Re: [QUESTION] are binary distributions/releases required?

[Justin Mclean]

HI,

> I'm struggling to find any examples of ASF jars pushed to maven
> central that have anything other than the standard boilerplate Apache
> LICENSE and NOTICE. Having a transitive dependency on another jar
> doesn't appear to be mentioned in any jar LICENSE/NOTICE that I
> checked.

See [1]. In some case where there’s no 3rd party code in the jar they will be 
identical.

> With Pekko, bundling classes from other non-Apache projects is not the
> norm (with a small number of exceptions) - the pom.xml just lists
> dependencies on the jars we need.
> 
> Is there anything else that affects what appears in a jar's META-INF
> LICENSE and NOTICE?

Including code of other Apache projects could effect your NOTICE file. [2]

Kind Regards,
Justin

1. https://infra.apache.org/licensing-howto.html#guiding 

2. https://infra.apache.org/licensing-howto.html#alv2-dep 

Re: [QUESTION] are binary distributions/releases required?

[PJ Fanning]

Hi Justin,
I'm struggling to find any examples of ASF jars pushed to maven
central that have anything other than the standard boilerplate Apache
LICENSE and NOTICE. Having a transitive dependency on another jar
doesn't appear to be mentioned in any jar LICENSE/NOTICE that I
checked.

Having code from another jar shaded within your jar - I'm guessing
that would be a case that needs mention in the jar's META-INF/LICENSE.

With Pekko, bundling classes from other non-Apache projects is not the
norm (with a small number of exceptions) - the pom.xml just lists
dependencies on the jars we need.

Is there anything else that affects what appears in a jar's META-INF
LICENSE and NOTICE?

Since we're not currently planning to create a set of binary artifacts
(zip and/or tgz) with jars including transitive dependency jars that
so many ASF projects create - presumably that means we don't need to
create the LICENSE-binary and NOTICE-binary that many projects create
- that contain lists of all the transitive dependencies with their
licenses. An example of this LICENSE-binary/NOTICE-binary usage
appears in the root dir of https://github.com/apache/spark.

Any clarifications would be much appreciated.


On Thu, 9 Feb 2023 at 01:04, Justin Mclean  wrote:
>
> Hi,
>
> Those jars are likely to have different LICENSE and NOTICE files so I would 
> suggest you vote on both at the same time.
>
> Kind Regards,
> Justin
> -
> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
> For additional commands, e-mail: general-h...@incubator.apache.org
>

-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [QUESTION] are binary distributions/releases required?

[Justin Mclean]

Hi,

Those jars are likely to have different LICENSE and NOTICE files so I would 
suggest you vote on both at the same time.

Kind Regards,
Justin
-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [QUESTION] are binary distributions/releases required?

[PJ Fanning]

Thanks Hans. That would be the general plan with the Maven jar part of
our releases.
* as part of the RC where we stage a source release for people to vote
on, we will also push jars to repository.apache.org staging repo
* if the vote on the source release passes, we will release the source
release artifacts and also, use repository.apache.org webapp to
release the staged jars - so they will get pushed to Maven Central
* if the vote fails, we can use repository.apache.org webapp to drop
the staged jars as well or removing the source release candidate
artifacts

