Signature issues on Sonatype OSS
2 views
Skip to first unread message
Harald Wellmann
Sep 23, 2013, 10:51:20 AM9/23/13
to ops4j...@googlegroups.com
FYI here is some news from Joel Orlina (Sonatype) regarding the broken releases.
Does anybody know any details about this OBR shadow repository he
mentions? Is anybody using it...?
Best regards,
Harald
===
We ran into some instability on OSSRH over the weekend, which may have
been related to your attempts to release orgops4j-1026 and -1028. It
appears that there's an OBR shadow repository set up for your
releases. Do you know if you're actively using that shadow
repository? I've had to temporarily disable that repo per the
recommendation of our Nexus dev team, who are actively diagnosing the
instability issues.
As far as your artifacts go, if you can confirm for me that you're
happy with the artifacts in those staging repositories, I can manually
release them for you and make sure that they propagate all the way to
Central. If you can, please refrain from trying to release those
repos yourself. There was a lot of commentary over the weekend on
OSSRH-5675, that talks about signature issues at close/release time
being transient and resolve-able simply by trying the close/release
multiple times. I fear that if you try to release your repos, you may
trigger the same instability that happened over the weekend, which
could result in an OSSRH outage.
At this point we're looking at the OBR shadow repository as the
culprit for the weekend instability, but, it's possible that this may
have been related to your signature validation errors as well. I'll
pass along what our Nexus developers find out.
Does anybody know any details about this OBR shadow repository he
mentions? Is anybody using it...?
Best regards,
Harald
===
We ran into some instability on OSSRH over the weekend, which may have
been related to your attempts to release orgops4j-1026 and -1028. It
appears that there's an OBR shadow repository set up for your
releases. Do you know if you're actively using that shadow
repository? I've had to temporarily disable that repo per the
recommendation of our Nexus dev team, who are actively diagnosing the
instability issues.
As far as your artifacts go, if you can confirm for me that you're
happy with the artifacts in those staging repositories, I can manually
release them for you and make sure that they propagate all the way to
Central. If you can, please refrain from trying to release those
repos yourself. There was a lot of commentary over the weekend on
OSSRH-5675, that talks about signature issues at close/release time
being transient and resolve-able simply by trying the close/release
multiple times. I fear that if you try to release your repos, you may
trigger the same instability that happened over the weekend, which
could result in an OSSRH outage.
At this point we're looking at the OBR shadow repository as the
culprit for the weekend instability, but, it's possible that this may
have been related to your signature validation errors as well. I'll
pass along what our Nexus developers find out.
Achim Nierbeck
Sep 23, 2013, 3:09:58 PM9/23/13
to ops4j...@googlegroups.com
Hi Harald,
I think this might be related to something Alin had mentioned in the past.
He worked on something for Sonatype to have automagic osgi bundles creations.
So this might well be that it is related.
But this is just a wild guess glueing some informations together from the top of my head :)
regards, Achim
--
You received this message because you are subscribed to the Google Groups "OPS4J Infrastructure" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ops4j-infra...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
Apache Karaf <http://karaf.apache.org/> Committer & PMC
OPS4J Pax Web <http://wiki.ops4j.org/display/paxweb/Pax+Web/> Committer & Project Lead
OPS4J Pax for Vaadin <http://team.ops4j.org/wiki/display/PAXVAADIN/Home> Commiter & Project Lead
blog <http://notizblog.nierbeck.de/>
Reply all
Reply to author
Forward
0 new messages