search

scala / scala-dev

Scala 2 team issues. Not for user-facing bugs or directly actionable user-facing improvements. For build/test/infra and for longer-term planning and idea tracking. Our bug tracker is at https://github.com/scala/bug/issues
Apache License 2.0
130 stars 14 forks source link

Release 2.12.15 #783

Closed SethTisue closed 3 years ago

SethTisue commented 3 years ago 
SCALA_VER_BASE="2.12.15"
SCALA_VER_SUFFIX=""
SCALA_SHA=96a666989b6bee067b1029553c6684ef1cb6f6b1
DIST_SHA=72e412c54705d343a892282a0f80dc0eb69767a5
SCALA_VER="$SCALA_VER_BASE$SCALA_VER_SUFFIX"

Key links:

N weeks before the release

Release announcement / notes

N days before release

SethTisue commented 3 years ago

Point of no return

Once sufficient time has passed since last merged PR, it's time to cut the release!

How long we wait depends on what kind of release it is. For a major release, it might be 1-2 weeks, to give core projects time to try out the preceding release candidate and/or the current candidate nightly. For point releases, assuming we've given the community ahead-of-time warning and kept them appraised of progress on the Discourse thread, and assuming the last changes merged seem sufficiently safe, we might build the next day.

Be mindful of others' schedules; even minor releases make work downstream (for Scala.js and Scala Native, for the Scala 3 team, for compiler plugin authors, and so on). It's better not to release on Friday or before a holiday.

Check availability

When everything is on maven central

Modules

Announcements

Afterwards

SethTisue commented 3 years ago

publishing failed, some Sonatype problem that isn't obvious to me. I'll investigate, but it's no longer feasible to publish this week. hopefully next week

SethTisue commented 3 years ago

the failed build on Sep 1: https://app.travis-ci.com/github/scala/scala/jobs/535138405

the error:

[error] java.net.ProtocolException: Server redirected too many  times (20)
[error]     at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
[error]     at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
...
[error]     at sbt.internal.librarymanagement.IvyActions$.publish(IvyActions.scala:501)

successful 2.12.14 publishing run, for comparison: https://app.travis-ci.com/github/scala/scala/jobs/508816266

for diffing purposes, it helps to pipe the raw logs through gsed 's/\x1b\[[0-9;]*m//g' | grep -v ^travis_time:

but actually the diffs don't give any clues. maybe I need to run with sbt -debug

this is pretty rough to troubleshoot since the build takes so long. it's tempting to try to publish from my local machine instead (without having to rebuild everything every time) and hope to learn something from that -- though that won't help if the problem has to do with the encrypted secrets on Travis-CI

SethTisue commented 3 years ago

note that I published scala-async from Travis-CI last week and that went fine, so there isn't an org-wide issue

note that since 2.12.14, we upgraded from sbt 1.3.13 to 1.5.5 as part of an effort to backport build changes from 2.13 to 2.12

perhaps I should do a trial run of the 2.13.7 release (and drop the staging repos, of course!) to see if the same problem occurs there

another possible source of clues is to re-run the 2.12.14 and/or 2.13.6 releases and see if they succeed (and then drop the staging repos)

SethTisue commented 3 years ago

another end to approach this from is "what could cause this error?"

at https://github.com/xerial/sbt-sonatype/issues/214 someone got the same error because of oss.sonatype.org vs s01.oss.sonatype.org, but we're publishing from a longstanding Sonatype account and not a recently created one, so oss.sonatype.org should still be right. and anyway the 2.12.14 release was in May 2021 which is after Sonatype started expecting new accounts to use the new host (in February 2021)

at https://github.com/sbt/sbt-pgp/issues/182 someone got the same error simply because they were using wrong credentials. if we were setting up publishing in the scala/scala repo for the first time, wrong credentials is the first explanation I'd consider, but in this case, we know that everything was set up right before, so how could it be wrong now? regardless, maybe I need to accept that it's somehow a wrong-credentials problem and set the credentials up again

I think the next thing I'll try is a dry run of 2.13.7 publishing, since that will tell us if the problem is repo-wide or is somehow specific to the 2.12.x branch

SethTisue commented 3 years ago

2.13.x build triggered with before_script: export SCALA_VER_BASE=2.13.7 SCALA_VER_SUFFIX=-M1 at https://app.travis-ci.com/github/scala/scala/builds/237558813

(but it might take a while because we're now down to only one concurrent Travis-CI job in scala/* and a PR validation job is running)

SethTisue commented 3 years ago

~OMG might this just be https://github.com/scala/scala-dev/issues/764 ...? I HOPE SO~

~it seems like a distant hope since the symptoms here aren't the same as those at https://github.com/scala/scala-dev/issues/762 , but regardless: scala/scala#9758~

UPDATE: never mind

SethTisue commented 3 years ago

2.13.x build triggered [...]

