Presumably this refers to packages distributed through Apache. Maybe that's so baked in that there's no need to mention it explicitly.
For example, if I want to make a distribution available that included JavaFX I could make that available on some random website. -ernie On 26/07/07 2:37 AM, Neil C Smith wrote:
Hi, We were discussing on Slack recently the merits of adding a PACKAGING.md file to the IDE repository. I've drafted a suggestion (below). This would outline how third-parties can package and distribute releases of Apache NetBeans. Besides the license itself, downstream distribution is already covered by ASF's Downstream Distribution Branding Policy. The idea would be to clarify how this should apply to the IDE. This thread obviously relates to the discussion around installers, and I've pulled out some things from there into the draft text below. This is separate to any additional requirements we might place for "community installers" on our download pages or for organisations using the trademark. Besides the unresolved installer thread, this is also prompted by an issue with a recent Gentoo package built from the wrong sources ( https://github.com/apache/netbeans/discussions/9476 ), and also further issues with WinGet (hash mismatch caused by the linked file being altered retrospectively). -------------------------- DRAFT - Apache NetBeans packaging guidelines Apache NetBeans is distributed by a number of downstream entities. We recognize the importance of these distributors, and welcome their support. This document outlines some key requirements that must be followed to distribute packages of Apache NetBeans. It complements the ASF's [Downstream Distribution Branding Policy][1]. Packages of Apache NetBeans MUST be built from the officially released source code zip, or from the associated binary zip release. These are listed on the download pages of the [Apache NetBeans website][2]. Packages MUST NOT be built from staged artefacts or before the release vote has completed successfully. Packages MUST NOT be built from a git checkout or the automatic zip on release tags. The repository contains non-released sources and is missing certain required metadata for an accurate release. Testing packages of Apache NetBeans release candidates MAY be produced using files from the [nightlies server][3] If made available to download they MUST be clearly marked as not built from an official release. Packages MAY patch the release to remove OS-specific binaries and other files not required by the target OS. Any other patching must be in line with the [sources requirements][4] of the ASF distribution policy. We prefer Apache NetBeans is packaged as released. Packages MAY include an open-source JDK alongside Apache NetBeans within a single self-contained bundle. The JDK MUST be either the latest release (recommended), or latest LTS, compatible with the Apache NetBeans version. The JDK MUST NOT include JavaFX. Distributors SHOULD ensure that the licensing information for Apache NetBeans and for the bundled JDK are clear and distinct. We provide the [NBPackage tool][5] for building packages from the binary zip. It supports bundling a JDK. Distributors MAY choose to use this tool to build packages. The Apache NetBeans build is not reproducible. NBPackage is designed to keep as many files as possible binary comparable with the release artefact. Distributors using another tool to produce packages from the binary zip SHOULD ensure that the contents of the package can be similarly verified. Distributors packaging from a source release SHOULD ensure that the build process is transparent and the source link verifiable. Distributors MUST provide contact details for reporting bugs and security vulnerabilities related to their packages. They SHOULD consider suitable practices for security and user experience - build verification, file hashes, code signing, notarization, immutable releases, etc. Any queries about how to apply these requirements and guidelines should be raised on the [Dev mailing list][6]. [1] https://www.apache.org/foundation/marks/downstream [2] https://netbeans.apache.org/download/ [3] https://nightlies.apache.org/netbeans/candidate/netbeans/ [4] https://www.apache.org/foundation/marks/downstream#source [5] https://github.com/apache/netbeans-nbpackage/ [6] https://netbeans.apache.org/community/mailing-lists/ ------------------------------ Thoughts? Thanks, Neil --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] For further information about the NetBeans mailing lists, visit: https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
--------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] For further information about the NetBeans mailing lists, visit: https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
