Hi Tommaso, On Mon, Sep 7, 2015 at 10:00 PM, Tommaso Teofili <[email protected]> wrote:
> Hi all, > > 2015-09-07 18:36 GMT+02:00 Andy Seaborne <[email protected]>: > > > On 07/09/15 14:32, Reto Gmür wrote: > > > >> >The binaries have had the NOTICE and LICENSE files replaced in both jar > >>> >and sources.jar. These miss the necessary declarations. > >>> > > >>> > >> I don't think anything changed here. Do you think something need to be > >> changed for the release candidate to be acceptable (the vote is on the > >> source zip linked in the original mail). > >> > > > > There are two strands of issue here. A general one about approving > > binaries and a point about distributing modified Jena as binary without > > it's NOTICE and LICENSE files. > > > > > > Approving binaries: > > > > Binaries must correspond to a release. > > > > The distribution mechanism for binaries is via > > repository.ao/content/repositories/releases/org/apache/... > > > > Note "releases". > > > > Material that is published through the Apache maven repository needs sort > > of VOTE. It transfers the legal liability from the RM to the foundation > for > > one thing. > > > > Surely, a "+1" ought to include checking what is produced is correct. > > > > I think what we are meant and required to vote on is a "source release". > I agree with Roy Fielding's point on that in a previous discussion on > general@incubator [1], basically we vote and release open source code (the > source release), binaries can be seen as a "convenience artifact" in that > view. > > > > > > > > Removing NOTICE and LICENSE: > > > > Clerezza is redistributing modified Jena binaries via > > repository.ao/content/*releases* without the NOTICE and LICENSE from > > Jena. Xerces, for example, cause material in LICENSE and some BSD code > > causes material in NOTICE. > > > > if we do redistribute modified Jena sources or binaries I think we need to > mention that in the NOTICE file, if I understand [2] correctly. > Some Jena and Xerces classes are unmodified in the generated jar, but as these are also apache projects they are covered by the minimal NOTICE. What might be an issue are the jar files located that are also contained in the generated jar, accessing their NOTICE files requires unjaring one level deeper. Cheers, Reto > > Regards, > Tommaso > > > > > > Andy > > > > http://www.apache.org/dev/release.html#what > > > > [1] : http://markmail.org/message/yzetzkhfahrlv5um > [2] : > http://www.apache.org/dev/licensing-howto.html#bundled-vs-non-bundled >
