Everything

php

PHP 7.3 timetable

php.internals

Christoph Becker

8 years ago

Hi!

Due to some pending preliminary work, I won't be able to release
7.3.0alpha1 on Thursday.  Unless Stas is willing to tackle the first
alpha, I suggest to postpone the tentative timetable[1] by a week.  I
don't think that would be a problem, since 7.0 - 7.2 had their first
alphas released on the second Thursday of June as well.

Any objections?

[1] <https://wiki.php.net/todo/php73#timetable>

--
Christoph M. Becker

Anatoliy Belsky

8 years ago

On Tue, 2018-06-05 at 15:36 +0200, Christoph M. Becker wrote:

> Hi!
>
> Due to some pending preliminary work, I won't be able to release
> 7.3.0alpha1 on Thursday.  Unless Stas is willing to tackle the first
> alpha, I suggest to postpone the tentative timetable[1] by a week.  I
> don't think that would be a problem, since 7.0 - 7.2 had their first
> alphas released on the second Thursday of June as well.
>

By the pending work, do you mean the yet missing karma, etc. you
mentioned in another thread? If so - actually you still could tag,
write site news, etc. - so most of the things. With the items where
there is no karma yet like uploading to downloads.php.net or mailing a
moderated list could be helped.


Regards

Anatol

Sara Golemon

8 years ago

On Tue, Jun 5, 2018 at 10:26 AM, Anatol Belski <ab@php.net> wrote:

> On Tue, 2018-06-05 at 15:36 +0200, Christoph M. Becker wrote:
>> Due to some pending preliminary work, I won't be able to release
>> 7.3.0alpha1 on Thursday.  Unless Stas is willing to tackle the first
>> alpha, I suggest to postpone the tentative timetable[1] by a week.  I
>> don't think that would be a problem, since 7.0 - 7.2 had their first
>> alphas released on the second Thursday of June as well.
>>
>

On the one hand: Timetables can be pushed, we're not curing cancer here.
On the other, that's what a second RM is for, so let's see what Stas has to say.

> By the pending work, do you mean the yet missing karma, etc. you
> mentioned in another thread? If so - actually you still could tag,
> write site news, etc. - so most of the things. With the items where
> there is no karma yet like uploading to downloads.php.net or mailing a
> moderated list could be helped.
>

Indeed. Joe had key issues recently and due to not having his new key
in place in time we pushed the tarballs out of band, but they still
had his sigs and all the rest.  A rough start, sure.  But alphas are a
great time to make and learn from mistakes. :D

-Sara

Christoph Becker

8 years ago

On 05.06.2018 at 17:10, Sara Golemon wrote:

> On Tue, Jun 5, 2018 at 10:26 AM, Anatol Belski <ab@php.net> wrote:
>
>> On Tue, 2018-06-05 at 15:36 +0200, Christoph M. Becker wrote:
>>
>>> Due to some pending preliminary work, I won't be able to release
>>> 7.3.0alpha1 on Thursday.  Unless Stas is willing to tackle the first
>>> alpha, I suggest to postpone the tentative timetable[1] by a week.  I
>>> don't think that would be a problem, since 7.0 - 7.2 had their first
>>> alphas released on the second Thursday of June as well.
>
> On the one hand: Timetables can be pushed, we're not curing cancer here.
> On the other, that's what a second RM is for, so let's see what Stas has to say.

ACK.

>> By the pending work, do you mean the yet missing karma, etc. you
>> mentioned in another thread? If so - actually you still could tag,
>> write site news, etc. - so most of the things. With the items where
>> there is no karma yet like uploading to downloads.php.net or mailing a
>> moderated list could be helped.
>
> Indeed. Joe had key issues recently and due to not having his new key
> in place in time we pushed the tarballs out of band, but they still
> had his sigs and all the rest.  A rough start, sure.  But alphas are a
> great time to make and learn from mistakes. :D

That's indeed one of the issues.  After quite some struggle, I've just
managed to sign a tag with a quickly generated GPG key.  However, I
still need to create a proper GPG (including generating a revocation
certificate), and of course, the key has to be signed by one or more of
the previous RMs (not sure how that will work).

