Hi Neil, sounds good to me. I probably had a slightly less formal style in mind when we chatted about this (like a readme for package maintainers) but this is an important area so this is fine of course. (please don't add rocket emojis ;))
best regards, michael On 7/7/26 11:37, Neil C Smith wrote: > Hi, > > We were discussing on Slack recently the merits of adding a > PACKAGING.md file to the IDE repository. I've drafted a suggestion > (below). This would outline how third-parties can package and > distribute releases of Apache NetBeans. Besides the license itself, > downstream distribution is already covered by ASF's Downstream > Distribution Branding Policy. The idea would be to clarify how this > should apply to the IDE. > > This thread obviously relates to the discussion around installers, and > I've pulled out some things from there into the draft text below. > This is separate to any additional requirements we might place for > "community installers" on our download pages or for organisations > using the trademark. > > Besides the unresolved installer thread, this is also prompted by an > issue with a recent Gentoo package built from the wrong sources ( > https://github.com/apache/netbeans/discussions/9476 ), and also > further issues with WinGet (hash mismatch caused by the linked file > being altered retrospectively). > > -------------------------- > DRAFT - Apache NetBeans packaging guidelines > > Apache NetBeans is distributed by a number of downstream entities. We > recognize the importance of these distributors, and welcome their > support. This document outlines some key requirements that must be > followed to distribute packages of Apache NetBeans. It complements the > ASF's [Downstream Distribution Branding Policy][1]. > > Packages of Apache NetBeans MUST be built from the officially released > source code zip, or from the associated binary zip release. These are > listed on the download pages of the [Apache NetBeans website][2]. > Packages MUST NOT be built from staged artefacts or before the release > vote has completed successfully. > > Packages MUST NOT be built from a git checkout or the automatic zip on > release tags. The repository contains non-released sources and is > missing certain required metadata for an accurate release. > > Testing packages of Apache NetBeans release candidates MAY be produced > using files from the [nightlies server][3] If made available to > download they MUST be clearly marked as not built from an official > release. > > Packages MAY patch the release to remove OS-specific binaries and > other files not required by the target OS. Any other patching must be > in line with the [sources requirements][4] of the ASF distribution > policy. We prefer Apache NetBeans is packaged as released. > > Packages MAY include an open-source JDK alongside Apache NetBeans > within a single self-contained bundle. The JDK MUST be either the > latest release (recommended), or latest LTS, compatible with the > Apache NetBeans version. The JDK MUST NOT include JavaFX. Distributors > SHOULD ensure that the licensing information for Apache NetBeans and > for the bundled JDK are clear and distinct. > > We provide the [NBPackage tool][5] for building packages from the > binary zip. It supports bundling a JDK. Distributors MAY choose to use > this tool to build packages. > > The Apache NetBeans build is not reproducible. NBPackage is designed > to keep as many files as possible binary comparable with the release > artefact. Distributors using another tool to produce packages from the > binary zip SHOULD ensure that the contents of the package can be > similarly verified. Distributors packaging from a source release > SHOULD ensure that the build process is transparent and the source > link verifiable. > > Distributors MUST provide contact details for reporting bugs and > security vulnerabilities related to their packages. They SHOULD > consider suitable practices for security and user experience - build > verification, file hashes, code signing, notarization, immutable > releases, etc. > > Any queries about how to apply these requirements and guidelines > should be raised on the [Dev mailing list][6]. > > [1] https://www.apache.org/foundation/marks/downstream > [2] https://netbeans.apache.org/download/ > [3] https://nightlies.apache.org/netbeans/candidate/netbeans/ > [4] https://www.apache.org/foundation/marks/downstream#source > [5] https://github.com/apache/netbeans-nbpackage/ > [6] https://netbeans.apache.org/community/mailing-lists/ > > ------------------------------ > > Thoughts? > > Thanks, > > Neil > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > > For further information about the NetBeans mailing lists, visit: > https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists > > > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] For further information about the NetBeans mailing lists, visit: https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
