Xavier Hanin wrote:
For hosting the repository, if it can be hosted at apache it's great.
There's also the solution to host it on svn as we do for the sandbox.
Apache infrastructure were explicit about making the Maven people use an
external host (ibiblio+mirrors), because it hosted non-ASF-licensed
JARs, and because of the load. Now, if its only metadata then maybe it
could be hosted somewhere in apache land. We could always start with a
DNS entry, though of course you could presumably point
ivyrep.jayasoft.org at somewhere new, when the time comes. I'm just
worried about breaking working builds by moving stuff around, which is
why custom DNS hostnames for every SOAP or REST service is a must.
Anyway, the current ivy repository is rather old, we tried to have the
policy to add only validated stuff, but it takes too much time and we
didn't
manage to get a true community process to validate files.
I'd argue that Maven has a problem here too; they accept stuff without
enough validation, though work is underway to fix it, including some
prolog-based dependency auditing I've been putting together.
The problem if we
put non validated files is that:
- people can't be confident on the repository quality
- you then have to modify files from time to time, and this is a very bad
practice for people already using stuff in the repository.
That brings up one requirement I have, which is that by default <ivy>
should at least check for metadata updates once a week. A local cache is
just that: a cache that can be invalidated from time to time.
But I think this could be the object of a discussion on its own, and is not
directly related to the repository hosting question.
Yes, and something to discuss with the repository@ people.
