Simone Tripodi wrote: > Hi again, > just to make sure everybody tests the same stuff, please refer to: > > http://people.apache.org/builds/cocoon/org/apache/cocoon/all/cocoon-all/3.0.0-alpha-3/cocoon-all-3.0.0-alpha-3-dist.tar.gz* > http://people.apache.org/builds/cocoon/org/apache/cocoon/all/cocoon-all/3.0.0-alpha-3/cocoon-all-3.0.0-alpha-3-dist.zip* > > Include GPG key and checksum verification!!!
Thanks Simone. +1 from me. MD5 (cocoon-all-3.0.0-alpha-3-dist.tar.gz) = 5b2e839101ec53246690b05dbf136b13 There are a couple of things that should get fixed for next time: The md5 and sha1 files have extra "-n". All NOTICE.txt files have a year range, so needs 2011. I don't understand how Maven stuff works. There are some declared dependencies. They do use suitable licenses. Do we need to add a copy of their licenses in our distribution? e.g. some are: AspectJ : EPL-1.0 Woodstox : Apache License 2.0 Antlr : BSD MurmurHash : Apache License 2.0 Some of those licenses do require reciprocity: http://www.apache.org/legal/resolved.html#category-b e.g. We already have mentioned in NOTICE.txt the JAXB using CDDL. However we have not mentioned AspectJ using EPL. We do mention Java MurmurHash using AL-20 and the original using MIT, but we do not need to. -David
