulo.apache.org/downloads/
> > [3]: https://checker.apache.org/dist/unsummed.html
> >
> > On Sat, Apr 14, 2018 at 11:13 PM Mike Drob <[hidden email]> wrote:
> >
> > > -0
> > >
> > > please do not publish md5 sums
> > > please add missing sha256 sums
> > >
> > > apache release policy:
> > > http://www.apache.org/dev/release-distribution#sigs-and-sums
> > >
> > > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch <[hidden email]>
> wrote:
> > >
> > > > +1
> > > >
> > > > * Verified sha1 & md5 hashes matched
> > > > * Verified signatures
> > > > * Ran binary tarball locally using Uno
> > > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > > >
> > > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher <[hidden email]>
> > > wrote:
> > > >
> > > > > Accumulo Developers,
> > > > >
> > > > > Please consider the following candidate for Apache Accumulo 1.9.0.
> > > > >
> > > > > Git Commit:
> > > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > Branch:
> > > > >     1.9.0-rc1
> > > > >
> > > > > If this vote passes, a gpg-signed tag will be created using:
> > > > >     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > >
> > > > > Staging repo:
> > > > >
> > > >
> > > https://repository.apache.org/content/repositories/
> > orgapacheaccumulo-1070
> > > > > Source (official release artifact):
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/
> > accumulo-1.9.0-src.tar.gz
> > > > > Binary:
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/
> > accumulo-1.9.0-bin.tar.gz
> > > > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash
> > for a
> > > > > given artifact.)
> > > > >
> > > > > All artifacts were built and staged with:
> > > > >     mvn release:prepare && mvn release:perform
> > > > >
> > > > > Signing keys are available at
> > > https://www.apache.org/dist/accumulo/KEYS
> > > > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > > > >
> > > > > Release notes (in progress) can be found at:
> > > > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > > > >
> > > > > Please vote one of:
> > > > > [ ] +1 - I have verified and accept...
> > > > > [ ] +0 - I have reservations, but not strong enough to vote
> > against...
> > > > > [ ] -1 - Because..., I do not accept...
> > > > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > > > >
> > > > > This vote will remain open until at least Sun Apr 15 22:30:00 UTC
> > 2018
> > > > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > > > Voting continues until the release manager sends an email closing
> the
> > > > vote.
> > > > >
> > > > > Thanks!
> > > > >
> > > > > P.S. Hint: download the whole staging repo with
> > > > >     wget -erobots=off -r -l inf -np -nH \
> > > > >
> > > > >
> > > >
> > > https://repository.apache.org/content/repositories/
> > orgapacheaccumulo-1070/
> > > > >     # note the trailing slash is needed
> > > > >
> > > >
> > >
> >
>
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Christopher Tubbs-2
In reply to this post by Sean Busbey-6
On Sun, Apr 15, 2018 at 10:11 AM Sean Busbey <[hidden email]> wrote:

> -1 on the RC vote
>
> I agree that in the staged maven repository we should stick to SHOULD
> guidance until such time that the maven tooling has a supported option to
> use correct checksums. (Have we verified that the relevant tooling at a
> minimum has a request in to add it?)
>
>
https://issues.apache.org/jira/browse/MNGSITE-328, and related issues track
this.


> However, I can't verify that the source artifact or any other artifacts
> that we'll eventually place in dist.a.o/release has correct checksums that
> meet the current release distribution policy simply because we don't have
> the relevant bits posted here in the RC.
>
>
You can't verify the contents of what will eventually be there anyway...
anybody could copy things incorrectly. But, they *should* be what was in
the staging directory... so you can always do a byte-for-byte comparison to
the staging repo (which gets promoted to Maven Central) and verify the
checksum matches that.


> Why don't we go back to providing both a staged maven repo and an RC
> directory in the ASF dev part of dist.a.o[4]? Plenty of other projects use
> that area to stage RCs that have correct checksums.
>
>
"go back to" doesn't make sense here. To my knowledge, we've never done
this. While using this SVN dev area is somewhat common now, before we
started staging in Nexus consistently, the SVN dev area on dist was not
standard, and people staged tarballs in people.apache.org and elsewhere.
When a release vote passed, people would do a `mvn deploy` from the
unpacked source tarball or from the SVN tag (meaning the jars in the binary
tarball did not match what was in Maven Central, and possibly from a
slightly different source with no way to verify). Staging in Nexus solved
all of that. Furthermore, two staging areas causes additional concerns
(which one is canonical? What if some people only test one, but not the
other? What if SVN contents change because unlike a closed Nexus staging
repository, SVN directory contents are not immutable?).

