On 6/4/26 15:25, Neil C Smith wrote: > I want to have a frank discussion about installers, and what our plan > should be for NetBeans 31 and beyond. This follows up on some > conversation already elsewhere, such as Slack. I originally talked > about providing community installers for a further year while things > got resolved. That would make NetBeans 31 the last. Resolution does > not seem to be getting any nearer right now.
If you are still available to provide bundles/installers for the upcoming NB 31 release -> would be great. NB 32 and later might lose the installer links from the download page - dependant on the situation before release. -mbien > We need to work out a > plan here, and we probably have 3 options - > > - Drop all installers / leave to independent packagers. May not be > ideal, around ~60% of our user base use installers. Third-parties > with no connection here remove oversight - unsupported configs, more > bug reports for us! And some, like winget, just link to other > providers anyway. > > - Bring back into ASF. This would remove the bundled JDK option, and > issues around code signing to resolve from the thread I started on the > security-discuss list [1]. No JDK is at least a possible option on > Windows now with changes elsewhere since we dropped the legacy NBI > installers, but there are some edge cases to resolve. The amount of > work may be a potential problem. I can donate my workflow here if > useful, but there is work to do to adapt to ASF's signing requirements > and properly test no-JDK Windows support in NBPackage. > > - Bring the Friends of Apache NetBeans installers into line with the > community installer requirements [2], with possible PMC discussion / > decision on changing those requirements. The original plan was that > FoAN hosted shared infrastructure for these that PMC members could > access. That has still not happened. And whatever happens here, the > FoAN installers cannot continue being unaligned with the PMC > requirement - I don't think thousands of Windows users getting a > pre-released package or a package in an unsupported configuration is > OK. > > Any thoughts? Other options to explore? > > If we go with the latter two options, I'll continue to provide > community installers for NB31 as a backup option. If we go with the > first option, I'd probably stop after this one. > > [1] Thread from March on security-discuss about access to ASF's code > signing in a GitHub workflow given our lack of reproducible builds - > https://lists.apache.org/thread/y72098wsxxg6504mll6qkc23sq37lmcp > > [2] The community installer definition that has existed since 2022 > amounts to "NetBeans packages bundled with the latest, recommended > JDK, built, tested and signed off by a PMC member". It's what we > agreed to point people to when dropping ASF built installers last > March. > > Thanks and best wishes, > > Neil > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > > For further information about the NetBeans mailing lists, visit: > https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists > > > --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] For further information about the NetBeans mailing lists, visit: https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