It failed with the same error as we're getting on 2.12.x. That narrows down the possible causes — we no longer need to consider 2.12-specific causes. I'm not sure whether that's good news or bad news :-), but I guess any narrowing is good 🤷

SethTisue commented 3 years ago

Now that we know both 2.12 and 2.13 are broken, I'm contemplating just replacing the publishing secrets and hope that helps. (Before, I was afraid to do that for fear of breaking 2.13 too.)

I don't know enough about PGP stuff to know whether it's plausible that we're using an expired key or something like that.

SethTisue commented 3 years ago

I reviewed the diffs on 2.13.x since v2.13.6, and https://github.com/scala/scala/pull/9658 stood out as a plausible culprit. (Jason also suggested at team meeting today that this PR might be relevant.)

9658 was backported to 2.12.x (https://github.com/scala/scala/pull/9659), so that's consistent with both branches being broken.

I think I'll try simply reverting the 2.12.x backport and hope that allows us to get 2.12.15 out the door. Then with that done, we can slow down and try and understand what went wrong, in time for 2.13.7.

SethTisue commented 3 years ago

pushed the reversion to a test-revert-9659 branch and kicked off https://app.travis-ci.com/github/scala/scala/builds/237568849 with before_script: export SCALA_VER_BASE=2.12.15 SCALA_VER_SUFFIX=-M1

SethTisue commented 3 years ago

gah that didn't help 🙀

maybe the credentials really are expired/bad somehow

SethTisue commented 3 years ago

this seems suspicious:

$ (cd admin && ./init.sh)
/home/travis/.gnupg/pubring.gpg
-------------------------------
pub   4096R/6D92E560 2018-02-13 [expired: 2020-02-13]
uid                  Scala Project <security@scala-lang.org>

/home/travis/.gnupg/secring.gpg
-------------------------------
sec#  4096R/6D92E560 2018-02-13 [expires: 2020-02-13]
uid                  Scala Project <security@scala-lang.org>
ssb   4096R/D692BCFF 2018-02-14

but if expires: 2020-02-13 were a problem, surely that would have caused release failures last year, not this year? the same thing appears in the successful 2.12.14 log

and anyway if it was a GPG key problem we'd get some other kind of error, I think

SethTisue commented 3 years ago

https://app.travis-ci.com/github/scala/scala/builds/237577842 is a re-run of the 2.13.6 publishing and fails the same way

plus I had already done a similar 2.12.x experiment at https://app.travis-ci.com/github/scala/scala/jobs/535148973 (I don't recall how I picked the commit I used, but it was around 2.12.14 release time) with the same result

so it looks like I can stop groveling around trying to identify what commit or pull request is the culprit and just redo the secrets... though I still wish I had a theory about what changed to make this stop working, since if I redo the secrets and it still doesn't work we'll still be right on square one

SethTisue commented 3 years ago

We have secrets in two places: in the Travis-CI web UI, and in .travis.yml itself

The ones in the Travis-CI web UI are encrypted_40abf89dbafd_iv and encrypted_40abf89dbafd_iv and I think they have to do with publishing the spec? Not sure. (But I really doubt these are in play here.)

In .travis.yml we have:

afaics only SONA_* are relevant here.

I don't know whether they were set up to use the lamp username or password, or that account's API token (the "username" and "password" of the token are accessible, if you know the account password, via the Sonatype web UI). I always use the token when setting up module publishing (as per advice in sbt-ci-release readme), so I guess I'll use that here as well.

SethTisue commented 3 years ago

redid the secrets (following https://docs.travis-ci.com/user/encryption-keys/) as follows:

pushed to redo-secrets branch and triggered https://app.travis-ci.com/github/scala/scala/jobs/537206661

at the top of the log I see this, as expected:

$ export SONA_USER=[secure]
$ export SONA_PASS=[secure]

20 minutes later:

Closed sonatype staging repos:
https://oss.sonatype.org/content/repositories/orgscala-lang-2824
https://oss.sonatype.org/content/repositories/orgscala-lang-2825
https://oss.sonatype.org/content/repositories/orgscala-lang-2826
https://oss.sonatype.org/content/repositories/orgscala-lang-2827.

🎉

and I shall not throw my laptop into the sea after all.... not today, anyway

SethTisue commented 3 years ago

I dropped the staging repos. I'll re-run this after merging https://github.com/scala/scala/pull/9759 . (Maybe it's paranoia talking, but I feel more comfortable having the real release come from an actual merge commit on the 2.12.x branch.)