Re: Signing releases using automated release infra

[Francis Chuang]

Is infra happy to explore the case where release artifacts are automatically 
uploaded via CI?

This would go a long way towards automating our release process as asking RMs 
to download the release artifacts from GitHub and uploading them manually is a 
bit clunky.

On 2023/07/18 19:55:00 Volkan Yazıcı wrote:
> Abstract: Signing release artifacts using an automated release
> infrastructure has been officially approved by LEGAL. This enables
> projects to sign artifacts using, say, GitHub Actions.
> 
> I have been trying to overhaul the Log4j release process and make it
> as frictionless as possible since last year. As a part of that effort,
> I wanted to sign artifacts in CI during deployment and in a
> `members@a.o` thread[0] I explained how one can do that securely with
> the help of Infra. That was in December 2022. It has been a long,
> rough journey, but we succeeded. In this PR[1], Legal has updated the
> release policy to reflect that this process is officially allowed.
> Further, Infra put together guides[2][3] to assist projects. Logging
> Services PMC has already successfully performed 4 Log4j Tools releases
> using this approach, see its release process[4] for a demonstration.
> 
> [0] (members only!)
> https://lists.apache.org/thread/1o12mkjrhyl45f9pof94pskg55vhs61n
> [1] https://github.com/apache/www-site/pull/235
> [2] https://infra.apache.org/release-publishing.html#signing
> [3] https://infra.apache.org/release-signing.html#automated-release-signing
> [4] https://github.com/apache/logging-log4j-tools/blob/master/RELEASING.adoc
> 
> # F.A.Q.
> 
> ## Why shall a project be interested in this?
> 
> It greatly simplifies the release process. See Log4j Tools release
> process[4], probably the simplest among all Java-based ASF projects.
> 
> ## How can a project get started?
> 
> 1. Make sure your project builds are reproducible (otherwise there is
> no way PMC can verify the integrity of CI-produced and -signed
> artifacts)
> 2. Clone and adapt INFRA-23996 (GPG keys in GitHub secrets)
> 3. Clone and adapt INFRA-23974 (Nexus creds. in GitHub secrets for
> snapshot deployments)
> 4. Clone and adapt INFRA-24051 (Nexus creds. in GitHub secrets for
> staging deployments)
> 
> You might also want to check this[5] GitHub Action workflow for inspiration.
> 
> [5] 
> https://github.com/apache/logging-log4j-tools/blob/master/.github/workflows/build.yml
> 
> ## Does the "automated release infrastructure" (CI) perform the full release?
> 
> No. CI *only* uploads signed artifacts to Nexus. The release manager
> (RM) still needs to copy the CI-generated files to SVN, PMC needs to
> vote, and, upon consensus, RM needs to "close" the release in Nexus
> and so on.
> 
> -
> To unsubscribe, e-mail: dev-unsubscr...@community.apache.org
> For additional commands, e-mail: dev-h...@community.apache.org
> 
> 

-
To unsubscribe, e-mail: dev-unsubscr...@community.apache.org
For additional commands, e-mail: dev-h...@community.apache.org

Re: Regarding the Apache Committee Report Helper Website

[Francis Chuang]

I just checked for Calcite and the only stats missing for us is JIRA 
activity. We have stats for everything else.


Sheng Wu also raised this issue earlier today: 
https://lists.apache.org/thread/2jn0m17276ny0l297nj5vfxtjsoksnz6


I think there might be an issue with Whimsy's data collection.

Francis

On 31/03/2024 7:33 pm, William H. wrote:

Hello,

Hope you are having a great Easter weekend.

I am the Chair of Apache ORC and I was met with an error in the 
statistics section of the report helper website 
(https://reporter.apache.org/wizard/ 
) where it displayed the activity 
data for Jira, Commit, and GitHub as 0 for the past quarter when it 
shouldn't have. I was wondering if this is something that can be fixed. 
I have attached what it looks like below. Thank you in advance for your 
help.


Bests,
William Hyun

Screenshot 2024-03-31 at 4.14.42 AM.png


-
To unsubscribe, e-mail: dev-unsubscr...@community.apache.org
For additional commands, e-mail: dev-h...@community.apache.org

[jira] [Created] (COMDEV-318) Suddenly unable to add release: Not part of the PMC group

[Francis Chuang (JIRA)]

Francis Chuang created COMDEV-318:
-

 Summary: Suddenly unable to add release: Not part of the PMC group
 Key: COMDEV-318
 URL: https://issues.apache.org/jira/browse/COMDEV-318
 Project: Community Development
  Issue Type: Bug
  Components: Reporter Tool
Reporter: Francis Chuang


I am trying to add a release for avatica 1.14.0 (part of the Calcite project) 
using the reporter tool.

I am using the tool at [https://reporter.apache.org/addrelease.html?calcite]

When trying to add a release, I receive the following error:
{code:java}
Could not save. Make sure you have filled out all fields and have access to 
this committee data! For further inquiries, please contact 
dev@community.apache.org Error: User francischuang not a member of PMC calcite 
nor an ASF member{code}
In the past, I have added releases successfully. I have also checked 
[https://whimsy.apache.org/roster/committee/calcite] and I am listed under the 
PMC group as the chair.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

-
To unsubscribe, e-mail: dev-unsubscr...@community.apache.org
For additional commands, e-mail: dev-h...@community.apache.org

[jira] [Commented] (COMDEV-318) Suddenly unable to add release: Not part of the PMC group

[Francis Chuang (JIRA)]

[ 
https://issues.apache.org/jira/browse/COMDEV-318?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16829144#comment-16829144
 ] 

Francis Chuang commented on COMDEV-318:
---

Thanks, [~s...@apache.org]! It works!

> Suddenly unable to add release: Not part of the PMC group
> -
>
> Key: COMDEV-318
> URL: https://issues.apache.org/jira/browse/COMDEV-318
> Project: Community Development
>  Issue Type: Bug
>  Components: Reporter Tool
>    Reporter: Francis Chuang
>Assignee: Sebb
>Priority: Major
>
> I am trying to add a release for avatica 1.14.0 (part of the Calcite project) 
> using the reporter tool.
> I am using the tool at [https://reporter.apache.org/addrelease.html?calcite]
> When trying to add a release, I receive the following error:
> {code:java}
> Could not save. Make sure you have filled out all fields and have access to 
> this committee data! For further inquiries, please contact 
> dev@community.apache.org Error: User francischuang not a member of PMC 
> calcite nor an ASF member{code}
> In the past, I have added releases successfully. I have also checked 
> [https://whimsy.apache.org/roster/committee/calcite] and I am listed under 
> the PMC group as the chair.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

-
To unsubscribe, e-mail: dev-unsubscr...@community.apache.org
For additional commands, e-mail: dev-h...@community.apache.org

[jira] [Resolved] (COMDEV-318) Suddenly unable to add release: Not part of the PMC group

[Francis Chuang (JIRA)]

 [ 
https://issues.apache.org/jira/browse/COMDEV-318?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Francis Chuang resolved COMDEV-318.
---
Resolution: Fixed

> Suddenly unable to add release: Not part of the PMC group
> -
>
> Key: COMDEV-318
> URL: https://issues.apache.org/jira/browse/COMDEV-318
> Project: Community Development
>  Issue Type: Bug
>  Components: Reporter Tool
>        Reporter: Francis Chuang
>Assignee: Sebb
>Priority: Major
>
> I am trying to add a release for avatica 1.14.0 (part of the Calcite project) 
> using the reporter tool.
> I am using the tool at [https://reporter.apache.org/addrelease.html?calcite]
> When trying to add a release, I receive the following error:
> {code:java}
> Could not save. Make sure you have filled out all fields and have access to 
> this committee data! For further inquiries, please contact 
> dev@community.apache.org Error: User francischuang not a member of PMC 
> calcite nor an ASF member{code}
> In the past, I have added releases successfully. I have also checked 
> [https://whimsy.apache.org/roster/committee/calcite] and I am listed under 
> the PMC group as the chair.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

-
To unsubscribe, e-mail: dev-unsubscr...@community.apache.org
For additional commands, e-mail: dev-h...@community.apache.org