On Wed, 8 Feb 2023 at 21:39, Hans Van Akelyen
 wrote:
>
> Isn't staging for release on maven central the same as creating binary
> convenience artifacts?
>
> Staging to the ASF nexus to then be pushed to maven central is part of your
> release process [1]
>
> Cheers,
> Hans
>
> [1] https://infra.apache.org/publishing-maven-artifacts.html
>
>
> On Wed, 8 Feb 2023 at 20:15, PJ Fanning  wrote:
>
> > Thanks Julian for clarifying the terminology.
> >
> > I think the general consensus in the Pekko team is that there is no call
> > for creating binary artifacts distributions (example [1]).
> >
> > The initial user base of Pekko are users who currently use Akka but
> > dislike the move to Business Source License 1.1. This user base are happy
> > with jars released to Maven Central and we will be providing these as a
> > convenience to our users.
> >
> > If and when the source releases are approved and released, jars built at
> > the same time as the source release will be published to Maven Central.
> >
> > [1]
> > https://www.apache.org/dyn/closer.lua/logging/log4j/2.19.0/apache-log4j-2.19.0-bin.zip
> >
> >
> > On 2023/02/08 16:46:03 Julian Hyde wrote:
> > > It’s useful to clarify the terminology. There’s no such thing as a
> > “binary
> > > release”. Release policy [1] says:
> > >
> > > > Every ASF release MUST contain one or more source packages
> > >
> > > > All releases are in the form of the source materials needed to make
> > > changes
> > > > to the software being released.
> > > >
> > > > As a convenience to users that might not have the appropriate tools to
> > > build a
> > > > compiled version of the source, binary/bytecode packages MAY be
> > > distributed
> > > > alongside official Apache releases.”
> > >
> > > The binary packages that may accompany a release are generally referred
> > to
> > > as “binary artifacts” of the release.
> > >
> > > Julian
> > >
> > > [1] https://www.apache.org/legal/release-policy.html#artifacts
> > >
> > > On Feb 8, 2023, at 7:19 AM, Dave Fisher  wrote:
> > >
> > > Hi PJ,
> > >
> > > Daffodil uses sbt and produces binary releases -
> > > https://daffodil.apache.org/releases/3.4.0/
> > > - https://GitHub.com/Apache/daffodil/
> > >
> > > Best,
> > > Dave
> > >
> > > Sent from my iPhone
> > >
> > > On Feb 8, 2023, at 6:33 AM, PJ Fanning  wrote:
> > >
> > >
> > > Hi everyone,
> > >
> > > The release management guide [1] only mentions 'source releases'. Every
> > > Apache project that I am familiar with also does binary releases. For
> > > applications, this makes sense - having a zip/tgz file that you can
> > > download and extract - that you can then readily start the application
> > > using a shell script. For libs, I'm sure these binary releases can be
> > > useful too but I'm wondering if they are strictly required.
> > >
> > >
> > > Apache Pekko is a set of libraries as opposed to an application. Our
> > build
> > > uses the sbt build tool and there isn't anything that I've come across
> > that
> > > would produce something like the binary releases that other Apache
> > projects
> > > release. This means we'd likely have to roll our own solution.
> > >
> > >
> > > In terms of prioritising work towards a v1.0.0 release, it's useful to
> > know
> > > if we have items that could be de-prioritised.
> > >
> > >
> > > If we do need to create binary releases, are there any guidelines to
> > follow
> > > - or do we just look at other Apache libs and use their binary releases
> > as
> > > a guide?
> > >
> > >
> > > Regards,
> > >
> > > PJ
> > >
> > >
> > > [1] https://incubator.apache.org/guides/releasemanagement.html
> > >
> > >
> > > -
> > >
> > > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
> > >
> > > For additional commands, e-mail: general-h...@incubator.apache.org
> > >
> >
> > -
> > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
> > For additional commands, e-mail: general-h...@incubator.apache.org
> >
> >

-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [QUESTION] are binary distributions/releases required?

[Hans Van Akelyen]

Isn't staging for release on maven central the same as creating binary
convenience artifacts?

Staging to the ASF nexus to then be pushed to maven central is part of your
release process [1]

Cheers,
Hans

[1] https://infra.apache.org/publishing-maven-artifacts.html


On Wed, 8 Feb 2023 at 20:15, PJ Fanning  wrote:

