RE: Questions about the release

[Zheng, Kai]

Hi Colm,

Thanks for this! 

>> Kai, is there a reason that the zookeeper + nimbus dependencies are not in 
>> the lib directories of the distributions?
This is a good question I happened to know the answer.

Yes we have already supported various KDC back ends, like the LDAP, ZK ones, 
but which one is to bundle in the KDC dist and used by default? It's hard to 
tell, because each one seems to need some time to mature. I'd suggest we take 
time to improve them when received user interests. So that's why we didn't put 
all the supported back ends in the dist.

Nimbus is another story, it's for the token support. It's not bundled by 
default because I'm not sure most users would want the token support.

Considering this release trouble, now I intend we don't bundle this plugins 
that involve external deps heavily, but it's just a thought. We can discuss 
about the way later. For now less change much better.

Thanks again.

Regards,
Kai

-Original Message-
From: Colm O hEigeartaigh [mailto:cohei...@apache.org] 
Sent: Tuesday, May 09, 2017 4:52 PM
To: kerby@directory.apache.org
Subject: Re: Questions about the release

OK I have made some changes based on my understanding of what is required.
Please correct me if I'm wrong!

Mockito, Hamcrest (junit) are test dependencies and are not required in the 
NOTICE file or to specify the license.

We bundle Netty and SLF4J in the distribution. So we have the SLF4J license 
included in "licenses" and mentioned in NOTICE, as well as the Netty NOTICE.

From what I can see from kerby-dist/kdc-dist/target/lib and 
kerby-dist/tool-dist/target/lib, all of the dependencies are covered.
However, in NOTICE we also have the "nimbus-jose-jwt," NOTICE and the "JLine" 
NOTICE (from Zookeeper). However, it appears we don't bundle either of these in 
the "lib" directories so I'm not sure why they are there.

Kai, is there a reason that the zookeeper + nimbus dependencies are not in the 
lib directories of the distributions?

Colm.

On Tue, May 9, 2017 at 7:35 AM, Zheng, Kai  wrote:

> Thanks Emmanuel and Colm! Could we lend your hands on this? Sure if 
> your bandwidth allows. We're much dummy in such things and seem to 
> have on confidence to get it right. :(
>
> For the long term, I would suggest we reorganize Kerby into two projects:
> kerby-kerb for the Kerberos core and library; kerby-kdc. The two 
> projects can be separately released in their own appropriate cycles. 
> For Kerby-kerb, it avoids any 3rd party deps.
>
> Regards,
> Kai
>
> -Original Message-
> From: Emmanuel Lécharny [mailto:elecha...@gmail.com]
> Sent: Tuesday, May 09, 2017 7:17 AM
> To: kerby@directory.apache.org
> Subject: Re: Questions about the release
>
>
>
> Le 08/05/2017 à 21:40, Colm O hEigeartaigh a écrit :
> > I don't think we need the Mockito notice as it's a test dependency,
> right?
>
> right.
>
> --
> Emmanuel Lecharny
>
> Symas.com
> directory.apache.org
>
>


--
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com

Re: Questions about the release

[Colm O hEigeartaigh]

OK I have made some changes based on my understanding of what is required.
Please correct me if I'm wrong!

Mockito, Hamcrest (junit) are test dependencies and are not required in the
NOTICE file or to specify the license.

We bundle Netty and SLF4J in the distribution. So we have the SLF4J license
included in "licenses" and mentioned in NOTICE, as well as the Netty NOTICE.

>From what I can see from kerby-dist/kdc-dist/target/lib and
kerby-dist/tool-dist/target/lib, all of the dependencies are covered.
However, in NOTICE we also have the "nimbus-jose-jwt," NOTICE and the
"JLine" NOTICE (from Zookeeper). However, it appears we don't bundle either
of these in the "lib" directories so I'm not sure why they are there.

Kai, is there a reason that the zookeeper + nimbus dependencies are not in
the lib directories of the distributions?

Colm.

On Tue, May 9, 2017 at 7:35 AM, Zheng, Kai  wrote:

> Thanks Emmanuel and Colm! Could we lend your hands on this? Sure if your
> bandwidth allows. We're much dummy in such things and seem to have on
> confidence to get it right. :(
>
> For the long term, I would suggest we reorganize Kerby into two projects:
> kerby-kerb for the Kerberos core and library; kerby-kdc. The two projects
> can be separately released in their own appropriate cycles. For Kerby-kerb,
> it avoids any 3rd party deps.
>
> Regards,
> Kai
>
> -Original Message-
> From: Emmanuel Lécharny [mailto:elecha...@gmail.com]
> Sent: Tuesday, May 09, 2017 7:17 AM
> To: kerby@directory.apache.org
> Subject: Re: Questions about the release
>
>
>
> Le 08/05/2017 à 21:40, Colm O hEigeartaigh a écrit :
> > I don't think we need the Mockito notice as it's a test dependency,
> right?
>
> right.
>
> --
> Emmanuel Lecharny
>
> Symas.com
> directory.apache.org
>
>


-- 
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com

Re: Questions about the release

[Colm O hEigeartaigh]

OK, seeing as we don't bundle them by default, then IMO we don't need to
include them in the NOTICE file. Emmanuel, can you confirm?

Colm.

On Tue, May 9, 2017 at 10:11 AM, Zheng, Kai  wrote:

> Hi Colm,
>
> Thanks for this!
>
> >> Kai, is there a reason that the zookeeper + nimbus dependencies are not
> in the lib directories of the distributions?
> This is a good question I happened to know the answer.
>
> Yes we have already supported various KDC back ends, like the LDAP, ZK
> ones, but which one is to bundle in the KDC dist and used by default? It's
> hard to tell, because each one seems to need some time to mature. I'd
> suggest we take time to improve them when received user interests. So
> that's why we didn't put all the supported back ends in the dist.
>
> Nimbus is another story, it's for the token support. It's not bundled by
> default because I'm not sure most users would want the token support.
>
> Considering this release trouble, now I intend we don't bundle this
> plugins that involve external deps heavily, but it's just a thought. We can
> discuss about the way later. For now less change much better.
>
> Thanks again.
>
> Regards,
> Kai
>
> -Original Message-
> From: Colm O hEigeartaigh [mailto:cohei...@apache.org]
> Sent: Tuesday, May 09, 2017 4:52 PM
> To: kerby@directory.apache.org
> Subject: Re: Questions about the release
>
> OK I have made some changes based on my understanding of what is required.
> Please correct me if I'm wrong!
>
> Mockito, Hamcrest (junit) are test dependencies and are not required in
> the NOTICE file or to specify the license.
>
> We bundle Netty and SLF4J in the distribution. So we have the SLF4J
> license included in "licenses" and mentioned in NOTICE, as well as the
> Netty NOTICE.
>
> From what I can see from kerby-dist/kdc-dist/target/lib and
> kerby-dist/tool-dist/target/lib, all of the dependencies are covered.
> However, in NOTICE we also have the "nimbus-jose-jwt," NOTICE and the
> "JLine" NOTICE (from Zookeeper). However, it appears we don't bundle either
> of these in the "lib" directories so I'm not sure why they are there.
>
> Kai, is there a reason that the zookeeper + nimbus dependencies are not in
> the lib directories of the distributions?
>
> Colm.
>
> On Tue, May 9, 2017 at 7:35 AM, Zheng, Kai  wrote:
>
> > Thanks Emmanuel and Colm! Could we lend your hands on this? Sure if
> > your bandwidth allows. We're much dummy in such things and seem to
> > have on confidence to get it right. :(
> >
> > For the long term, I would suggest we reorganize Kerby into two projects:
> > kerby-kerb for the Kerberos core and library; kerby-kdc. The two
> > projects can be separately released in their own appropriate cycles.
> > For Kerby-kerb, it avoids any 3rd party deps.
> >
> > Regards,
> > Kai
> >
> > -Original Message-
> > From: Emmanuel Lécharny [mailto:elecha...@gmail.com]
> > Sent: Tuesday, May 09, 2017 7:17 AM
> > To: kerby@directory.apache.org
> > Subject: Re: Questions about the release
> >
> >
> >
> > Le 08/05/2017 à 21:40, Colm O hEigeartaigh a écrit :
> > > I don't think we need the Mockito notice as it's a test dependency,
> > right?
> >
> > right.
> >
> > --
> > Emmanuel Lecharny
> >
> > Symas.com
> > directory.apache.org
> >
> >
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>



-- 
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com

Re: Questions about the release

[Emmanuel Lécharny]

Le 09/05/2017 à 11:16, Colm O hEigeartaigh a écrit :
> OK, seeing as we don't bundle them by default, then IMO we don't need to
> include them in the NOTICE file. Emmanuel, can you confirm?
Everything that is not bundled does not have to be into N files.

If there is no way a user can grab the sources and generate a package
from those source that contain this bundle, then there is no need to
have the N file in the source either. OTOH, if the user can grab the
source, build it to produce a package that will contain the bundle, then
we need teh N files somwhere so that they get added when the user
build the packaged. In any case, it should not be present in our source
package N

To be very clear : there are two kinds of N files :
- those we include in our source or binary packages (if we provide some).
- those that get included when we generate some packages from the source
package (they are 'second order' N files)

The first category makes our package legit, teh second category protect
our users when they build their own package using our build system
(typically the 'dist' modules).

-- 
Emmanuel Lecharny

Symas.com
directory.apache.org

Re: Questions about the release

[Colm O hEigeartaigh]

Thanks Emmanuel. The user would have to add zookeeper/nimbus in the poms
before generating the distribution to add them, so I am going to remove
these from the NOTICE file as they are not required.

OK here are the changes I have made...please review:

1) The root NOTICE just includes the standard Apache copyright notice:

https://github.com/apache/directory-kerby/blob/trunk/NOTICE

2) The two "distributions" of "kdc-dist" and "tool-dist" have the following
NOTICE files:

https://github.com/apache/directory-kerby/blob/trunk/kerby-dist/kdc-dist/NOTICE
https://github.com/apache/directory-kerby/blob/trunk/kerby-dist/tool-dist/NOTICE

and the following identical license folders:

https://github.com/apache/directory-kerby/tree/trunk/kerby-dist/tool-dist/licenses
https://github.com/apache/directory-kerby/tree/trunk/kerby-dist/kdc-dist/licenses

We only bundle Netty + SLF4J in "kdc-dist" and only SLF4J in the tool-dist,
so I think we are covered.

Colm.


-- 
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com

On Tue, May 9, 2017 at 11:04 AM, Emmanuel Lécharny 
wrote:

>
>
> Le 09/05/2017 à 11:16, Colm O hEigeartaigh a écrit :
> > OK, seeing as we don't bundle them by default, then IMO we don't need to
> > include them in the NOTICE file. Emmanuel, can you confirm?
> Everything that is not bundled does not have to be into N files.
>
> If there is no way a user can grab the sources and generate a package
> from those source that contain this bundle, then there is no need to
> have the N file in the source either. OTOH, if the user can grab the
> source, build it to produce a package that will contain the bundle, then
> we need teh N files somwhere so that they get added when the user
> build the packaged. In any case, it should not be present in our source
> package N
>
> To be very clear : there are two kinds of N files :
> - those we include in our source or binary packages (if we provide some).
> - those that get included when we generate some packages from the source
> package (they are 'second order' N files)
>
> The first category makes our package legit, teh second category protect
> our users when they build their own package using our build system
> (typically the 'dist' modules).
>
> --
> Emmanuel Lecharny
>
> Symas.com
> directory.apache.org
>
>


-- 
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com

Re: Questions about the release

[Emmanuel Lécharny]

Le 09/05/2017 à 12:24, Colm O hEigeartaigh a écrit :
> Thanks Emmanuel. The user would have to add zookeeper/nimbus in the poms
> before generating the distribution to add them, so I am going to remove
> these from the NOTICE file as they are not required.
>
> OK here are the changes I have made...please review:
>
> 1) The root NOTICE just includes the standard Apache copyright notice:
>
> https://github.com/apache/directory-kerby/blob/trunk/NOTICE
>
> 2) The two "distributions" of "kdc-dist" and "tool-dist" have the following
> NOTICE files:
>
> https://github.com/apache/directory-kerby/blob/trunk/kerby-dist/kdc-dist/NOTICE
> https://github.com/apache/directory-kerby/blob/trunk/kerby-dist/tool-dist/NOTICE
>
> and the following identical license folders:
>
> https://github.com/apache/directory-kerby/tree/trunk/kerby-dist/tool-dist/licenses
> https://github.com/apache/directory-kerby/tree/trunk/kerby-dist/kdc-dist/licenses
>
> We only bundle Netty + SLF4J in "kdc-dist" and only SLF4J in the tool-dist,
> so I think we are covered.


Sounds good to me.

Have you taken into account the transitive dependencies ? (ie, N for
things that are embedded in Netty).

-- 
Emmanuel Lecharny

Symas.com
directory.apache.org

Re: Questions about the release

[Emmanuel Lécharny]

Le 09/05/2017 à 14:23, Colm O hEigeartaigh a écrit :
> Hi Kai,
>
> What matters is what jars we are including in the "lib". Any changes Netty
> made to third party dependencies in these jars must be in the
> NOTICE/licenses.

Colm is right.

Now, it's enough - assuming that they have been double checked - to
include Netty's N files in our dist packages, because Netty has
already done the work : ie gathering the dependencies they are using.



I know, I know, this is a painful process...

