[
https://issues.apache.org/jira/browse/CASSANDRA-17748?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Michael Semb Wever updated CASSANDRA-17748:
-------------------------------------------
Description:
Move our official debian and redhat repositories from downloads.apache.org to
Apache's JFrog Artifactory server at apache.jfrog.io
That is, the following URLs would be moved from
```
https://downloads.apache.org/cassandra/debian/
https://downloads.apache.org/cassandra/redhat/
```
to
```
https://apache.jfrog.io/ui/native/cassandra-deb/
https://apache.jfrog.io/ui/native/cassandra-rpm/
```
The rationale to do this is to avoid the strict opinionated checksum and
signature requirements on downloads.a.o (dist.a.o), as the debian and redhat
repositories have their own system for integrity and signing (which we already
do).
Furthermore, as these repositories and their binaries are "convenience
binaries" and not the official Cassandra source binaries, they do not need to
be on downloads.a.o and can be served from apache.jfrog.io. This is similar to
maven binaries (and docker images). Apache Arrow is already taking this
approach: https://arrow.apache.org/install/
An advantage to using apache.frog.io is that these repositories maintain all
past patch versions on each repo series (major/minor). This has been requested
by users a number of times, for the sake of rolling back to a previous patch
version. downloads.a.o can only contain the latest version.
This will BREAK everyone's existing
`/etc/apt/sources.list.d/cassandra.sources.list` and
`/etc/yum.repos.d/cassandra.repo` files. Folk will need to update these files
to point to the new repo URLs. This would require an announcement to both
users@ and dev@. I do not know how we can avoid this breakage. We could put in
a simple README.md in the original URL locations explaining the breakage and
how to fix.
was:
Move our official debian and redhat repositories from downloads.apache.org to
Apache's JFrog Artifactory server at apache.jfrog.io
That is, the following URLs would be moved from
```
https://downloads.apache.org/cassandra/debian/
https://downloads.apache.org/cassandra/redhat/
```
to
```
https://apache.jfrog.io/artifactory/cassandra-deb/
https://apache.jfrog.io/artifactory/cassandra-rpm/
```
The rationale to do this is to avoid the strict opinionated checksum and
signature requirements on downloads.a.o (dist.a.o), as the debian and redhat
repositories have their own system for integrity and signing (which we already
do).
Furthermore, as these repositories and their binaries are "convenience
binaries" and not the official Cassandra source binaries, they do not need to
be on downloads.a.o and can be served from apache.jfrog.io. This is similar to
maven binaries (and docker images). Apache Arrow is already taking this
approach: https://arrow.apache.org/install/
An advantage to using apache.frog.io is that these repositories maintain all
past patch versions on each repo series (major/minor). This has been requested
by users a number of times, for the sake of rolling back to a previous patch
version. downloads.a.o can only contain the latest version.
This will BREAK everyone's existing
`/etc/apt/sources.list.d/cassandra.sources.list` and
`/etc/yum.repos.d/cassandra.repo` files. Folk will need to update these files
to point to the new repo URLs. This would require an announcement to both
users@ and dev@. I do not know how we can avoid this breakage. We could put in
a simple README.md in the original URL locations explaining the breakage and
how to fix.
> Move deb/rpm repositories from dist/downloads .a.o to apache.jfrog.io
> ---------------------------------------------------------------------
>
> Key: CASSANDRA-17748
> URL: https://issues.apache.org/jira/browse/CASSANDRA-17748
> Project: Cassandra
> Issue Type: Task
> Components: Packaging
> Reporter: Michael Semb Wever
> Assignee: Michael Semb Wever
> Priority: Urgent
>
> Move our official debian and redhat repositories from downloads.apache.org to
> Apache's JFrog Artifactory server at apache.jfrog.io
> That is, the following URLs would be moved from
> ```
> https://downloads.apache.org/cassandra/debian/
> https://downloads.apache.org/cassandra/redhat/
> ```
> to
> ```
> https://apache.jfrog.io/ui/native/cassandra-deb/
> https://apache.jfrog.io/ui/native/cassandra-rpm/
> ```
> The rationale to do this is to avoid the strict opinionated checksum and
> signature requirements on downloads.a.o (dist.a.o), as the debian and redhat
> repositories have their own system for integrity and signing (which we
> already do).
> Furthermore, as these repositories and their binaries are "convenience
> binaries" and not the official Cassandra source binaries, they do not need to
> be on downloads.a.o and can be served from apache.jfrog.io. This is similar
> to maven binaries (and docker images). Apache Arrow is already taking this
> approach: https://arrow.apache.org/install/
> An advantage to using apache.frog.io is that these repositories maintain all
> past patch versions on each repo series (major/minor). This has been
> requested by users a number of times, for the sake of rolling back to a
> previous patch version. downloads.a.o can only contain the latest version.
> This will BREAK everyone's existing
> `/etc/apt/sources.list.d/cassandra.sources.list` and
> `/etc/yum.repos.d/cassandra.repo` files. Folk will need to update these files
> to point to the new repo URLs. This would require an announcement to both
> users@ and dev@. I do not know how we can avoid this breakage. We could put
> in a simple README.md in the original URL locations explaining the breakage
> and how to fix.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