I've thought about modifying our build.sh script to stage stuff in SVN to
help reduce human error... but it doesn't entirely address all those
concerns about two staging areas. Additionally, that's a new step being
added to the release process... and discussions about changing our release
process to do additional things like that fall outside the scope of this
release vote. We're voting on the release artifacts here, not voting on
revamping the release process. Let's not hold up a release because of wish
list items for the release process.

Since it seems to be a problem for folks this time around... I've manually
staged the artifacts in:
https://dist.apache.org/repos/dist/dev/accumulo/1.9.0-rc1

Does that change anybody's vote?



> [4]: https://dist.apache.org/repos/dist/dev/accumulo/
>
> On 2018/04/15 05:35:39, Christopher <[hidden email]> wrote:
> > Mike,
> >
> > We use stronger checksums (SHA512) in the SVN[1] area and downloads
> page[2]
> > after a vote passes. In fact, we're one of the only "perfect projects" in
> > regards to compliance with this policy[3].
> >
> > The Maven staging area doesn't follow all the "SHOULD" statements, but
> > that's only because these checksums are automatically generated by
> > maven-deploy-plugin, and not under our direct control. However, it still
> > follows all the "MUST" statements, so it is still in compliance with the
> > cited policy. Unless we're willing to circumvent standard Maven tooling
> and
> > risk breaking things which depend on the conventions established by this
> > tooling (which, to be clear, I think would be a really terribly bad
> idea),
> > we simply cannot follow all the "SHOULD" statements for the Maven staging
> > area.
> >
> > [1]: https://www.apache.org/dist/accumulo/
> > [2]: https://accumulo.apache.org/downloads/
> > [3]: https://checker.apache.org/dist/unsummed.html
> >
> > On Sat, Apr 14, 2018 at 11:13 PM Mike Drob <[hidden email]> wrote:
> >
> > > -0
> > >
> > > please do not publish md5 sums
> > > please add missing sha256 sums
> > >
> > > apache release policy:
> > > http://www.apache.org/dev/release-distribution#sigs-and-sums
> > >
> > > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch <[hidden email]>
> wrote:
> > >
> > > > +1
> > > >
> > > > * Verified sha1 & md5 hashes matched
> > > > * Verified signatures
> > > > * Ran binary tarball locally using Uno
> > > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > > >
> > > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher <[hidden email]>
> > > wrote:
> > > >
> > > > > Accumulo Developers,
> > > > >
> > > > > Please consider the following candidate for Apache Accumulo 1.9.0.
> > > > >
> > > > > Git Commit:
> > > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > Branch:
> > > > >     1.9.0-rc1
> > > > >
> > > > > If this vote passes, a gpg-signed tag will be created using:
> > > > >     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > >
> > > > > Staging repo:
> > > > >
> > > >
> > >
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> > > > > Source (official release artifact):
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > >
> accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> > > > > Binary:
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > >
> accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> > > > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash
> for a
> > > > > given artifact.)
> > > > >
> > > > > All artifacts were built and staged with:
> > > > >     mvn release:prepare && mvn release:perform
> > > > >
> > > > > Signing keys are available at
> > > https://www.apache.org/dist/accumulo/KEYS
> > > > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > > > >
> > > > > Release notes (in progress) can be found at:
> > > > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > > > >
> > > > > Please vote one of:
> > > > > [ ] +1 - I have verified and accept...
> > > > > [ ] +0 - I have reservations, but not strong enough to vote
> against...
> > > > > [ ] -1 - Because..., I do not accept...
> > > > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > > > >
> > > > > This vote will remain open until at least Sun Apr 15 22:30:00 UTC
> 2018
> > > > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > > > Voting continues until the release manager sends an email closing
> the
> > > > vote.
> > > > >
> > > > > Thanks!
> > > > >
> > > > > P.S. Hint: download the whole staging repo with
> > > > >     wget -erobots=off -r -l inf -np -nH \
> > > > >
> > > > >
> > > >
> > >
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
> > > > >     # note the trailing slash is needed
> > > > >
> > > >
> > >
> >
>
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Sean Busbey-6
In reply to this post by Mike Walch-2
I don't have strong feelings about how we implement hosting the RC, but I do want the RC to contain the actual checksum that we're going to use when we publish on dist.a.o in the release.