--
Christoph M. Becker

Anatoliy Belsky

8 years ago

On Tue, 2018-06-05 at 19:14 +0200, Christoph M. Becker wrote:

> On 05.06.2018 at 17:10, Sara Golemon wrote:
>
> > On Tue, Jun 5, 2018 at 10:26 AM, Anatol Belski <ab@php.net> wrote:
> >
> > > On Tue, 2018-06-05 at 15:36 +0200, Christoph M. Becker wrote:
> > >
> > > > Due to some pending preliminary work, I won't be able to
> > > > release
> > > > 7.3.0alpha1 on Thursday.  Unless Stas is willing to tackle the
> > > > first
> > > > alpha, I suggest to postpone the tentative timetable[1] by a
> > > > week.  I
> > > > don't think that would be a problem, since 7.0 - 7.2 had their
> > > > first
> > > > alphas released on the second Thursday of June as well.
> >
> > On the one hand: Timetables can be pushed, we're not curing cancer
> > here.
> > On the other, that's what a second RM is for, so let's see what
> > Stas has to say.
>
> ACK.
>
> > > By the pending work, do you mean the yet missing karma, etc. you
> > > mentioned in another thread? If so - actually you still could
> > > tag,
> > > write site news, etc. - so most of the things. With the items
> > > where
> > > there is no karma yet like uploading to downloads.php.net or
> > > mailing a
> > > moderated list could be helped.
> >
> > Indeed. Joe had key issues recently and due to not having his new
> > key
> > in place in time we pushed the tarballs out of band, but they still
> > had his sigs and all the rest.  A rough start, sure.  But alphas
> > are a
> > great time to make and learn from mistakes. :D
>
> That's indeed one of the issues.  After quite some struggle, I've
> just
> managed to sign a tag with a quickly generated GPG key.  However, I
> still need to create a proper GPG (including generating a revocation
> certificate), and of course, the key has to be signed by one or more
> of
> the previous RMs (not sure how that will work).
>

I haven't seen the tag pushed yet. The signing process is otherwise
described in the doc. You can use any service to excercise before
pushing to the git.php.net, fe github. Usually pgp.mit.edu is used to
publish keys. If you've already published the GPG key you're intended
to use, please send it so we can sign. In further it would be ok to
discuss on the release managers list, also you could ping on IRC if
there's more.

Aller Anfang ist schwer, aber schaffbar :)

Regards

Anatol

Christoph Becker

8 years ago

On 05.06.2018 at 19:53, Anatol Belski wrote:

> I haven't seen the tag pushed yet. The signing process is otherwise
> described in the doc. You can use any service to excercise before
> pushing to the git.php.net, fe github. Usually pgp.mit.edu is used to
> publish keys. If you've already published the GPG key you're intended
> to use, please send it so we can sign.

I've pushed the fingerprint of my GPG key to web-php[1], and also made
it available on pgp.mit.edu[2].  As I understand it, this should be
sufficient to sign it.  Otherwise, please tell me what to do.

> In further it would be ok to
> discuss on the release managers list, also you could ping on IRC if
> there's more.

As far as I know, I'm not yet subscribed to the “release managers list”,
and I have no experience with IRC.  If necessary, I can catch up on
this, but it'll take some time.

> Aller Anfang ist schwer, aber schaffbar :)

Thanks!  I'm quite confident about this. :)

[1]
<https://github.com/php/web-php/commit/2467b8c6b5e879d5af27260fc7dab9af3223a8c0>
[2] <https://pgp.mit.edu/pks/lookup?search=cmb%40php.net&op=index>

--
Christoph M. Becker

Stas Malyshev

8 years ago

Hi!

> I've pushed the fingerprint of my GPG key to web-php[1], and also made
> it available on pgp.mit.edu[2].  As I understand it, this should be
> sufficient to sign it.  Otherwise, please tell me what to do.

Should be enough to start signing packages, I assume.

