Hi, I took another look at what the downstream packages were based on.
AUR + flathub are based on our bin-zip: https://aur.archlinux.org/packages/netbeans-bin https://github.com/flathub/org.apache.netbeans Laszlo maintains the snap package, please correct me if I am wrong but I believe it is also taking the bin-zips for both channels https://snapcraft.io/netbeans winget and hombebrew both use the Friends of NetBeans jdk bundles https://github.com/microsoft/winget-pkgs/tree/master/manifests/a/Apache/NetBeans/30 https://github.com/Homebrew/homebrew-cask/blob/main/Casks/n/netbeans.rb I looked at winget around the NB 25 time frame, and remember that it supported dependencies and even zip packages (although zip packages had some limitations). Homebrew can handle dependencies too. This means that the second option ("Bring back into ASF") would be possible without disrupting downstream packaging since the JDK could be moved into a dependency (if it isn't already one like with AUR and flathub). Of course the signing problem remains + someone would have to do that task during release which is already full with other tasks (looking at the new, slightly intimidating checklist). best regards, -mbien On 6/4/26 15:25, Neil C Smith wrote: > I want to have a frank discussion about installers, and what our plan > should be for NetBeans 31 and beyond. This follows up on some > conversation already elsewhere, such as Slack. I originally talked > about providing community installers for a further year while things > got resolved. That would make NetBeans 31 the last. Resolution does > not seem to be getting any nearer right now. We need to work out a > plan here, and we probably have 3 options - > > - Drop all installers / leave to independent packagers. May not be > ideal, around ~60% of our user base use installers. Third-parties > with no connection here remove oversight - unsupported configs, more > bug reports for us! And some, like winget, just link to other > providers anyway. > > - Bring back into ASF. This would remove the bundled JDK option, and > issues around code signing to resolve from the thread I started on the > security-discuss list [1]. No JDK is at least a possible option on > Windows now with changes elsewhere since we dropped the legacy NBI > installers, but there are some edge cases to resolve. The amount of > work may be a potential problem. I can donate my workflow here if > useful, but there is work to do to adapt to ASF's signing requirements > and properly test no-JDK Windows support in NBPackage. > > - Bring the Friends of Apache NetBeans installers into line with the > community installer requirements [2], with possible PMC discussion / > decision on changing those requirements. The original plan was that > FoAN hosted shared infrastructure for these that PMC members could > access. That has still not happened. And whatever happens here, the > FoAN installers cannot continue being unaligned with the PMC > requirement - I don't think thousands of Windows users getting a > pre-released package or a package in an unsupported configuration is > OK. > > Any thoughts? Other options to explore? > > If we go with the latter two options, I'll continue to provide > community installers for NB31 as a backup option. If we go with the > first option, I'd probably stop after this one. > > [1] Thread from March on security-discuss about access to ASF's code > signing in a GitHub workflow given our lack of reproducible builds - > https://lists.apache.org/thread/y72098wsxxg6504mll6qkc23sq37lmcp > > [2] The community installer definition that has existed since 2022 > amounts to "NetBeans packages bundled with the latest, recommended > JDK, built, tested and signed off by a PMC member". It's what we > agreed to point people to when dropping ASF built installers last > March. > > Thanks and best wishes, > > Neil > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > > For further information about the NetBeans mailing lists, visit: > https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists > > > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] For further information about the NetBeans mailing lists, visit: https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