Otherwise we're not verifying that said checksum is correct for the artifact we're voting on, which is part of the point of us having a release vote.

Publishing via the dev part of dist.a.o is one way to do that. If the community prefers some other way, that's fine by me as well.



On 2018/04/15 16:23:02, Mike Walch <[hidden email]> wrote:

> I am trying to understand what you are looking for with your -1.
>
> It sounds like you want following files created in
> https://dist.apache.org/repos/dist/dev/accumulo/1.9.0 for each release
> candidate:
>
> accumulo-1.9.0-bin.tar.gz
> accumulo-1.9.0-bin.tar.gz.asc
> accumulo-1.9.0-bin.tar.gz.sha512
> accumulo-1.9.0-src.tar.gz
> accumulo-1.9.0-src.tar.gz.asc
> accumulo-1.9.0-src.tar.gz.sha512
>
> This will require the release manager to copy the tarballs and asc files
> from the maven repo to SVN dev directory and create the sha512 files for
> each candidate, correct?
>
> If this is going to be a new requirement for releases, it should be
> documented with step by step instructions at https://accumulo.apache.org/
> contributor/making-release
>
> On Sun, Apr 15, 2018 at 10:12 AM, Sean Busbey <[hidden email]> wrote:
>
> > sorry, that should have been "staged maven repository should stick to MUST
> > guidance"
> >
> >
> >
> > On 2018/04/15 14:11:43, Sean Busbey <[hidden email]> wrote:
> > > -1 on the RC vote
> > >
> > > I agree that in the staged maven repository we should stick to SHOULD
> > guidance until such time that the maven tooling has a supported option to
> > use correct checksums. (Have we verified that the relevant tooling at a
> > minimum has a request in to add it?)
> > >
> > > However, I can't verify that the source artifact or any other artifacts
> > that we'll eventually place in dist.a.o/release has correct checksums that
> > meet the current release distribution policy simply because we don't have
> > the relevant bits posted here in the RC.
> > >
> > > Why don't we go back to providing both a staged maven repo and an RC
> > directory in the ASF dev part of dist.a.o[4]? Plenty of other projects use
> > that area to stage RCs that have correct checksums.
> > >
> > > [4]: https://dist.apache.org/repos/dist/dev/accumulo/
> > >
> > > On 2018/04/15 05:35:39, Christopher <[hidden email]> wrote:
> > > > Mike,
> > > >
> > > > We use stronger checksums (SHA512) in the SVN[1] area and downloads
> > page[2]
> > > > after a vote passes. In fact, we're one of the only "perfect projects"
> > in
> > > > regards to compliance with this policy[3].
> > > >
> > > > The Maven staging area doesn't follow all the "SHOULD" statements, but
> > > > that's only because these checksums are automatically generated by
> > > > maven-deploy-plugin, and not under our direct control. However, it
> > still
> > > > follows all the "MUST" statements, so it is still in compliance with
> > the
> > > > cited policy. Unless we're willing to circumvent standard Maven
> > tooling and
> > > > risk breaking things which depend on the conventions established by
> > this
> > > > tooling (which, to be clear, I think would be a really terribly bad
> > idea),
> > > > we simply cannot follow all the "SHOULD" statements for the Maven
> > staging
> > > > area.
> > > >
> > > > [1]: https://www.apache.org/dist/accumulo/
> > > > [2]: https://accumulo.apache.org/downloads/
> > > > [3]: https://checker.apache.org/dist/unsummed.html
> > > >
> > > > On Sat, Apr 14, 2018 at 11:13 PM Mike Drob <[hidden email]> wrote:
> > > >
> > > > > -0
> > > > >
> > > > > please do not publish md5 sums
> > > > > please add missing sha256 sums
> > > > >
> > > > > apache release policy:
> > > > > http://www.apache.org/dev/release-distribution#sigs-and-sums
> > > > >
> > > > > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch <[hidden email]>
> > wrote:
> > > > >
> > > > > > +1
> > > > > >
> > > > > > * Verified sha1 & md5 hashes matched
> > > > > > * Verified signatures
> > > > > > * Ran binary tarball locally using Uno
> > > > > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > > > > >
> > > > > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher <[hidden email]>
> > > > > wrote:
> > > > > >
> > > > > > > Accumulo Developers,
> > > > > > >
> > > > > > > Please consider the following candidate for Apache Accumulo
> > 1.9.0.
> > > > > > >
> > > > > > > Git Commit:
> > > > > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > > > Branch:
> > > > > > >     1.9.0-rc1
> > > > > > >
> > > > > > > If this vote passes, a gpg-signed tag will be created using:
> > > > > > >     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > > > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > > >
> > > > > > > Staging repo:
> > > > > > >
> > > > > >
> > > > > https://repository.apache.org/content/repositories/orgapache
> > accumulo-1070
> > > > > > > Source (official release artifact):
> > > > > > > https://repository.apache.org/content/repositories/orgapache
> > > > > > >
> > > > > >
> > > > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.
> > 9.0-src.tar.gz
> > > > > > > Binary:
> > > > > > > https://repository.apache.org/content/repositories/orgapache
> > > > > > >
> > > > > >
> > > > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.
> > 9.0-bin.tar.gz
> > > > > > > (Append ".sha1", ".md5", or ".asc" to download the
> > signature/hash for a
> > > > > > > given artifact.)
> > > > > > >
> > > > > > > All artifacts were built and staged with:
> > > > > > >     mvn release:prepare && mvn release:perform
> > > > > > >
> > > > > > > Signing keys are available at
> > > > > https://www.apache.org/dist/accumulo/KEYS
> > > > > > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > > > > > >
> > > > > > > Release notes (in progress) can be found at:
> > > > > > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > > > > > >
> > > > > > > Please vote one of:
> > > > > > > [ ] +1 - I have verified and accept...
> > > > > > > [ ] +0 - I have reservations, but not strong enough to vote
> > against...
> > > > > > > [ ] -1 - Because..., I do not accept...
> > > > > > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > > > > > >
> > > > > > > This vote will remain open until at least Sun Apr 15 22:30:00
> > UTC 2018
> > > > > > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > > > > > Voting continues until the release manager sends an email
> > closing the
> > > > > > vote.
> > > > > > >
> > > > > > > Thanks!
> > > > > > >
> > > > > > > P.S. Hint: download the whole staging repo with
> > > > > > >     wget -erobots=off -r -l inf -np -nH \
> > > > > > >
> > > > > > >
> > > > > >
> > > > > https://repository.apache.org/content/repositories/orgapache
> > accumulo-1070/
> > > > > > >     # note the trailing slash is needed
> > > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
>
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Sean Busbey-6
In reply to this post by Christopher Tubbs-2