> Thanks Julian for clarifying the terminology.
>
> I think the general consensus in the Pekko team is that there is no call
> for creating binary artifacts distributions (example [1]).
>
> The initial user base of Pekko are users who currently use Akka but
> dislike the move to Business Source License 1.1. This user base are happy
> with jars released to Maven Central and we will be providing these as a
> convenience to our users.
>
> If and when the source releases are approved and released, jars built at
> the same time as the source release will be published to Maven Central.
>
> [1]
> https://www.apache.org/dyn/closer.lua/logging/log4j/2.19.0/apache-log4j-2.19.0-bin.zip
>
>
> On 2023/02/08 16:46:03 Julian Hyde wrote:
> > It’s useful to clarify the terminology. There’s no such thing as a
> “binary
> > release”. Release policy [1] says:
> >
> > > Every ASF release MUST contain one or more source packages
> >
> > > All releases are in the form of the source materials needed to make
> > changes
> > > to the software being released.
> > >
> > > As a convenience to users that might not have the appropriate tools to
> > build a
> > > compiled version of the source, binary/bytecode packages MAY be
> > distributed
> > > alongside official Apache releases.”
> >
> > The binary packages that may accompany a release are generally referred
> to
> > as “binary artifacts” of the release.
> >
> > Julian
> >
> > [1] https://www.apache.org/legal/release-policy.html#artifacts
> >
> > On Feb 8, 2023, at 7:19 AM, Dave Fisher  wrote:
> >
> > Hi PJ,
> >
> > Daffodil uses sbt and produces binary releases -
> > https://daffodil.apache.org/releases/3.4.0/
> > - https://GitHub.com/Apache/daffodil/
> >
> > Best,
> > Dave
> >
> > Sent from my iPhone
> >
> > On Feb 8, 2023, at 6:33 AM, PJ Fanning  wrote:
> >
> >
> > Hi everyone,
> >
> > The release management guide [1] only mentions 'source releases'. Every
> > Apache project that I am familiar with also does binary releases. For
> > applications, this makes sense - having a zip/tgz file that you can
> > download and extract - that you can then readily start the application
> > using a shell script. For libs, I'm sure these binary releases can be
> > useful too but I'm wondering if they are strictly required.
> >
> >
> > Apache Pekko is a set of libraries as opposed to an application. Our
> build
> > uses the sbt build tool and there isn't anything that I've come across
> that
> > would produce something like the binary releases that other Apache
> projects
> > release. This means we'd likely have to roll our own solution.
> >
> >
> > In terms of prioritising work towards a v1.0.0 release, it's useful to
> know
> > if we have items that could be de-prioritised.
> >
> >
> > If we do need to create binary releases, are there any guidelines to
> follow
> > - or do we just look at other Apache libs and use their binary releases
> as
> > a guide?
> >
> >
> > Regards,
> >
> > PJ
> >
> >
> > [1] https://incubator.apache.org/guides/releasemanagement.html
> >
> >
> > -
> >
> > To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
> >
> > For additional commands, e-mail: general-h...@incubator.apache.org
> >
>
> -
> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
> For additional commands, e-mail: general-h...@incubator.apache.org
>
>

Re: [QUESTION] are binary distributions/releases required?

[PJ Fanning]

Thanks Julian for clarifying the terminology.

I think the general consensus in the Pekko team is that there is no call for 
creating binary artifacts distributions (example [1]). 

The initial user base of Pekko are users who currently use Akka but dislike the 
move to Business Source License 1.1. This user base are happy with jars 
released to Maven Central and we will be providing these as a convenience to 
our users.

If and when the source releases are approved and released, jars built at the 
same time as the source release will be published to Maven Central.

[1] 
https://www.apache.org/dyn/closer.lua/logging/log4j/2.19.0/apache-log4j-2.19.0-bin.zip


On 2023/02/08 16:46:03 Julian Hyde wrote:
> It’s useful to clarify the terminology. There’s no such thing as a “binary
> release”. Release policy [1] says:
> 
> > Every ASF release MUST contain one or more source packages
> 
> > All releases are in the form of the source materials needed to make
> changes
> > to the software being released.
> >
> > As a convenience to users that might not have the appropriate tools to
> build a
> > compiled version of the source, binary/bytecode packages MAY be
> distributed
> > alongside official Apache releases.”
> 
> The binary packages that may accompany a release are generally referred to
> as “binary artifacts” of the release.
> 
> Julian
> 
> [1] https://www.apache.org/legal/release-policy.html#artifacts
> 
> On Feb 8, 2023, at 7:19 AM, Dave Fisher  wrote:
> 
> Hi PJ,
> 
> Daffodil uses sbt and produces binary releases -
> https://daffodil.apache.org/releases/3.4.0/
> - https://GitHub.com/Apache/daffodil/
> 
> Best,
> Dave
> 
> Sent from my iPhone
> 
> On Feb 8, 2023, at 6:33 AM, PJ Fanning  wrote:
> 
> 
> Hi everyone,
> 
> The release management guide [1] only mentions 'source releases'. Every
> Apache project that I am familiar with also does binary releases. For
> applications, this makes sense - having a zip/tgz file that you can
> download and extract - that you can then readily start the application
> using a shell script. For libs, I'm sure these binary releases can be
> useful too but I'm wondering if they are strictly required.
> 
> 
> Apache Pekko is a set of libraries as opposed to an application. Our build
> uses the sbt build tool and there isn't anything that I've come across that
> would produce something like the binary releases that other Apache projects
> release. This means we'd likely have to roll our own solution.
> 
> 
> In terms of prioritising work towards a v1.0.0 release, it's useful to know
> if we have items that could be de-prioritised.
> 
> 
> If we do need to create binary releases, are there any guidelines to follow
> - or do we just look at other Apache libs and use their binary releases as
> a guide?
> 
> 
> Regards,
> 
> PJ
> 
> 
> [1] https://incubator.apache.org/guides/releasemanagement.html
> 
> 
> -
> 
> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
> 
> For additional commands, e-mail: general-h...@incubator.apache.org
> 