-- 
Emmanuel Lecharny

Symas.com
directory.apache.org

Re: Questions about the release

[Colm O hEigeartaigh]

I haven't. So I think I should include all "This product contains a
modified portion" portions from the NOTICE file, but not "This product
optionally depends on" from here:

https://github.com/netty/netty/blob/4.1/NOTICE.txt

? As well as any of the licenses that are referred.

Colm.

On Tue, May 9, 2017 at 12:46 PM, Emmanuel Lécharny 
wrote:

>
>
> Le 09/05/2017 à 12:24, Colm O hEigeartaigh a écrit :
> > Thanks Emmanuel. The user would have to add zookeeper/nimbus in the poms
> > before generating the distribution to add them, so I am going to remove
> > these from the NOTICE file as they are not required.
> >
> > OK here are the changes I have made...please review:
> >
> > 1) The root NOTICE just includes the standard Apache copyright notice:
> >
> > https://github.com/apache/directory-kerby/blob/trunk/NOTICE
> >
> > 2) The two "distributions" of "kdc-dist" and "tool-dist" have the
> following
> > NOTICE files:
> >
> > https://github.com/apache/directory-kerby/blob/trunk/
> kerby-dist/kdc-dist/NOTICE
> > https://github.com/apache/directory-kerby/blob/trunk/
> kerby-dist/tool-dist/NOTICE
> >
> > and the following identical license folders:
> >
> > https://github.com/apache/directory-kerby/tree/trunk/
> kerby-dist/tool-dist/licenses
> > https://github.com/apache/directory-kerby/tree/trunk/
> kerby-dist/kdc-dist/licenses
> >
> > We only bundle Netty + SLF4J in "kdc-dist" and only SLF4J in the
> tool-dist,
> > so I think we are covered.
>
>
> Sounds good to me.
>
> Have you taken into account the transitive dependencies ? (ie, N for
> things that are embedded in Netty).
>
> --
> Emmanuel Lecharny
>
> Symas.com
> directory.apache.org
>
>


-- 
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com

RE: Questions about the release

[Zheng, Kai]

Hi Colm and Emmanuel,

Regarding Netty, what we used is the TCP/UDP network transport support, which 
should be one of its basic functionalities. We haven't used any other parts, 
like the one JBoss marshalling function. The relevant codes are in kerby KDC. 
Hope this helps.

Regards,
Kai 

-Original Message-
From: Colm O hEigeartaigh [mailto:cohei...@apache.org] 
Sent: Tuesday, May 09, 2017 8:12 PM
To: kerby@directory.apache.org
Subject: Re: Questions about the release

I haven't. So I think I should include all "This product contains a modified 
portion" portions from the NOTICE file, but not "This product optionally 
depends on" from here:

https://github.com/netty/netty/blob/4.1/NOTICE.txt

? As well as any of the licenses that are referred.

Colm.

On Tue, May 9, 2017 at 12:46 PM, Emmanuel Lécharny 
wrote:

>
>
> Le 09/05/2017 à 12:24, Colm O hEigeartaigh a écrit :
> > Thanks Emmanuel. The user would have to add zookeeper/nimbus in the 
> > poms before generating the distribution to add them, so I am going 
> > to remove these from the NOTICE file as they are not required.
> >
> > OK here are the changes I have made...please review:
> >
> > 1) The root NOTICE just includes the standard Apache copyright notice:
> >
> > https://github.com/apache/directory-kerby/blob/trunk/NOTICE
> >
> > 2) The two "distributions" of "kdc-dist" and "tool-dist" have the
> following
> > NOTICE files:
> >
> > https://github.com/apache/directory-kerby/blob/trunk/
> kerby-dist/kdc-dist/NOTICE
> > https://github.com/apache/directory-kerby/blob/trunk/
> kerby-dist/tool-dist/NOTICE
> >
> > and the following identical license folders:
> >
> > https://github.com/apache/directory-kerby/tree/trunk/
> kerby-dist/tool-dist/licenses
> > https://github.com/apache/directory-kerby/tree/trunk/
> kerby-dist/kdc-dist/licenses
> >
> > We only bundle Netty + SLF4J in "kdc-dist" and only SLF4J in the
> tool-dist,
> > so I think we are covered.
>
>
> Sounds good to me.
>
> Have you taken into account the transitive dependencies ? (ie, N for 
> things that are embedded in Netty).
>
> --
> Emmanuel Lecharny
>
> Symas.com
> directory.apache.org
>
>


--
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com

Re: Questions about the release

[Colm O hEigeartaigh]

Hi Kai,

What matters is what jars we are including in the "lib". Any changes Netty
made to third party dependencies in these jars must be in the
NOTICE/licenses.

Colm.