On 2018/04/15 21:39:04, Christopher <[hidden email]> wrote:

> On Sun, Apr 15, 2018 at 10:11 AM Sean Busbey <[hidden email]> wrote:
>
> > -1 on the RC vote
> >
> > I agree that in the staged maven repository we should stick to SHOULD
> > guidance until such time that the maven tooling has a supported option to
> > use correct checksums. (Have we verified that the relevant tooling at a
> > minimum has a request in to add it?)
> >
> >
> https://issues.apache.org/jira/browse/MNGSITE-328, and related issues track
> this.
>

Reading more on this it seems like there's also a problem on the Nexus side with hosting SHA256 / SHA512 checksums, so we're probably in for a long wait on that bit.


>
> > However, I can't verify that the source artifact or any other artifacts
> > that we'll eventually place in dist.a.o/release has correct checksums that
> > meet the current release distribution policy simply because we don't have
> > the relevant bits posted here in the RC.
> >
> >
> You can't verify the contents of what will eventually be there anyway...
> anybody could copy things incorrectly. But, they *should* be what was in
> the staging directory... so you can always do a byte-for-byte comparison to
> the staging repo (which gets promoted to Maven Central) and verify the
> checksum matches that.
>

Those are very different levels of effort. In one case I can see if the thing folks voted on is the thing that's hosted (or at least the thing I end up with when I download the thing that's hosted).  the checksums are supposed to serve this purpose.

