- signatures and checksums match - source builds - apache rat passes +1
Below are the linux commands I used to verify the release of the myfaces-core-assembly-2.2.8-src files: ============================================= wget https://repository.apache.org/content/repositories/orgapachemyfaces-1051/org/apache/myfaces/core/myfaces-core-assembly/2.2.8/myfaces-core-assembly-2.2.8-src.tar.gz wget https://repository.apache.org/content/repositories/orgapachemyfaces-1051/org/apache/myfaces/core/myfaces-core-assembly/2.2.8/myfaces-core-assembly-2.2.8-src.tar.gz.asc wget https://repository.apache.org/content/repositories/orgapachemyfaces-1051/org/apache/myfaces/core/myfaces-core-assembly/2.2.8/myfaces-core-assembly-2.2.8-src.tar.gz.md5 wget https://repository.apache.org/content/repositories/orgapachemyfaces-1051/org/apache/myfaces/core/myfaces-core-assembly/2.2.8/myfaces-core-assembly-2.2.8-src.tar.gz.sha1 wget https://repository.apache.org/content/repositories/orgapachemyfaces-1051/org/apache/myfaces/core/myfaces-core-assembly/2.2.8/myfaces-core-assembly-2.2.8-src.zip wget https://repository.apache.org/content/repositories/orgapachemyfaces-1051/org/apache/myfaces/core/myfaces-core-assembly/2.2.8/myfaces-core-assembly-2.2.8-src.zip.asc wget https://repository.apache.org/content/repositories/orgapachemyfaces-1051/org/apache/myfaces/core/myfaces-core-assembly/2.2.8/myfaces-core-assembly-2.2.8-src.zip.md5 wget https://repository.apache.org/content/repositories/orgapachemyfaces-1051/org/apache/myfaces/core/myfaces-core-assembly/2.2.8/myfaces-core-assembly-2.2.8-src.zip.sha1 # check checksums find . -name '*.md5' -exec cat {} \; -printf ' %f\n' | sed 's|\.md5$||' | md5sum -c find . -name '*.sha1' -exec cat {} \; -printf ' %f\n' | sed 's|\.sha1$||' | sha1sum -c # check signatures wget http://www.apache.org/dist/myfaces/KEYS gpg --import KEYS find . -name '*.asc' -exec gpg --verify {} \; # verify tar.gz and zip sources are identical mkdir src cd src tar xvf ../myfaces-core-assembly-2.2.8-src.tar.gz mv myfaces-core-2.2.8-src/ myfaces-core-2.2.8-src-tar-gz unzip ../myfaces-core-assembly-2.2.8-src.zip # should be no output diff -rq myfaces-core-2.2.8-src* # should be "are identical" output diff -srq myfaces-core-2.2.8-src* # build source cd myfaces-core-2.2.8-src/src find \( -name '*.jar' -o -name '*.zip' \) -exec unzip -n {} \; cd myfaces-core-module-2.2.8/ mvn install mvn apache-rat:check # To check for all errors, if more than one project is affected # mvn apache-rat:check -Drat.numUnapprovedLicenses=9999 # To see details of rat failure, including location of rat report # mvn -e -X apache-rat:check On Tue, Apr 7, 2015 at 3:35 PM, Leonardo Uribe <[email protected]> wrote: > +1 > > 2015-04-07 14:35 GMT-05:00 Leonardo Uribe <[email protected]>: >> Hi, >> >> I was running the needed tasks to get the 2.2.8 release of Apache >> MyFaces core out. >> >> The artifacts passed the TCK test of Feb 2013 (jsftck-2.2_26-Feb-2013.zip). >> >> Please note that this vote concerns all of the following parts: >> 1. Maven artifact group "org.apache.myfaces.shared" v4.2.6 [1] >> 2. Maven artifact group "org.apache.myfaces.core" v2.2.8 [1] >> >> The artifacts were deployed on nexus repo [1] and to my private >> Apache account [3] for binary and source packages. >> >> The release notes could be found at [4]. >> >> Also the clirr test does not show binary incompatibilities with myfaces-api. >> >> Please take a look at the "2.2.8" artifacts and vote! >> >> Please note: This vote is "majority approval" with a minimum of three >> +1 votes (see [3]). >> >> ------------------------------------------------ >> [ ] +1 for community members who have reviewed the bits >> [ ] +0 >> [ ] -1 for fatal flaws that should cause these bits not to be released, >> and why.............. >> ------------------------------------------------ >> >> Thanks, >> Leonardo Uribe >> >> [1] >> https://repository.apache.org/content/repositories/orgapachemyfaces-1051/org/apache/myfaces/ >> [2] http://www.apache.org/foundation/voting.html#ReleaseVotes >> [3] http://people.apache.org/~lu4242/myfaces228binsrc >> [4] >> https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=10600&version=12329267
