[
https://issues.apache.org/jira/browse/CASSANDRA-17748?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17764174#comment-17764174
]
Michael Semb Wever commented on CASSANDRA-17748:
------------------------------------------------
[~xgerman42], if you can get these efforts upstreamed we would consider that.
> Move deb/rpm repositories from dist/downloads .a.o to apache.jfrog.io
> ---------------------------------------------------------------------
>
> Key: CASSANDRA-17748
> URL: https://issues.apache.org/jira/browse/CASSANDRA-17748
> Project: Cassandra
> Issue Type: Task
> Components: Packaging
> Reporter: Michael Semb Wever
> Assignee: Michael Semb Wever
> Priority: Urgent
> Labels: pull-request-available
> Fix For: 3.11.14, 4.0.6, 4.1-beta1, 4.1, 5.0, 5.0-alpha1
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Move our official debian and redhat repositories from downloads.apache.org to
> Apache's JFrog Artifactory server at apache.jfrog.io
> That is, the following URLs would be moved from
> ```
> https://downloads.apache.org/cassandra/debian/
> https://downloads.apache.org/cassandra/redhat/
> ```
> to
> ```
> https://apache.jfrog.io/artifactory/cassandra-deb/
> https://apache.jfrog.io/artifactory/cassandra-rpm/
> ```
> The rationale to do this is to avoid the strict opinionated checksum and
> signature requirements on downloads.a.o (dist.a.o), as the debian and redhat
> repositories have their own system for integrity and signing (which we
> already do).
> Furthermore, as these repositories and their binaries are "convenience
> binaries" and not the official Cassandra source binaries, they do not need to
> be on downloads.a.o and can be served from apache.jfrog.io. This is similar
> to maven binaries (and docker images). Apache Arrow is already taking this
> approach: https://arrow.apache.org/install/
> An advantage to using apache.frog.io is that these repositories maintain all
> past patch versions on each repo series (major/minor). This has been
> requested by users a number of times, for the sake of rolling back to a
> previous patch version. downloads.a.o can only contain the latest version.
> This will BREAK everyone's existing
> `/etc/apt/sources.list.d/cassandra.sources.list` and
> `/etc/yum.repos.d/cassandra.repo` files. Folk will need to update these files
> to point to the new repo URLs. This would require an announcement to both
> users@ and dev@. I do not know how we can avoid this breakage. We could put
> in a simple README.md in the original URL locations explaining the breakage
> and how to fix.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