>
> > Why don't we go back to providing both a staged maven repo and an RC
> > directory in the ASF dev part of dist.a.o[4]? Plenty of other projects use
> > that area to stage RCs that have correct checksums.
> >
> >
> "go back to" doesn't make sense here. To my knowledge, we've never done
> this. While using this SVN dev area is somewhat common now, before we
> started staging in Nexus consistently, the SVN dev area on dist was not
> standard, and people staged tarballs in people.apache.org and elsewhere.
> When a release vote passed, people would do a `mvn deploy` from the
> unpacked source tarball or from the SVN tag (meaning the jars in the binary
> tarball did not match what was in Maven Central, and possibly from a
> slightly different source with no way to verify). Staging in Nexus solved
> all of that. Furthermore, two staging areas causes additional concerns
> (which one is canonical? What if some people only test one, but not the
> other? What if SVN contents change because unlike a closed Nexus staging
> repository, SVN directory contents are not immutable?).
>

I guess I misremembered us using the SVN dev area. In any case I'm not concerned with where we host the RC bits so long as I can vote on all the things that will eventually go in to dist.a.o's release area. Otherwise what good does checking that the checksums are correct do?

All the rest of these concerns are implementation details. If you post one thing and say "this is the part that will go into the release area of dist.a.o" then _that_ one is the canonical one by definition. So long as folks say which one(s) of the staging areas they verified and we have coverage over both, then it hardly matters if some folks might not be checking all of them. SVN mutability has plenty of solutions, if we're really hung up on it.


> I've thought about modifying our build.sh script to stage stuff in SVN to
> help reduce human error... but it doesn't entirely address all those
> concerns about two staging areas. Additionally, that's a new step being
> added to the release process... and discussions about changing our release
> process to do additional things like that fall outside the scope of this
> release vote. We're voting on the release artifacts here, not voting on
> revamping the release process. Let's not hold up a release because of wish
> list items for the release process.
>

Again, to be clear, I don't care what the particulars of the release process are so long as they allow me to vote on the thing that ASF release policy says I'm supposed to vote on. Release votes are majority in any case. I'm pretty sure even if I vote -1 on every release for the rest of my life on this basis the rest of the PMC could ignore my concern if y'all wanted to.


> Since it seems to be a problem for folks this time around... I've manually
> staged the artifacts in:
> https://dist.apache.org/repos/dist/dev/accumulo/1.9.0-rc1
>

If you started a new VOTE thread that included these artifacts as those that would go into dist.a.o's release area, then I would evaluate the candidates without the need to -1 because I couldn't check the things we're planning to publish.

As is, I think changing the contents of the RC mid-vote is ill advised mostly because it's confusing (e.g. how do we know folks who already voted are still on board if they don't respond?). We have several folks who already voted based on what's posted in Nexus. You're the RM for the vote. If you want to tally just based on those votes or if you want to cancel and start again, either is your prerogative.


Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Sean Busbey-6
In reply to this post by Mike Drob
Does "strongly against" in this case mean "-1" or still "-0" ?

On 2018/04/15 17:24:33, Mike Drob <[hidden email]> wrote:

> I am strongly against generating and publishing checksum information after
> a vote because that ostensibly means it hasn't been verified and voted on.
>
> On Sun, Apr 15, 2018 at 12:35 AM, Christopher <[hidden email]> wrote:
>
> > Mike,
> >
> > We use stronger checksums (SHA512) in the SVN[1] area and downloads page[2]
> > after a vote passes. In fact, we're one of the only "perfect projects" in
> > regards to compliance with this policy[3].
> >
> > The Maven staging area doesn't follow all the "SHOULD" statements, but
> > that's only because these checksums are automatically generated by
> > maven-deploy-plugin, and not under our direct control. However, it still
> > follows all the "MUST" statements, so it is still in compliance with the
> > cited policy. Unless we're willing to circumvent standard Maven tooling and
> > risk breaking things which depend on the conventions established by this
> > tooling (which, to be clear, I think would be a really terribly bad idea),
> > we simply cannot follow all the "SHOULD" statements for the Maven staging
> > area.
> >
> > [1]: https://www.apache.org/dist/accumulo/
> > [2]: https://accumulo.apache.org/downloads/
> > [3]: https://checker.apache.org/dist/unsummed.html
> >
> > On Sat, Apr 14, 2018 at 11:13 PM Mike Drob <[hidden email]> wrote:
> >
> > > -0
> > >
> > > please do not publish md5 sums
> > > please add missing sha256 sums
> > >
> > > apache release policy:
> > > http://www.apache.org/dev/release-distribution#sigs-and-sums
> > >
> > > On Sat, Apr 14, 2018 at 11:37 AM, Mike Walch <[hidden email]> wrote:
> > >
> > > > +1
> > > >
> > > > * Verified sha1 & md5 hashes matched
> > > > * Verified signatures
> > > > * Ran binary tarball locally using Uno
> > > > * Ran 'mvn verify' successfully for wikisearch using RC jars
> > > >
> > > > On Thu, Apr 12, 2018 at 6:21 PM, Christopher <[hidden email]>
> > > wrote:
> > > >
> > > > > Accumulo Developers,
> > > > >
> > > > > Please consider the following candidate for Apache Accumulo 1.9.0.
> > > > >
> > > > > Git Commit:
> > > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > > Branch:
> > > > >     1.9.0-rc1
> > > > >
> > > > > If this vote passes, a gpg-signed tag will be created using:
> > > > >     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> > > > >     bca516000bdb54b1e5582f908e0a525634a120f7
> > > > >
> > > > > Staging repo:
> > > > >
> > > >
> > > https://repository.apache.org/content/repositories/
> > orgapacheaccumulo-1070
> > > > > Source (official release artifact):
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/
> > accumulo-1.9.0-src.tar.gz
> > > > > Binary:
> > > > > https://repository.apache.org/content/repositories/orgapache
> > > > >
> > > >
> > > accumulo-1070/org/apache/accumulo/accumulo/1.9.0/
> > accumulo-1.9.0-bin.tar.gz
> > > > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash
> > for a
> > > > > given artifact.)
> > > > >
> > > > > All artifacts were built and staged with:
> > > > >     mvn release:prepare && mvn release:perform
> > > > >
> > > > > Signing keys are available at
> > > https://www.apache.org/dist/accumulo/KEYS
> > > > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> > > > >
> > > > > Release notes (in progress) can be found at:
> > > > > https://accumulo.apache.org/release/accumulo-1.9.0/
> > > > >
> > > > > Please vote one of:
> > > > > [ ] +1 - I have verified and accept...
> > > > > [ ] +0 - I have reservations, but not strong enough to vote
> > against...
> > > > > [ ] -1 - Because..., I do not accept...
> > > > > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> > > > >
> > > > > This vote will remain open until at least Sun Apr 15 22:30:00 UTC
> > 2018
> > > > > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > > > > Voting continues until the release manager sends an email closing the
> > > > vote.
> > > > >
> > > > > Thanks!
> > > > >
> > > > > P.S. Hint: download the whole staging repo with
> > > > >     wget -erobots=off -r -l inf -np -nH \
> > > > >
> > > > >
> > > >
> > > https://repository.apache.org/content/repositories/
> > orgapacheaccumulo-1070/
> > > > >     # note the trailing slash is needed
> > > > >
> > > >
> > >
> >
>
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Sean Busbey-6
In reply to this post by Sean Busbey-6


On 2018/04/16 01:26:54, Sean Busbey <[hidden email]> wrote:

>
>
> On 2018/04/15 21:39:04, Christopher <[hidden email]> wrote:
> > On Sun, Apr 15, 2018 at 10:11 AM Sean Busbey <[hidden email]> wrote:
> >  
> >
> > > However, I can't verify that the source artifact or any other artifacts
> > > that we'll eventually place in dist.a.o/release has correct checksums that
> > > meet the current release distribution policy simply because we don't have
> > > the relevant bits posted here in the RC.
> > >
> > >
> > You can't verify the contents of what will eventually be there anyway...
> > anybody could copy things incorrectly. But, they *should* be what was in
> > the staging directory... so you can always do a byte-for-byte comparison to
> > the staging repo (which gets promoted to Maven Central) and verify the
> > checksum matches that.
> >
>
> Those are very different levels of effort. In one case I can see if the thing folks voted on is the thing that's hosted (or at least the thing I end up with when I download the thing that's hosted).  the checksums are supposed to serve this purpose.
>


Jeez. I am doing terrible for proofreading this weekend. This was supposed to say "in either case I can see..."
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Christopher Tubbs-2
On Sun, Apr 15, 2018 at 9:30 PM Sean Busbey <[hidden email]> wrote:

>
>
> On 2018/04/16 01:26:54, Sean Busbey <[hidden email]> wrote:
> >
> >
> > On 2018/04/15 21:39:04, Christopher <[hidden email]> wrote:
> > > On Sun, Apr 15, 2018 at 10:11 AM Sean Busbey <[hidden email]>
> wrote:
> > >
> > >
> > > > However, I can't verify that the source artifact or any other
> artifacts
> > > > that we'll eventually place in dist.a.o/release has correct
> checksums that
> > > > meet the current release distribution policy simply because we don't
> have
> > > > the relevant bits posted here in the RC.
> > > >
> > > >
> > > You can't verify the contents of what will eventually be there
> anyway...
> > > anybody could copy things incorrectly. But, they *should* be what was
> in
> > > the staging directory... so you can always do a byte-for-byte
> comparison to
> > > the staging repo (which gets promoted to Maven Central) and verify the
> > > checksum matches that.
> > >
> >
> > Those are very different levels of effort. In one case I can see if the
> thing folks voted on is the thing that's hosted (or at least the thing I
> end up with when I download the thing that's hosted).  the checksums are
> supposed to serve this purpose.
> >
>
>
Right now, there is nothing established in policy or official guidelines
that directly serves this provenance purpose. (See [3] for a relevant
discussion on legal-discuss@.) Something that I think gets close might be
in [1] where voters are able to provide additional signatures for a release
candidate.

Also, let's be careful not to confuse the "Release Policy"[1] (which
governs releasing, voting, and sigs, but does not mention checksums) with
the "Release Distribution Policy"[2] (which governs the distribution
channels provided by Infra, and has the additional requirement for
checksums, but is separate from voting). There is nothing in the "Release
Policy" which suggests that checksums are supposed to serve any purpose...
they aren't even mentioned in the policy which pertains to voting, and the
policy which pertains to the distribution channels neither mentions voting
nor any purpose for the checksums. So no, the checksums are *not* supposed
to serve this purpose.

Regardless, for this release candidate, I've already provided SHA512
checksums in the dist/dev area. Feel free to update your vote accordingly.
Thanks.

In future, rather than maintain parallel staging areas, as I've done for
this release, I think it would be best to tweak the generated email to
simply include the hashes that will be published to the SVN dist/release
area directly in the vote thread (suggested in [3]). Personally, I'd prefer
to include the GPG signatures rather than any checksums, because I think
they are more relevant and useful for vote provenance (and I don't see a
problem with not pre-computing the SHA512 checksum). However, clearly
there's interest in providing pre-computed checksums, so I'd settle for
providing the SHA512 instead... anything to help us avoid two staging areas.

[1]: https://www.apache.org/legal/release-policy.html
[2]: https://www.apache.org/dev/release-distribution.html
[3]:
https://lists.apache.org/thread.html/bb7281ed8da0ceaa5f0f18e3edc6c3f728c74d7ed8c4df12729b6f40@%3Clegal-discuss.apache.org%3E
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Keith Turner
In reply to this post by Christopher Tubbs-2
I started continuous ingest running on a 9 node EC2 cluster this
morning.  I plan to let ingest run for ~24hrs and then run verify.
I will not know the results of this for ~2 days.

On Thu, Apr 12, 2018 at 6:21 PM, Christopher <[hidden email]> wrote:

> Accumulo Developers,
>
> Please consider the following candidate for Apache Accumulo 1.9.0.
>
> Git Commit:
>     bca516000bdb54b1e5582f908e0a525634a120f7
> Branch:
>     1.9.0-rc1
>
> If this vote passes, a gpg-signed tag will be created using:
>     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
>     bca516000bdb54b1e5582f908e0a525634a120f7
>
> Staging repo:
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> Source (official release artifact):
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> Binary:
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> given artifact.)
>
> All artifacts were built and staged with:
>     mvn release:prepare && mvn release:perform
>
> Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
> (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
>
> Release notes (in progress) can be found at:
> https://accumulo.apache.org/release/accumulo-1.9.0/
>
> Please vote one of:
> [ ] +1 - I have verified and accept...
> [ ] +0 - I have reservations, but not strong enough to vote against...
> [ ] -1 - Because..., I do not accept...
> ... these artifacts as the 1.9.0 release of Apache Accumulo.
>
> This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> Voting continues until the release manager sends an email closing the vote.
>
> Thanks!
>
> P.S. Hint: download the whole staging repo with
>     wget -erobots=off -r -l inf -np -nH \
>
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
>     # note the trailing slash is needed
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Keith Turner
In reply to this post by Christopher Tubbs-2
+1

 * Successfully built Fluo against RC
 * Ran continuous ingest for 24hrs on 9 node cluster using RC.
Verified successfully.  Table had 32.3 billion entries after test.