-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [QUESTION] are binary distributions/releases required?

[Julian Hyde]

It’s useful to clarify the terminology. There’s no such thing as a “binary
release”. Release policy [1] says:

> Every ASF release MUST contain one or more source packages

> All releases are in the form of the source materials needed to make
changes
> to the software being released.
>
> As a convenience to users that might not have the appropriate tools to
build a
> compiled version of the source, binary/bytecode packages MAY be
distributed
> alongside official Apache releases.”

The binary packages that may accompany a release are generally referred to
as “binary artifacts” of the release.

Julian

[1] https://www.apache.org/legal/release-policy.html#artifacts

On Feb 8, 2023, at 7:19 AM, Dave Fisher  wrote:

Hi PJ,

Daffodil uses sbt and produces binary releases -
https://daffodil.apache.org/releases/3.4.0/
- https://GitHub.com/Apache/daffodil/

Best,
Dave

Sent from my iPhone

On Feb 8, 2023, at 6:33 AM, PJ Fanning  wrote:


Hi everyone,

The release management guide [1] only mentions 'source releases'. Every
Apache project that I am familiar with also does binary releases. For
applications, this makes sense - having a zip/tgz file that you can
download and extract - that you can then readily start the application
using a shell script. For libs, I'm sure these binary releases can be
useful too but I'm wondering if they are strictly required.


Apache Pekko is a set of libraries as opposed to an application. Our build
uses the sbt build tool and there isn't anything that I've come across that
would produce something like the binary releases that other Apache projects
release. This means we'd likely have to roll our own solution.


In terms of prioritising work towards a v1.0.0 release, it's useful to know
if we have items that could be de-prioritised.


If we do need to create binary releases, are there any guidelines to follow
- or do we just look at other Apache libs and use their binary releases as
a guide?


Regards,

PJ


[1] https://incubator.apache.org/guides/releasemanagement.html


-

To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org

For additional commands, e-mail: general-h...@incubator.apache.org

Re: [QUESTION] are binary distributions/releases required?

[Dave Fisher]

Hi PJ,

Daffodil uses sbt and produces binary releases - 
https://daffodil.apache.org/releases/3.4.0/
- https://GitHub.com/Apache/daffodil/

Best,
Dave

Sent from my iPhone

> On Feb 8, 2023, at 6:33 AM, PJ Fanning  wrote:
> 
> Hi everyone,
> The release management guide [1] only mentions 'source releases'. Every 
> Apache project that I am familiar with also does binary releases. For 
> applications, this makes sense - having a zip/tgz file that you can download 
> and extract - that you can then readily start the application using a shell 
> script. For libs, I'm sure these binary releases can be useful too but I'm 
> wondering if they are strictly required.
> 
> Apache Pekko is a set of libraries as opposed to an application. Our build 
> uses the sbt build tool and there isn't anything that I've come across that 
> would produce something like the binary releases that other Apache projects 
> release. This means we'd likely have to roll our own solution. 
> 
> In terms of prioritising work towards a v1.0.0 release, it's useful to know 
> if we have items that could be de-prioritised.
> 
> If we do need to create binary releases, are there any guidelines to follow - 
> or do we just look at other Apache libs and use their binary releases as a 
> guide? 
> 
> Regards,
> PJ
> 
> [1] https://incubator.apache.org/guides/releasemanagement.html
> 
> -
> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
> For additional commands, e-mail: general-h...@incubator.apache.org
> 

Re: [QUESTION] are binary distributions/releases required?

