I want to have a frank discussion about installers, and what our plan should be for NetBeans 31 and beyond. This follows up on some conversation already elsewhere, such as Slack. I originally talked about providing community installers for a further year while things got resolved. That would make NetBeans 31 the last. Resolution does not seem to be getting any nearer right now. We need to work out a plan here, and we probably have 3 options -
- Drop all installers / leave to independent packagers. May not be ideal, around ~60% of our user base use installers. Third-parties with no connection here remove oversight - unsupported configs, more bug reports for us! And some, like winget, just link to other providers anyway. - Bring back into ASF. This would remove the bundled JDK option, and issues around code signing to resolve from the thread I started on the security-discuss list [1]. No JDK is at least a possible option on Windows now with changes elsewhere since we dropped the legacy NBI installers, but there are some edge cases to resolve. The amount of work may be a potential problem. I can donate my workflow here if useful, but there is work to do to adapt to ASF's signing requirements and properly test no-JDK Windows support in NBPackage. - Bring the Friends of Apache NetBeans installers into line with the community installer requirements [2], with possible PMC discussion / decision on changing those requirements. The original plan was that FoAN hosted shared infrastructure for these that PMC members could access. That has still not happened. And whatever happens here, the FoAN installers cannot continue being unaligned with the PMC requirement - I don't think thousands of Windows users getting a pre-released package or a package in an unsupported configuration is OK. Any thoughts? Other options to explore? If we go with the latter two options, I'll continue to provide community installers for NB31 as a backup option. If we go with the first option, I'd probably stop after this one. [1] Thread from March on security-discuss about access to ASF's code signing in a GitHub workflow given our lack of reproducible builds - https://lists.apache.org/thread/y72098wsxxg6504mll6qkc23sq37lmcp [2] The community installer definition that has existed since 2022 amounts to "NetBeans packages bundled with the latest, recommended JDK, built, tested and signed off by a PMC member". It's what we agreed to point people to when dropping ASF built installers last March. Thanks and best wishes, Neil --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] For further information about the NetBeans mailing lists, visit: https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
