Re: Maven2 support
On Fri, 15 Apr 2005, Steve Loughran wrote: > Date: Fri, 15 Apr 2005 13:30:56 +0100 > From: Steve Loughran <[EMAIL PROTECTED]> > Cc: [EMAIL PROTECTED] > Subject: Re: Maven2 support > > On 4/15/05, Brett Porter <[EMAIL PROTECTED]> wrote: > > > > -something with a different .md5 checksum than its real checksum. > > > > The repository is scanned every 4 hours and repairs missing/broken > > md5s (bearing in mind that we don't consider them as a security > > option, but a download integrity check) > > OK, no problem. I'm not actually testing those MD5s, and I have my own > tests with different SHA1 and MD5 signatures from what is expected. I'm wondering if uploading pgp signatures is still somewhere on the agenda. They are important for integrity checks of the repository. I try to follow your exchanges but I'm afraid it's all abacadabra to me. Henk Penning _ Henk P. Penning, Computer Systems Group R Uithof CGN-A232 _/ \_ Dept of Computer Science, Utrecht University T +31 30 253 4106 / \_/ \ Padualaan 14, 3584CH Utrecht, the Netherlands F +31 30 251 3791 \_/ \_/ http://www.cs.uu.nl/staff/henkp.html M [EMAIL PROTECTED] \_/
Re: repository thoughts
On Sun, 23 Jan 2005, Brett Porter wrote: > Date: Sun, 23 Jan 2005 16:08:22 +1100 > From: Brett Porter <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: repository thoughts > > Hi folks, > > I've put up basically a TODO list from recent discussions. Sorry it > took so long. > > http://wiki.apache.org/ASFRepository/BrettPorter > > Did I miss anything? Brett, This is a very good start ; thanks. -- MD5 checksum format : in my experience the format doesn't matter much ; it is always easy to grab a 32 byte hex number from any format. Counter examples are easy to find of course (filenames like '41eab7db2910a04500751bbc2ed7f5bf') but in general, different formats aren't a problem. Perhaps it is wize to state that md5 checksums should be in a '.md5' (lowercase) file because some people put the md5 checksum in a '.MD5' file. -- For cleanup purposes it would be nice if one could link something (X) in the repository, to something (Y) in '/dist/' : we can flag X for removal if Y is gone. > Brett Henk Penning _ Henk P. Penning, Computer Systems Group R Uithof CGN-A232 _/ \_ Dept of Computer Science, Utrecht University T +31 30 253 4106 / \_/ \ Padualaan 14, 3584CH Utrecht, the Netherlands F +31 30 251 3791 \_/ \_/ http://www.cs.uu.nl/staff/henkp.html M [EMAIL PROTECTED] \_/
Re: Where to publish Xalan code on http://www.apache.org/dist (fwd)
On Tue, 11 Jan 2005, Mark R. Diggory wrote: > Date: Tue, 11 Jan 2005 19:31:22 -0500 > From: Mark R. Diggory <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: Re: Where to publish Xalan code on http://www.apache.org/dist > (fwd) [ I wrote : ] > > Remove ? [ Mark : ] > I've been planning to, I'm just concerned of the impact, I'm trying to > be thorough and verify it will not cause others major problems when I > remove them. [ but Brett wrote somewhere else : ] > Nobody is building against java-repository, they are using ibiblio, > so there is no harm in cleaning these up AFAICT. Mark, what kind of problems could result in removing things ? According to Brett we could remove the entire repository, and nobody's build would fail (not that I'm suggesting that :-). Are there other worries ? HPP ------------ _ Henk P. Penning, Computer Systems Group R Uithof CGN-A232 _/ \_ Dept of Computer Science, Utrecht University T +31 30 253 4106 / \_/ \ Padualaan 14, 3584CH Utrecht, the Netherlands F +31 30 251 3791 \_/ \_/ http://www.cs.uu.nl/staff/henkp.html M [EMAIL PROTECTED] \_/
Re: Where to publish Xalan code on http://www.apache.org/dist (fwd)
On Wed, 12 Jan 2005, Brett Porter wrote: > Date: Wed, 12 Jan 2005 09:39:54 +1100 > From: Brett Porter <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: Re: Where to publish Xalan code on http://www.apache.org/dist > (fwd) > > Henk, > > My bad. I copied it to the wrong location. I fixed the JARs, forgot > the POMs and will remove them next time I have SSH access. Ok ; fine ; I was afraid I missed something. To generalise a little further, are all *SNAPSHOT* thingies in the repository 'bad' (as in, don't belong there) ? How about stuff like this (a *SNAPSHOT* symlink to a date-like *20040825.214656* thing) ? ./turbine/poms/maven-turbine-plugin-SNAPSHOT.pom -> maven-turbine-plugin-20040825.214656.pom We have 474 '*SNAPSHOT*' files and 174 symlinks. [EMAIL PROTECTED]: find . -name '*SNAPSHOT*' -type f -ls | wc 4745214 75820 [EMAIL PROTECTED]: find . -name '*SNAPSHOT*' -type l -ls | wc 1742262 32093 Remove ? > - Brett HPP _ Henk P. Penning, Computer Systems Group R Uithof CGN-A232 _/ \_ Dept of Computer Science, Utrecht University T +31 30 253 4106 / \_/ \ Padualaan 14, 3584CH Utrecht, the Netherlands F +31 30 251 3791 \_/ \_/ http://www.cs.uu.nl/staff/henkp.html M [EMAIL PROTECTED] \_/
