THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
Ready to be reviewed. Several questions (in light blue) need answers. Section 6, checking provenance, needs technical input.
...
This document is intended for first-time reviewers of Apache Taverna, particularly those reviewers who desire additional information about the review process and tools used. It assumes you have already read How to Review a Release and Vote.
...
Contents
...
- Getting Started
- Verify Your Environment
- Download the Release Candidate
- BEFORE You Unzip the Release Candidate
- AFTER You Unzip the Release Candidate But BEFORE You Build
- Build
- AFTER the (Successful) Build
- Tips
...
| Anchor | ||||
|---|---|---|---|---|
|
First read How to Review a Release and Vote.
...
- MD5 and SHA Checksum Utility
- Online Difference Checker (for text files)
...
| Anchor | ||||
|---|---|---|---|---|
|
Use the command line interface to verify you have the correct versions of Maven and Java as stated in the README file. Use the following commands to check Maven (mvn) and Java versions.
mvn --version
java --version
...
| Anchor | ||||
|---|---|---|---|---|
|
- Create a temporary directory for the release candidate.
- Open the VOTE email, and click the release candidate link. This will open a web page with four additional links: .zip (the release candidate),.asc (the signature file), .md5 (the md5 hash file), and .sha1 (the sha1 hash file). (See sections 1a and b below for information about signature and hash files.)
- Download the files to your computer by clicking on each of the four links and saving the files to your computer. (You may need to use Ctrl-S to save a text file from the browser to text. Make sure the browser does not append ".txt" to the file.)
Alternatively, you can use wget to download the release candidate. (See Apache Stratos 3.0.0 .0 Test Procedure.) Test Procedure.)
...
| Anchor | ||||
|---|---|---|---|---|
|
1a Check that Checksums are valid
...
gpg --verify 'apache-taverna-...-source-release.zip.asc' 'apache-taverna-...-source-release.zip'
...
| Anchor | ||||
|---|---|---|---|---|
|
2 Check the commit ID matches the VOTE email
...
There may be some "expected" binary files, such as pictures and test workflows. If these come from third-parties (e.g., a Creative Commons-licensed JPEG), they should be declared in NOTICE/LICENSE.
| Anchor | ||||
|---|---|---|---|---|
|
8 Build the release candidate(s) from source
Run mvn clean install
- Successfully complete the verification steps above.
- Use a command line interface and navigate to the folder containing the unzipped release candidate files.
- Execute the command below, which will build the release candidate and save the output to two text files. (The text file names can be anything.) This command will run several Maven goals, including automated tests. Do not skip the automated build tests.
mvn clean install > console.txt 2> err.txt
Review build completion status
BUILD FAILURE: At the completion of the mvn clean install process, if the message is "BUILD FAILURE," review both text files. Report the failure, along with any warning and error messages, on the release candidate's DISCUSS thread.
BUILD SUCCESS: If the completion message is "BUILD SUCCESS," review both text files. Report the success, along with any warning messages, on the release candidate's DISCUSS thread.
| Anchor | ||||
|---|---|---|---|---|
|
9 Check the dependencies
Checking dependencies:
- Make sure dependencies are used and declared properly. (Use mvn dependency:analyze and look for warnings or errors.)
- Determine if there are any mismatches between resolved dependencies and the dependencyManagement section. (Use mvn dependency:analyze-dep-mgt and look for warnings or errors.)
- Generate a list of licenses for each third-party dependency and check the licenses to make sure they meet Apache licensing requirements. (See Review Binary License below.)
- You can create a list of dependencies by module using mvn dependency:list and generate a dependency tree to troubleshoot conflicts using mvn dependency:tree.
Review Binary Licenses.
Create a list of third-party dependencies using the license:aggregate-add-third-party plugin and review the dependency licenses.)
- In a command line interface, change to the top level directory of the distribution (e.g., apache-taverna-language-<version>-incubator).
- Run the following Maven command: mvn license:aggregate-add-third-party. (On Windows, to save the output to a file, add > filename.txt to the end of the command.)
- This command will create THIRD-PARTY.txt files in each target folder (in the generated-sources/license subfolder).
- Review the THIRD-PARTY.txt files for unknown or disallowed licenses. Note: some unknown licenses have been determined to be allowed.) One method is shown below.
cat target/generated-sources/license/THIRD-PARTY.txt | sort
10 Verify the build produces the binaries
Quick check: browse the target folders and make sure there are not any extra folders. (For example, if we are voting on taverna-language there should not be any taverna-engine folders.)
Deeper check: ensure your target folders contains all the same *.jar files as those in the git repo? in the Maven repository? (Example link?)
At least one person should check that all staged JARs are the same as those built from the downloaded release candidate. (One approach is to do a recursive wget of the repository , and then compare the result of "find . -name '*jar'" in the wget-tree with */*/target/*.jar. See StackOverflow response.)
NOTE: Binary releases are considered "convenience only" and are not crucial for the vote: The source release is what everything else should be made from. However, in practical terms most people download the binaries from the Maven repository, so it is important this is checked at least once.
11 Verify all the *.jar files include the word "incubating"
Visually inspect all the *.jar files include the word "incubating" by opening all the /target folders. Is there an easier way to do this?
Are other files supposed to be labeled as well, or is it only the *.jar files?
Anchor tips tips
Tips
| tips | |
| tips |
How to check LICENSE, NOTICE, DISCLAIMER, and similar files?
- Command line: Navigate to directory containing the file and use cat command to print contents to console (Example: cat LICENSE)
- Text Editor/IDE: Use a text editor (e.g., Notepad++) or an integrated development environment (IDE), such as Eclipse, to open the LICENSE, NOTICE, DISCLAIMER, and similar files.
How to capture the output of a command line interface command?
- In a command line interface, send the console output and error messages to a text file:
- GitBash example: mvn clean install > Console.txt 2> Err.txt
- In a command line interface, send the console output and error messages to a text file: