Hi, On Sat, 18 Aug 2018 at 16:37, Jaroslav Tulach <jaroslav.tul...@gmail.com> wrote: > Great questions and concerns, Neil.
Thanks! And thanks for the response. Some comments ... > +10, the module should be properly signed! > > Apache can't sign it itself. Somebody else has to. Currently Reema and co. do > sign the module. I am fine with that, we just need to make sure it is > recognized as regularly (e.g. not self) signed. There are two ways: > > - Reema & co. can obtain signing certificate from an approved signing > authority > > - or we can take Reema & co. public key and add it to the list of trusted keys > in the Apache NetBeans The former sounds like a preferred approach, although either would be a major improvement for end users. > Instructions how to build nbjavac are desirable. It would be good if the > repository URL and revision was part of the NBM or JAR file. ... > Download it from update center automatically with the autoupdate Ant task. > That's what we do in Oracle Labs. But I assume that's still only the binary build?! Thanks for that suggestion - I hadn't considered using an Ant task for this. I'm not too concerned about getting the binary into the build if I go that way though, but may still prefer to build. However, I would say access to the specific sources required to build nb-javac *as distributed* is more than desirable. It's a key requirement of the license. And theoretically I can't legally redistribute without being able to provide it. Or eg. a Linux distro couldn't currently package a batteries-included version of NetBeans 9 with nb-javac pre-included. This is what I was getting at when I replied to Geertjan that this is a two-way thing, and separate to the ASF legal requirement on this. We've met the ASF requirement, but we could do with signposting how nb-javac is provided a bit better, and who is the other party with whom users agree the license / should contact to exercise the rights given. IMO, a link to the right source repo tag and/or source zip, somewhere on our website (preferably on the download page with a little info on what nb-javac is and why it's not from ASF) would be ideal. I'm happy to put in a PR for that, if I knew exactly what to link to! Best wishes, Neil --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@netbeans.incubator.apache.org For additional commands, e-mail: dev-h...@netbeans.incubator.apache.org For further information about the NetBeans mailing lists, visit: https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
