[VOTE] 4.0.M5 release v2

classic Classic list List threaded Threaded
16 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

[VOTE] 4.0.M5 release v2

Nikita Timofeev
Hi all,

I'm published new files for 4.0.M5 release and you can start voting (again).
The only difference should be fix for CAY-2242.

Here are links:
Maven: https://repository.apache.org/content/repositories/orgapachecayenne-1013
Assemblies: https://dist.apache.org/repos/dist/dev/cayenne/4.0.M5/

Sorry for inconvenience, hope this one will be promoted to the official release.

--
Best regards,
Nikita Timofeev
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [VOTE] 4.0.M5 release v2

Mike Kienenberger
It seems like it may make more sense to change the version to M6 rather
than create M5-v2 and have to deal with potential confusion.

On Fri, Feb 24, 2017 at 3:54 AM, Nikita Timofeev <[hidden email]>
wrote:

> Hi all,
>
> I'm published new files for 4.0.M5 release and you can start voting
> (again).
> The only difference should be fix for CAY-2242.
>
> Here are links:
> Maven: https://repository.apache.org/content/repositories/
> orgapachecayenne-1013
> Assemblies: https://dist.apache.org/repos/dist/dev/cayenne/4.0.M5/
>
> Sorry for inconvenience, hope this one will be promoted to the official
> release.
>
> --
> Best regards,
> Nikita Timofeev
>
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [VOTE] 4.0.M5 release v2

Nikita Timofeev
Hi, Mike

Release is still only 4.0.M5, v2 is only to distinct mail threads.
And I have deleted previous builds, so there should be no confusion.

On Fri, Feb 24, 2017 at 6:08 PM, Mike Kienenberger <[hidden email]> wrote:

> It seems like it may make more sense to change the version to M6 rather
> than create M5-v2 and have to deal with potential confusion.
>
> On Fri, Feb 24, 2017 at 3:54 AM, Nikita Timofeev <[hidden email]>
> wrote:
>
>> Hi all,
>>
>> I'm published new files for 4.0.M5 release and you can start voting
>> (again).
>> The only difference should be fix for CAY-2242.
>>
>> Here are links:
>> Maven: https://repository.apache.org/content/repositories/
>> orgapachecayenne-1013
>> Assemblies: https://dist.apache.org/repos/dist/dev/cayenne/4.0.M5/
>>
>> Sorry for inconvenience, hope this one will be promoted to the official
>> release.
>>
>> --
>> Best regards,
>> Nikita Timofeev
>>



--
Best regards,
Nikita Timofeev
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [VOTE] 4.0.M5 release v2

Aristedes Maniatis-2
I agree with Mike. Since you didn't delete the artifacts I already downloaded to my machine, there is confusion. For the future, we should never "unrelease" anything. At the very least, please post hashes of the new files to this mailing list.

There is no shame in releasing 10 milestones if that's what it takes.

Ari


On 25/2/17 2:20am, Nikita Timofeev wrote:

> Hi, Mike
>
> Release is still only 4.0.M5, v2 is only to distinct mail threads.
> And I have deleted previous builds, so there should be no confusion.
>
> On Fri, Feb 24, 2017 at 6:08 PM, Mike Kienenberger <[hidden email]> wrote:
>> It seems like it may make more sense to change the version to M6 rather
>> than create M5-v2 and have to deal with potential confusion.
>>
>> On Fri, Feb 24, 2017 at 3:54 AM, Nikita Timofeev <[hidden email]>
>> wrote:
>>
>>> Hi all,
>>>
>>> I'm published new files for 4.0.M5 release and you can start voting
>>> (again).
>>> The only difference should be fix for CAY-2242.
>>>
>>> Here are links:
>>> Maven: https://repository.apache.org/content/repositories/
>>> orgapachecayenne-1013
>>> Assemblies: https://dist.apache.org/repos/dist/dev/cayenne/4.0.M5/
>>>
>>> Sorry for inconvenience, hope this one will be promoted to the official
>>> release.
>>>
>>> --
>>> Best regards,
>>> Nikita Timofeev
>>>
>
>
>

--
-------------------------->
Aristedes Maniatis
GPG fingerprint CBFB 84B4 738D 4E87 5E5C  5EFA EF6A 7D2E 3E49 102A
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [VOTE] 4.0.M5 release v2

Andrus Adamchik
Since I was the one who advised Nikita to stick with M5, let me comment on this. I am aware that many projects at Apache increment their build numbers upon failed votes. I just felt there wasn't really any logical justification for it in our case, and we'd be doing it entirely out of puristic reasons.

> For the future, we should never "unrelease" anything.


I agree with "no unrelease", but we haven't "released" anything yet. We just posted some files for review.

> Since you didn't delete the artifacts I already downloaded to my machine, there is confusion.

PMC members know exactly what happened. So I don't think that's a problem for them. And if we are concerned about an outside person who may have downloaded those artifacts, then I don't think that renaming the final set to M6 would make any difference. In both cases someone would get stuck with a signed but unapproved copy of M5.

The only remotely possible cause for confusion that I can think of is if an outside person used that temporary Maven repo, and now the M5 artifacts are stuck in his local ~/.m2/repository and they need a manual refresh. Again, I am hoping this won't confuse any of the PMC members.

Andrus


> On Feb 25, 2017, at 3:58 AM, Aristedes Maniatis <[hidden email]> wrote:
>
> I agree with Mike. Since you didn't delete the artifacts I already downloaded to my machine, there is confusion. For the future, we should never "unrelease" anything. At the very least, please post hashes of the new files to this mailing list.
>
> There is no shame in releasing 10 milestones if that's what it takes.
>
> Ari
>
>
> On 25/2/17 2:20am, Nikita Timofeev wrote:
>> Hi, Mike
>>
>> Release is still only 4.0.M5, v2 is only to distinct mail threads.
>> And I have deleted previous builds, so there should be no confusion.
>>
>> On Fri, Feb 24, 2017 at 6:08 PM, Mike Kienenberger <[hidden email]> wrote:
>>> It seems like it may make more sense to change the version to M6 rather
>>> than create M5-v2 and have to deal with potential confusion.
>>>
>>> On Fri, Feb 24, 2017 at 3:54 AM, Nikita Timofeev <[hidden email]>
>>> wrote:
>>>
>>>> Hi all,
>>>>
>>>> I'm published new files for 4.0.M5 release and you can start voting
>>>> (again).
>>>> The only difference should be fix for CAY-2242.
>>>>
>>>> Here are links:
>>>> Maven: https://repository.apache.org/content/repositories/
>>>> orgapachecayenne-1013
>>>> Assemblies: https://dist.apache.org/repos/dist/dev/cayenne/4.0.M5/
>>>>
>>>> Sorry for inconvenience, hope this one will be promoted to the official
>>>> release.
>>>>
>>>> --
>>>> Best regards,
>>>> Nikita Timofeev
>>>>
>>
>>
>>
>
> --
> -------------------------->
> Aristedes Maniatis
> GPG fingerprint CBFB 84B4 738D 4E87 5E5C  5EFA EF6A 7D2E 3E49 102A

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [VOTE] 4.0.M5 release v2

Andrus Adamchik
In reply to this post by Nikita Timofeev

> On Feb 24, 2017, at 11:54 AM, Nikita Timofeev <[hidden email]> wrote:
>
> Hi all,
>
> I'm published new files for 4.0.M5 release and you can start voting (again).
> The only difference should be fix for CAY-2242.
>
> Here are links:
> Maven: https://repository.apache.org/content/repositories/orgapachecayenne-1013
> Assemblies: https://dist.apache.org/repos/dist/dev/cayenne/4.0.M5/
>
> Sorry for inconvenience, hope this one will be promoted to the official release.
>
> --
> Best regards,
> Nikita Timofeev

I ran through my usual checklist:

1. MD5 matches
2. Signature checks
3. rat passes
4. LICENSE and NOTICE files present in the root of the distro
5. builds from source
6. Modeler runs on OS X
7. Cross-platform Modeler runs on OS X
8. Modeler runs on Windows

Everything passed successfully. Additionally I tried upgrading LinkRest and LinkMove frameworks on local branches using the staging Maven repo. It worked flawlessly (though we need to mention in the UPGRADE.txt that Derby PK generator has been switched to sequences from AUTO_PK_TABLE. This did affect one of the LinkMove tests).

My vote is +1.

