[
https://issues.apache.org/jira/browse/CASSANDRA-17748?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17578553#comment-17578553
]
Michael Semb Wever commented on CASSANDRA-17748:
------------------------------------------------
The following patches are ready for review:
- [cassandra-website|https://github.com/apache/cassandra-website/pull/153]
- [cassandra-release|https://github.com/apache/cassandra-builds/pull/79]
-
[3.11|https://github.com/apache/cassandra/compare/cassandra-3.11...thelastpickle:cassandra:mck/17748/3.11]
-
[4.0|https://github.com/apache/cassandra/compare/cassandra-4.0...thelastpickle:cassandra:mck/17748/4.0]
-
[4.1|https://github.com/apache/cassandra/compare/cassandra-4.1...thelastpickle:cassandra:mck/17748/4.1]
-
[trunk|https://github.com/apache/cassandra/compare/trunk...thelastpickle:cassandra:mck/17748/trunk]
In addition, the following is the draft email to post to
[email protected]
```
[PROPOSAL] Moving deb/rpm repositories from downloads.apache.org to
apache.jfrog.io
The proposal is to move our official debian and redhat repositories from
downloads.apache.org to Apache's JFrog Artifactory server at apache.jfrog.io ,
fronting it with the url aliases debian.cassandra.apache.org and
redhat.cassandra.apache.org
That is to replace the following URLs
fromhttps://downloads.apache.org/cassandra/debian/
https://downloads.apache.org/cassandra/redhat/
tohttps://debian.cassandra.apache.org
https://redhat.cassandra.apache.org
(which in turn redirect to our jfrog repositories
at)https://apache.jfrog.io/artifactory/cassandra-deb
https://apache.jfrog.io/artifactory/cassandra-rpm
The rationale to do this is to avoid the strict checksum and signature
requirements on downloads.a.o (which is the same as dist.a.o), as the debian
and redhat repositories have their own system for integrity and signing (which
we already do).
These repositories and their binaries are "convenience binaries" and not the
official Cassandra source binaries, so they do not need to be on downloads.a.o
and can be served from apache.jfrog.io. This is similar to maven binaries (and
docker images).
This will BREAK everyone's existing
`/etc/apt/sources.list.d/cassandra.sources.list` and
`/etc/yum.repos.d/cassandra.repo` files. Folk will need to update these files
to point to the new repo URLs.
The plan is to do the following to ensure people are informed about this
breaking change: - announcement to both users@ and dev@ - README.md in the
original URL locations explaining the breakage and how to fix. (The README.md
must be voted on, signed and checksummed), - A warning banner on our website
downloads page, - Every release email for the next 12 months will contain the
warning.
background: https://issues.apache.org/jira/browse/CASSANDRA-17748
```
> Move deb/rpm repositories from dist/downloads .a.o to apache.jfrog.io
> ---------------------------------------------------------------------
>
> Key: CASSANDRA-17748
> URL: https://issues.apache.org/jira/browse/CASSANDRA-17748
> Project: Cassandra
> Issue Type: Task
> Components: Packaging
> Reporter: Michael Semb Wever
> Assignee: Michael Semb Wever
> Priority: Urgent
> Labels: pull-request-available
>
> Move our official debian and redhat repositories from downloads.apache.org to
> Apache's JFrog Artifactory server at apache.jfrog.io
> That is, the following URLs would be moved from
> ```
> https://downloads.apache.org/cassandra/debian/
> https://downloads.apache.org/cassandra/redhat/
> ```
> to
> ```
> https://apache.jfrog.io/artifactory/cassandra-deb/
> https://apache.jfrog.io/artifactory/cassandra-rpm/
> ```
> The rationale to do this is to avoid the strict opinionated checksum and
> signature requirements on downloads.a.o (dist.a.o), as the debian and redhat
> repositories have their own system for integrity and signing (which we
> already do).
> Furthermore, as these repositories and their binaries are "convenience
> binaries" and not the official Cassandra source binaries, they do not need to
> be on downloads.a.o and can be served from apache.jfrog.io. This is similar
> to maven binaries (and docker images). Apache Arrow is already taking this
> approach: https://arrow.apache.org/install/
> An advantage to using apache.frog.io is that these repositories maintain all
> past patch versions on each repo series (major/minor). This has been
> requested by users a number of times, for the sake of rolling back to a
> previous patch version. downloads.a.o can only contain the latest version.
> This will BREAK everyone's existing
> `/etc/apt/sources.list.d/cassandra.sources.list` and
> `/etc/yum.repos.d/cassandra.repo` files. Folk will need to update these files
> to point to the new repo URLs. This would require an announcement to both
> users@ and dev@. I do not know how we can avoid this breakage. We could put
> in a simple README.md in the original URL locations explaining the breakage
> and how to fix.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