[Sheng Wu]

Hi

Only source codes(tars) are treated as releases. So generally, you
could only put the source tars as the vote releases.

Meanwhile, we should check the runtime dependencies about License
compatibility, such as no Catalog X or commercial license dependencies
in the runtime(especially not optional).

Sheng Wu 吴晟
Twitter, wusheng1108

PJ Fanning  于2023年2月8日周三 22:33写道：
>
> Hi everyone,
> The release management guide [1] only mentions 'source releases'. Every 
> Apache project that I am familiar with also does binary releases. For 
> applications, this makes sense - having a zip/tgz file that you can download 
> and extract - that you can then readily start the application using a shell 
> script. For libs, I'm sure these binary releases can be useful too but I'm 
> wondering if they are strictly required.
>
> Apache Pekko is a set of libraries as opposed to an application. Our build 
> uses the sbt build tool and there isn't anything that I've come across that 
> would produce something like the binary releases that other Apache projects 
> release. This means we'd likely have to roll our own solution.
>
> In terms of prioritising work towards a v1.0.0 release, it's useful to know 
> if we have items that could be de-prioritised.
>
> If we do need to create binary releases, are there any guidelines to follow - 
> or do we just look at other Apache libs and use their binary releases as a 
> guide?
>
> Regards,
> PJ
>
> [1] https://incubator.apache.org/guides/releasemanagement.html
>
> -
> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
> For additional commands, e-mail: general-h...@incubator.apache.org
>

-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org

Re: [QUESTION] are binary distributions/releases required?

[tison]

Hi PJ,

Only source releases are required. Apache Kvrocks (Incubating) release
2.1.0 (the first Apache release) with sources only, although there's a
following vote for Docker release due to user's requirement :)

You may refer to:

https://lists.apache.org/thread/v63xyr8rw5o7h0flt3fx3mrn9vxsyskm
https://lists.apache.org/thread/k744nbjf6vhvwkf8fb02t4l08rjxo7n7

I agree to release only sources helps the podling getting started with the
new process, while please keep collecting users feedback :)

Best,
tison.


PJ Fanning  于2023年2月8日周三 22:33写道：

> Hi everyone,
> The release management guide [1] only mentions 'source releases'. Every
> Apache project that I am familiar with also does binary releases. For
> applications, this makes sense - having a zip/tgz file that you can
> download and extract - that you can then readily start the application
> using a shell script. For libs, I'm sure these binary releases can be
> useful too but I'm wondering if they are strictly required.
>
> Apache Pekko is a set of libraries as opposed to an application. Our build
> uses the sbt build tool and there isn't anything that I've come across that
> would produce something like the binary releases that other Apache projects
> release. This means we'd likely have to roll our own solution.
>
> In terms of prioritising work towards a v1.0.0 release, it's useful to
> know if we have items that could be de-prioritised.
>
> If we do need to create binary releases, are there any guidelines to
> follow - or do we just look at other Apache libs and use their binary
> releases as a guide?
>
> Regards,
> PJ
>
> [1] https://incubator.apache.org/guides/releasemanagement.html
>
> -
> To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
> For additional commands, e-mail: general-h...@incubator.apache.org
>
>

[QUESTION] are binary distributions/releases required?

[PJ Fanning]

Hi everyone,
The release management guide [1] only mentions 'source releases'. Every Apache 
project that I am familiar with also does binary releases. For applications, 
this makes sense - having a zip/tgz file that you can download and extract - 
that you can then readily start the application using a shell script. For libs, 
I'm sure these binary releases can be useful too but I'm wondering if they are 
strictly required.

Apache Pekko is a set of libraries as opposed to an application. Our build uses 
the sbt build tool and there isn't anything that I've come across that would 
produce something like the binary releases that other Apache projects release. 
This means we'd likely have to roll our own solution. 

In terms of prioritising work towards a v1.0.0 release, it's useful to know if 
we have items that could be de-prioritised.

If we do need to create binary releases, are there any guidelines to follow - 
or do we just look at other Apache libs and use their binary releases as a 
guide? 

Regards,
PJ

[1] https://incubator.apache.org/guides/releasemanagement.html

-
To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org
For additional commands, e-mail: general-h...@incubator.apache.org