Andrus



Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [VOTE] 4.0.M5 release v2

Savva Kolbachev
As I remember we already did several voting attempts before (3 attempts for
4.0.M2 and 2 attempts for 4.0.M3) and there were no confusions. I think
it's okay to keep the same release version in such situations.

Looks like this time the confusion comes from the "[VOTE] 4.0.M5 release
v2" subject of the mail thread that has been treated as voting for
4.0.M5-v2 or something. Yeah, it's definitely better to have clearer
subject like "[VOTE] 4.0.M5 second attempt" etc.

If we don't want to have several voting attempts for the same release
version, I think we could discuss it in the different thread. But in this
case I would suggest to continue voting as we don't have frequent releases
and each of them is a party :)

I have been able to successfully check the release, so here is my +1.

On Sun, Feb 26, 2017 at 4:35 PM, Andrus Adamchik <[hidden email]>
wrote:

>
> > On Feb 24, 2017, at 11:54 AM, Nikita Timofeev <[hidden email]>
> wrote:
> >
> > Hi all,
> >
> > I'm published new files for 4.0.M5 release and you can start voting
> (again).
> > The only difference should be fix for CAY-2242.
> >
> > Here are links:
> > Maven: https://repository.apache.org/content/repositories/
> orgapachecayenne-1013
> > Assemblies: https://dist.apache.org/repos/dist/dev/cayenne/4.0.M5/
> >
> > Sorry for inconvenience, hope this one will be promoted to the official
> release.
> >
> > --
> > Best regards,
> > Nikita Timofeev
>
> I ran through my usual checklist:
>
> 1. MD5 matches
> 2. Signature checks
> 3. rat passes
> 4. LICENSE and NOTICE files present in the root of the distro
> 5. builds from source
> 6. Modeler runs on OS X
> 7. Cross-platform Modeler runs on OS X
> 8. Modeler runs on Windows
>
> Everything passed successfully. Additionally I tried upgrading LinkRest
> and LinkMove frameworks on local branches using the staging Maven repo. It
> worked flawlessly (though we need to mention in the UPGRADE.txt that Derby
> PK generator has been switched to sequences from AUTO_PK_TABLE. This did
> affect one of the LinkMove tests).
>
> My vote is +1.
>
> Andrus
>
>
>
>


--
Best Regards,
Savva Kolbachev
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [VOTE] 4.0.M5 release v2

Andrus Adamchik
Gently nudging the PMC members to cast their votes :)

We are still one vote short. If someone needs more time, could you please indicate that you are planning to vote?

Andrus

(OT: what's everyone's feeling - is our new frequent release schedule unsustainable in practice?)

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [VOTE] 4.0.M5 release v2

Aristedes Maniatis-2
Here's my +1. I reviewed the OSX version and modeler against my work schema.

I think more frequent releases are a good thing. Would it help if we set up a Jenkins job to create the build artifacts then we have an easier to verify chain from source checkout to artifact creation?

Ari


On 2/3/17 6:39pm, Andrus Adamchik wrote:
> Gently nudging the PMC members to cast their votes :)
>
> We are still one vote short. If someone needs more time, could you please indicate that you are planning to vote?
>
> Andrus
>
> (OT: what's everyone's feeling - is our new frequent release schedule unsustainable in practice?)
>

--
-------------------------->
Aristedes Maniatis
GPG fingerprint CBFB 84B4 738D 4E87 5E5C  5EFA EF6A 7D2E 3E49 102A
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [VOTE] 4.0.M5 release v2

Andrus Adamchik


> On Mar 2, 2017, at 11:55 AM, Aristedes Maniatis <[hidden email]> wrote:
>
> Would it help if we set up a Jenkins job to create the build artifacts then we have an easier to verify chain from source checkout to artifact creation?

It most certainly will. How do we sign the files though?

Andrus
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [VOTE] 4.0.M5 release v2

Michael Gentry
In reply to this post by Andrus Adamchik
Still on my to-do list, but I've just been short on time.  I should be able
to get to it tomorrow or this weekend at the latest, but don't let my
schedule hold things up if we get enough votes!