On Thu, Apr 12, 2018 at 6:21 PM, Christopher <[hidden email]> wrote:

> Accumulo Developers,
>
> Please consider the following candidate for Apache Accumulo 1.9.0.
>
> Git Commit:
>     bca516000bdb54b1e5582f908e0a525634a120f7
> Branch:
>     1.9.0-rc1
>
> If this vote passes, a gpg-signed tag will be created using:
>     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
>     bca516000bdb54b1e5582f908e0a525634a120f7
>
> Staging repo:
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070
> Source (official release artifact):
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-src.tar.gz
> Binary:
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.0/accumulo-1.9.0-bin.tar.gz
> (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> given artifact.)
>
> All artifacts were built and staged with:
>     mvn release:prepare && mvn release:perform
>
> Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
> (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
>
> Release notes (in progress) can be found at:
> https://accumulo.apache.org/release/accumulo-1.9.0/
>
> Please vote one of:
> [ ] +1 - I have verified and accept...
> [ ] +0 - I have reservations, but not strong enough to vote against...
> [ ] -1 - Because..., I do not accept...
> ... these artifacts as the 1.9.0 release of Apache Accumulo.
>
> This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> Voting continues until the release manager sends an email closing the vote.
>
> Thanks!
>
> P.S. Hint: download the whole staging repo with
>     wget -erobots=off -r -l inf -np -nH \
>
> https://repository.apache.org/content/repositories/orgapacheaccumulo-1070/
>     # note the trailing slash is needed
Reply | Threaded
Open this post in threaded view
|

Re: [VOTE] Apache Accumulo 1.9.0-rc1

Mike Miller
+1
Ran randomwalk "All.xml" tests across 7 walkers and 1 leader EC2 cluster
for almost 48 hours.  No problems seen other than a false positive with the
test that is fixed in PR #429 <https://github.com/apache/accumulo/pull/429>

On Wed, Apr 18, 2018 at 11:07 AM, Keith Turner <[hidden email]> wrote:

> +1
>
>  * Successfully built Fluo against RC
>  * Ran continuous ingest for 24hrs on 9 node cluster using RC.
> Verified successfully.  Table had 32.3 billion entries after test.
>
>
>
> On Thu, Apr 12, 2018 at 6:21 PM, Christopher <[hidden email]> wrote:
> > Accumulo Developers,
> >
> > Please consider the following candidate for Apache Accumulo 1.9.0.
> >
> > Git Commit:
> >     bca516000bdb54b1e5582f908e0a525634a120f7
> > Branch:
> >     1.9.0-rc1
> >
> > If this vote passes, a gpg-signed tag will be created using:
> >     git tag -f -m 'Apache Accumulo 1.9.0' -s rel/1.9.0 \
> >     bca516000bdb54b1e5582f908e0a525634a120f7
> >
> > Staging repo:
> > https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070
> > Source (official release artifact):
> > https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.
> 0/accumulo-1.9.0-src.tar.gz
> > Binary:
> > https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070/org/apache/accumulo/accumulo/1.9.
> 0/accumulo-1.9.0-bin.tar.gz
> > (Append ".sha1", ".md5", or ".asc" to download the signature/hash for a
> > given artifact.)
> >
> > All artifacts were built and staged with:
> >     mvn release:prepare && mvn release:perform
> >
> > Signing keys are available at https://www.apache.org/dist/accumulo/KEYS
> > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D)
> >
> > Release notes (in progress) can be found at:
> > https://accumulo.apache.org/release/accumulo-1.9.0/
> >
> > Please vote one of:
> > [ ] +1 - I have verified and accept...
> > [ ] +0 - I have reservations, but not strong enough to vote against...
> > [ ] -1 - Because..., I do not accept...
> > ... these artifacts as the 1.9.0 release of Apache Accumulo.
> >
> > This vote will remain open until at least Sun Apr 15 22:30:00 UTC 2018
> > (Sun Apr 15 18:30:00 EDT 2018 / Sun Apr 15 15:30:00 PDT 2018).
> > Voting continues until the release manager sends an email closing the
> vote.
> >
> > Thanks!
> >
> > P.S. Hint: download the whole staging repo with
> >     wget -erobots=off -r -l inf -np -nH \
> >
> > https://repository.apache.org/content/repositories/
> orgapacheaccumulo-1070/
> >     # note the trailing slash is needed
>
12