--
Stas Malyshev
smalyshev@gmail.com

Sara Golemon

8 years ago

On Tue, Jun 5, 2018 at 6:44 PM, Christoph M. Becker <cmbecker69@gmx.de> wrote:

> I've pushed the fingerprint of my GPG key to web-php[1], and also made
> it available on pgp.mit.edu[2].  As I understand it, this should be
> sufficient to sign it.  Otherwise, please tell me what to do.
>

Looks good:

$ gpg --recv-keys 'CBAF 69F1 73A0 FEA4 B537  F470 D66C 9593 118B CCB6'
gpg: key D66C9593118BCCB6: public key "Christoph M. Becker
<cmb@php.net>" imported
gpg: Total number processed: 1
gpg:               imported: 1


However, a certain other 7.3 RM (not naming names), should probably
add his key to the 7.3 section of php.net/gpg-keys
IME, the people who are most hawkishly checking our signatures care
about who's expected to sign a given release. (This is why I'm also
listed under 7.1 RMs)
I can commit a copy from elsewhere in the file, but it should probably
be done by the person who's key it is. :D

> As far as I know, I'm not yet subscribed to the “release managers list”,
> and I have no experience with IRC.  If necessary, I can catch up on
> this, but it'll take some time.
>

Make sure systems@ is poked about that.  You really do need to be on
the distribution list.

-Sara

Anatoliy Belsky

8 years ago

On Wed, 2018-06-06 at 00:44 +0200, Christoph M. Becker wrote:

> On 05.06.2018 at 19:53, Anatol Belski wrote:
>
> > I haven't seen the tag pushed yet. The signing process is otherwise
> > described in the doc. You can use any service to excercise before
> > pushing to the git.php.net, fe github. Usually pgp.mit.edu is used
> > to
> > publish keys. If you've already published the GPG key you're
> > intended
> > to use, please send it so we can sign.
>
> I've pushed the fingerprint of my GPG key to web-php[1], and also
> made
> it available on pgp.mit.edu[2].  As I understand it, this should be
> sufficient to sign it.  Otherwise, please tell me what to do.
>

Looks fine. I've also signed your key now.

A thought aside - it could be an idea for us to make a key signing
party sometime.

> > In further it would be ok to
> > discuss on the release managers list, also you could ping on IRC if
> > there's more.
>
> As far as I know, I'm not yet subscribed to the “release managers
> list”,
> and I have no experience with IRC.  If necessary, I can catch up on
> this, but it'll take some time.
>

IRC is not necessary, just some people are to find there and you can
ask some quick question.

Regards

Anatol

Stas Malyshev

8 years ago

Hi!

> Due to some pending preliminary work, I won't be able to release
> 7.3.0alpha1 on Thursday.  Unless Stas is willing to tackle the first
> alpha, I suggest to postpone the tentative timetable[1] by a week.  I
> don't think that would be a problem, since 7.0 - 7.2 had their first
> alphas released on the second Thursday of June as well.

Ah, it's that time already. I could try to build it (haven't done it for
a while, so my setup could be a little rusty) and see if it works by
Thursday, then I'll publish it. If not, then we can take a week delay,
it's not a huge deal.

--
Stas Malyshev
smalyshev@gmail.com

Christoph Becker

8 years ago

On 05.06.2018 at 20:55, Stanislav Malyshev wrote:

>> Due to some pending preliminary work, I won't be able to release
>> 7.3.0alpha1 on Thursday.  Unless Stas is willing to tackle the first
>> alpha, I suggest to postpone the tentative timetable[1] by a week.  I
>> don't think that would be a problem, since 7.0 - 7.2 had their first
>> alphas released on the second Thursday of June as well.
>
> Ah, it's that time already. I could try to build it (haven't done it for
> a while, so my setup could be a little rusty) and see if it works by
> Thursday, then I'll publish it. If not, then we can take a week delay,
> it's not a huge deal.

Thanks, Stas!  I shall catch up with my pending issues soon.

--
Christoph M. Becker