I'm not opposed to more frequent releases since, if nothing else, it makes
the project seem more active to outsiders.

mrg


On Thu, Mar 2, 2017 at 2:39 AM, Andrus Adamchik <[hidden email]>
wrote:

> Gently nudging the PMC members to cast their votes :)
>
> We are still one vote short. If someone needs more time, could you please
> indicate that you are planning to vote?
>
> Andrus
>
> (OT: what's everyone's feeling - is our new frequent release schedule
> unsustainable in practice?)
>
>
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [VOTE] 4.0.M5 release v2

Aristedes Maniatis-2
In reply to this post by Andrus Adamchik
On 2/3/17 8:51pm, Andrus Adamchik wrote:
>
>
>> On Mar 2, 2017, at 11:55 AM, Aristedes Maniatis <[hidden email]> wrote:
>>
>> Would it help if we set up a Jenkins job to create the build artifacts then we have an easier to verify chain from source checkout to artifact creation?
>
> It most certainly will. How do we sign the files though?

There can still be a step of downloading the files from jenkins, signing and uploading. md5 hashes are still there for verifying the Jenkins output is intact.

I'm not sure how we verify that Jenkins itself isn't compromised, but perhaps we can ask what others do.


Ari



--
-------------------------->
Aristedes Maniatis
GPG fingerprint CBFB 84B4 738D 4E87 5E5C  5EFA EF6A 7D2E 3E49 102A
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [VOTE] 4.0.M5 release v2

Nikita Timofeev
Hi all,

As we have everything required for the M5 release I'm going to
complete it today.

Thank you for your votes and ideas!

On Thu, Mar 2, 2017 at 4:49 PM, Aristedes Maniatis <[hidden email]> wrote:

> On 2/3/17 8:51pm, Andrus Adamchik wrote:
>>
>>
>>> On Mar 2, 2017, at 11:55 AM, Aristedes Maniatis <[hidden email]> wrote:
>>>
>>> Would it help if we set up a Jenkins job to create the build artifacts then we have an easier to verify chain from source checkout to artifact creation?
>>
>> It most certainly will. How do we sign the files though?
>
> There can still be a step of downloading the files from jenkins, signing and uploading. md5 hashes are still there for verifying the Jenkins output is intact.
>
> I'm not sure how we verify that Jenkins itself isn't compromised, but perhaps we can ask what others do.
>
>
> Ari
>
>
>
> --
> -------------------------->
> Aristedes Maniatis
> GPG fingerprint CBFB 84B4 738D 4E87 5E5C  5EFA EF6A 7D2E 3E49 102A



--
Best regards,
Nikita Timofeev
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [VOTE] 4.0.M5 release v2

Nikita Timofeev
And to keep everything in order, here is the final voting results.
We have 3 PMC votes in total:

Andrus Adamchik (PMC): +1
Savva Kolbachev (PMC): +1
Aristedes Maniatis (PMC): +1

Cayenne release 4.0.M5 is done!
Thank you all once again!

On Mon, Mar 6, 2017 at 12:26 PM, Nikita Timofeev
<[hidden email]> wrote:

> Hi all,
>
> As we have everything required for the M5 release I'm going to
> complete it today.
>
> Thank you for your votes and ideas!
>
> On Thu, Mar 2, 2017 at 4:49 PM, Aristedes Maniatis <[hidden email]> wrote:
>> On 2/3/17 8:51pm, Andrus Adamchik wrote:
>>>
>>>
>>>> On Mar 2, 2017, at 11:55 AM, Aristedes Maniatis <[hidden email]> wrote:
>>>>
>>>> Would it help if we set up a Jenkins job to create the build artifacts then we have an easier to verify chain from source checkout to artifact creation?
>>>
>>> It most certainly will. How do we sign the files though?
>>
>> There can still be a step of downloading the files from jenkins, signing and uploading. md5 hashes are still there for verifying the Jenkins output is intact.
>>
>> I'm not sure how we verify that Jenkins itself isn't compromised, but perhaps we can ask what others do.
>>
>>
>> Ari
>>
>>
>>
>> --
>> -------------------------->
>> Aristedes Maniatis
>> GPG fingerprint CBFB 84B4 738D 4E87 5E5C  5EFA EF6A 7D2E 3E49 102A
>
>
>
> --
> Best regards,
> Nikita Timofeev



--
Best regards,
Nikita Timofeev
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [VOTE] 4.0.M5 release v2

Andrus Adamchik
Thanks Nikita!