On Tue, May 9, 2017 at 1:20 PM, Zheng, Kai  wrote:

> Hi Colm and Emmanuel,
>
> Regarding Netty, what we used is the TCP/UDP network transport support,
> which should be one of its basic functionalities. We haven't used any other
> parts, like the one JBoss marshalling function. The relevant codes are in
> kerby KDC. Hope this helps.
>
> Regards,
> Kai
>
> -Original Message-
> From: Colm O hEigeartaigh [mailto:cohei...@apache.org]
> Sent: Tuesday, May 09, 2017 8:12 PM
> To: kerby@directory.apache.org
> Subject: Re: Questions about the release
>
> I haven't. So I think I should include all "This product contains a
> modified portion" portions from the NOTICE file, but not "This product
> optionally depends on" from here:
>
> https://github.com/netty/netty/blob/4.1/NOTICE.txt
>
> ? As well as any of the licenses that are referred.
>
> Colm.
>
> On Tue, May 9, 2017 at 12:46 PM, Emmanuel Lécharny 
> wrote:
>
> >
> >
> > Le 09/05/2017 à 12:24, Colm O hEigeartaigh a écrit :
> > > Thanks Emmanuel. The user would have to add zookeeper/nimbus in the
> > > poms before generating the distribution to add them, so I am going
> > > to remove these from the NOTICE file as they are not required.
> > >
> > > OK here are the changes I have made...please review:
> > >
> > > 1) The root NOTICE just includes the standard Apache copyright notice:
> > >
> > > https://github.com/apache/directory-kerby/blob/trunk/NOTICE
> > >
> > > 2) The two "distributions" of "kdc-dist" and "tool-dist" have the
> > following
> > > NOTICE files:
> > >
> > > https://github.com/apache/directory-kerby/blob/trunk/
> > kerby-dist/kdc-dist/NOTICE
> > > https://github.com/apache/directory-kerby/blob/trunk/
> > kerby-dist/tool-dist/NOTICE
> > >
> > > and the following identical license folders:
> > >
> > > https://github.com/apache/directory-kerby/tree/trunk/
> > kerby-dist/tool-dist/licenses
> > > https://github.com/apache/directory-kerby/tree/trunk/
> > kerby-dist/kdc-dist/licenses
> > >
> > > We only bundle Netty + SLF4J in "kdc-dist" and only SLF4J in the
> > tool-dist,
> > > so I think we are covered.
> >
> >
> > Sounds good to me.
> >
> > Have you taken into account the transitive dependencies ? (ie, N for
> > things that are embedded in Netty).
> >
> > --
> > Emmanuel Lecharny
> >
> > Symas.com
> > directory.apache.org
> >
> >
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>



-- 
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com

Re: Questions about the release

[Colm O hEigeartaigh]

OK I have added all of the parts from the Netty NOTICE that were "modified"
in Netty and licenses, so long as they weren't ASL v2.0. Emmanuel, please
review and let me know if it's finally right.

https://github.com/apache/directory-kerby/tree/trunk/kerby-dist/kdc-dist

Colm.

On Tue, May 9, 2017 at 2:37 PM, Emmanuel Lécharny 
wrote:

>
>
> Le 09/05/2017 à 14:23, Colm O hEigeartaigh a écrit :
> > Hi Kai,
> >
> > What matters is what jars we are including in the "lib". Any changes
> Netty
> > made to third party dependencies in these jars must be in the
> > NOTICE/licenses.
>
> Colm is right.
>
> Now, it's enough - assuming that they have been double checked - to
> include Netty's N files in our dist packages, because Netty has
> already done the work : ie gathering the dependencies they are using.
>
>
>
> I know, I know, this is a painful process...
>
> --
> Emmanuel Lecharny
>
> Symas.com
> directory.apache.org
>
>


-- 
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com

Re: Questions about the release

[Colm O hEigeartaigh]

Great thanks! I will re-spin the release.

Colm.

On Tue, May 9, 2017 at 4:01 PM, Emmanuel Lécharny 
wrote:

>
>
> Le 09/05/2017 à 16:54, Colm O hEigeartaigh a écrit :
> > OK I have added all of the parts from the Netty NOTICE that were
> "modified"
> > in Netty and licenses, so long as they weren't ASL v2.0. Emmanuel, please
> > review and let me know if it's finally right.
> >
> > https://github.com/apache/directory-kerby/tree/trunk/kerby-dist/kdc-dist
> >
> > Colm.
>
> That sounds correct !
>
> Thanks for the hard work !
>
> --
> Emmanuel Lecharny
>
> Symas.com
> directory.apache.org
>
>


-- 
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com