On May 6, 2007, at 1:57 PM, robert burrell donkin wrote:
incubator distributions need to be stored under /www/www.apache.org/
dist
AFACT there are two reasonable options: either create repositories
under /www.apache.org/dist/incubator or use the standard maven ones
I don't understand the question, but I think the answer can be deduced
from this:
Any [1] artifact that is released by The Apache Software
Foundation MUST
have http://www.apache.org/dist/ as its primary download location
and it
MUST follow all the central infrastructure guidelines (eg, mirroring,
signing) that exist for that location.
Similarly
Any artifact that does NOT come from http://www.apache.org/dist/
is NOT
an official release by The Apache Software Foundation, though it
may be
a redistribution of such a release, which users are encouraged to
verify
using PGP signature files and/or SHA1 digest files retrieved from
http://www.apache.org/dist/. The ASF welcomes and appreciates
redistribution of its existing artifacts.
I think the above essentially captures what came out of the 500-mail-
or-so
discussion and vote that we had recently.
IOW it is all fine and dandy if files go all across the globe (or apache
servers) as long as they're redistributed from /dist/ somehow. My
favorite
change was when the ibiblio maven repo was set up to auto-sync from /
dist/
(no idea if it still works that way).
That loads of users find it quite alright to ignore checksums and
signature
sanity and just get things out of badly policied repositories (note: I'm
not saying the maven repos are badly policied, I think there's a lot
of due
dilligence going on there, but that wasn't always the case), is well,
not
part of our own policies.
cheers,
- Leo
[1] this is a recent change from how incubator has done this for a few
years, where we made an exception to this rule for artifacts
from the
incubator.
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