I see that website announcement is already committed in our CMS staging area: http://svn.apache.org/viewvc?view=revision&revision=1785615 I was planning to review it tonight or tomorrow, publish it, and make a mailing list / twitter announcement.

Andrus

> On Mar 6, 2017, at 2:43 PM, Nikita Timofeev <[hidden email]> wrote:
>
> And to keep everything in order, here is the final voting results.
> We have 3 PMC votes in total:
>
> Andrus Adamchik (PMC): +1
> Savva Kolbachev (PMC): +1
> Aristedes Maniatis (PMC): +1
>
> Cayenne release 4.0.M5 is done!
> Thank you all once again!
>
> On Mon, Mar 6, 2017 at 12:26 PM, Nikita Timofeev
> <[hidden email]> wrote:
>> Hi all,
>>
>> As we have everything required for the M5 release I'm going to
>> complete it today.
>>
>> Thank you for your votes and ideas!
>>
>> On Thu, Mar 2, 2017 at 4:49 PM, Aristedes Maniatis <[hidden email]> wrote:
>>> On 2/3/17 8:51pm, Andrus Adamchik wrote:
>>>>
>>>>
>>>>> On Mar 2, 2017, at 11:55 AM, Aristedes Maniatis <[hidden email]> wrote:
>>>>>
>>>>> Would it help if we set up a Jenkins job to create the build artifacts then we have an easier to verify chain from source checkout to artifact creation?
>>>>
>>>> It most certainly will. How do we sign the files though?
>>>
>>> There can still be a step of downloading the files from jenkins, signing and uploading. md5 hashes are still there for verifying the Jenkins output is intact.
>>>
>>> I'm not sure how we verify that Jenkins itself isn't compromised, but perhaps we can ask what others do.
>>>
>>>
>>> Ari
>>>
>>>
>>>
>>> --
>>> -------------------------->
>>> Aristedes Maniatis
>>> GPG fingerprint CBFB 84B4 738D 4E87 5E5C  5EFA EF6A 7D2E 3E49 102A
>>
>>
>>
>> --
>> Best regards,
>> Nikita Timofeev
>
>
>
> --
> Best regards,
> Nikita Timofeev

Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [VOTE] 4.0.M5 release v2

Hugi Thordarson-2
In reply to this post by Nikita Timofeev
Thanks for all your hard work guys! The progress Cayenne has made in the last few months is amazing and M5 is awesome.

- hugi



> On 6. mar. 2017, at 11:43, Nikita Timofeev <[hidden email]> wrote:
>
> And to keep everything in order, here is the final voting results.
> We have 3 PMC votes in total:
>
> Andrus Adamchik (PMC): +1
> Savva Kolbachev (PMC): +1
> Aristedes Maniatis (PMC): +1
>
> Cayenne release 4.0.M5 is done!
> Thank you all once again!
>
> On Mon, Mar 6, 2017 at 12:26 PM, Nikita Timofeev
> <[hidden email]> wrote:
>> Hi all,
>>
>> As we have everything required for the M5 release I'm going to
>> complete it today.
>>
>> Thank you for your votes and ideas!
>>
>> On Thu, Mar 2, 2017 at 4:49 PM, Aristedes Maniatis <[hidden email]> wrote:
>>> On 2/3/17 8:51pm, Andrus Adamchik wrote:
>>>>
>>>>
>>>>> On Mar 2, 2017, at 11:55 AM, Aristedes Maniatis <[hidden email]> wrote:
>>>>>
>>>>> Would it help if we set up a Jenkins job to create the build artifacts then we have an easier to verify chain from source checkout to artifact creation?
>>>>
>>>> It most certainly will. How do we sign the files though?
>>>
>>> There can still be a step of downloading the files from jenkins, signing and uploading. md5 hashes are still there for verifying the Jenkins output is intact.
>>>
>>> I'm not sure how we verify that Jenkins itself isn't compromised, but perhaps we can ask what others do.
>>>
>>>
>>> Ari
>>>
>>>
>>>
>>> --
>>> -------------------------->
>>> Aristedes Maniatis
>>> GPG fingerprint CBFB 84B4 738D 4E87 5E5C  5EFA EF6A 7D2E 3E49 102A
>>
>>
>>
>> --
>> Best regards,
>> Nikita Timofeev
>
>
>
> --
> Best regards,
> Nikita Timofeev

Loading...