Re: Where to publish Xalan code on http://www.apache.org/dist (fwd)
On Tue, 11 Jan 2005, Mark R. Diggory wrote: > Date: Tue, 11 Jan 2005 16:04:31 -0500 > From: Mark R. Diggory <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: Re: Where to publish Xalan code on http://www.apache.org/dist > (fwd) > > Mixed terminology again. if the "SNAPSHOT" refers to a fully sanctioned > release not an interim or daily build, then the usage is fine. Remember > in this case SNAPSHOT is no different than "LATEST" or "CURRENT". I wish > we could have Maven folks explore usage of a more accurate terminology > for these. Hm, it would seem the latest sanctioned 'maven' is in /www/www.apache.org/dist/maven/binaries/maven-1.0.2.tar.gz .. unpacking it shows me maven-1.0.2/plugins/maven-site-plugin-1.5.2.jar so the latest sanctioned maven-site-plugin appears to be '1.5.2'. Or isn't it ? Also, if SNAPSHOT is no different than "LATEST" or "CURRENT", what does "LATEST" or "CURRENT" stand for ?? ( 1, 2, 3 ..) > -Mark HPP _ Henk P. Penning, Computer Systems Group R Uithof CGN-A232 _/ \_ Dept of Computer Science, Utrecht University T +31 30 253 4106 / \_/ \ Padualaan 14, 3584CH Utrecht, the Netherlands F +31 30 251 3791 \_/ \_/ http://www.cs.uu.nl/staff/henkp.html M [EMAIL PROTECTED] \_/
Re: Where to publish Xalan code on http://www.apache.org/dist (fwd)
Hi, [ I cut this from another message ; I hope it is correct ] --On Wednesday, January 5, 2005 6:43 AM +1100 Brett Porter <[EMAIL PROTECTED]> wrote: > This is for Maven users (and possible future tools, eg I believe Ant 1.7 > has repository support) to be able to get your releases easily (releases > only - >development snapshots to http://cvs.apache.org/repository). This was put in 'java-repository/maven/poms/' just now : Jan 11 11:43 maven-site-plugin-1.6-SNAPSHOT.pom Jan 11 11:43 maven-site-plugin-1.6-SNAPSHOT.pom.md5 Just to make sure : isn't this a 'development snapshot' ? Shouldn't this have gone to 'http://cvs.apache.org/repository' ? HPP ------------ _ Henk P. Penning, Computer Systems Group R Uithof CGN-A232 _/ \_ Dept of Computer Science, Utrecht University T +31 30 253 4106 / \_/ \ Padualaan 14, 3584CH Utrecht, the Netherlands F +31 30 251 3791 \_/ \_/ http://www.cs.uu.nl/staff/henkp.html M [EMAIL PROTECTED] \_/
Re: md5's
On Wed, 6 Oct 2004, Mark R. Diggory wrote: > Date: Wed, 06 Oct 2004 14:08:38 -0400 > From: Mark R. Diggory <[EMAIL PROTECTED]> > To: Dion Gillard <[EMAIL PROTECTED]> > Cc: Henk P. Penning <[EMAIL PROTECTED]>, [EMAIL PROTECTED], > [EMAIL PROTECTED], Maven Developers List > Subject: Re: md5's > Ultimately it would, as well, be of great benefit if the artifact > publishing worked initially in a staging area as not to confuse existing > cron jobs attempting to validate md5's on the server. This would > probably be best served in the systems default tmp directory. That would be great. I think, the best way for adding/replace stuff is -- write a 'temp' -- rename 'temp' to 'file' because a rename is truly atomic if 'temp' and 'file' are in the same file system. If you can implement the 'temp' for 'file' to be, for instance, '.tmp.file', I can easily teach the checkers to ignore '.tmp.*' files. I think rsync does something like that (even better .tmp.$$.file). Just a thought. > -Mark HPP _ Henk P. Penning, Computer Systems Group R Uithof CGN-A232 _/ \_ Dept of Computer Science, Utrecht University T +31 30 253 4106 / \_/ \ Padualaan 14, 3584CH Utrecht, the Netherlands F +31 30 251 3791 \_/ \_/ http://www.cs.uu.nl/staff/henkp.html M [EMAIL PROTECTED] \_/
Re: md5's
On Tue, 5 Oct 2004, Mark R. Diggory wrote: > Date: Tue, 05 Oct 2004 14:11:03 -0400 > From: Mark R. Diggory <[EMAIL PROTECTED]> > To: Henk P. Penning <[EMAIL PROTECTED]> > Cc: [EMAIL PROTECTED], dion <[EMAIL PROTECTED]>, [EMAIL PROTECTED] > Subject: Re: md5's > In the opposite direction, individual ownership without > group write capabilities blocks individuals from "removing" releases > when it is time for them to be excised. I don't think it does. If you have write permission on a directory, you can remove any file in it, including the files you don't own and can't write. On Solaris 'rm' asks first, but you can remove. I can't check the situation on minotaur. I assume the same thing goes. HPP _ Henk P. Penning, Computer Systems Group R Uithof CGN-A232 _/ \_ Dept of Computer Science, Utrecht University T +31 30 253 4106 / \_/ \ Padualaan 14, 3584CH Utrecht, the Netherlands F +31 30 251 3791 \_/ \_/ http://www.cs.uu.nl/staff/henkp.html M [EMAIL PROTECTED] \_/
