On 5/5/05, Dion Gillard <[EMAIL PROTECTED]> wrote:
> Where do you see the Eclipse version number (not the artifact version)
> fitting in?
I was under the impression this would be captured within the archive itself.
But should it need to be part of the path, it is probably sensible to
make it part
> Btw, is there any rules that govern what a project
> can drop or not drop into the respository?
Anything otherwise distributable should be fine.
As far as I'm concerned, the repository is still the right place for
these - perhaps under /eclipse-plugins/ (or some more suitable name)
instead of
I echo David's sentiments on this. I'd be interested to know what is
in the eclipse metadata you want to attach to the various artifacts in
the repository, and whether any of it coincides with existing metadata
formats in use here, such as the following for parts of jakarta
commons:
http://www.apa
> I'm wondering if uploading pgp signatures is still somewhere
> on the agenda. They are important for integrity checks of
> the repository.
I checked Steve's response, and don't see any indication in Ant or
smartfrog that there is PGP support yet... as far as I know there is
not.
It defini
> will do. Where is the upload process documented?
http://maven.apache.org/reference/repository-upload.html
Cheers,
Brett
> I note the maven2 .md5 files are binary. I think I prefer hex, as it
> is easier to manually verify. I ended up checking the md5 sum off the
> maven1 files.
That's a bug in the m1->m2 repository converter. I'll check it out.
> Here is what I'd like
> -a 'dotted' project to test that logic
> -so
Sorry, I meant: http.proxyHost, http.proxyPort and counterparts as
standard names.
- Brett
On Apr 12, 2005 2:09 AM, Steve Loughran <[EMAIL PROTECTED]> wrote:
> On Apr 11, 2005 4:39 PM, Brett Porter <[EMAIL PROTECTED]> wrote:
>
> > If you needed that, couldn't the
> you know, I wonder if we can't create a defacto place in the Java1.4
> preferences world for storing proxy information across apps. There is
> something for applets, but nothing for apps in general.
>
> Imagine a System node "org.apache.jakarta.proxy" that would be read by
> everything that care
> There is no good solution here. Really.
sure - I understand that. All I am trying to think of is something as
secure as your proposal, but less intrusive to the user. Or at least a
decent way to aid them with tools.
Really, I've been in favour of using bouncycastle and PGP for a long
time, so
> the smartfrog solution is brute force unforgiving: you must declare
> the SHA1 or MD5 value in a download
Right... I'm sure users wanting security will put up with a certain
level of pain. I'm still not sure how you securely publish the value
initially (though this certainly prevents later tampe
(I'm assuming you meant to reply to all by the content - it happens
frequently with other gmail users - sorry if I'm out of place
repeating your message)
> I'd probably retain my own in the Ant codebase, but SmartFrog could
> take wagon -as long as our signing it doesnt break it (smartfrog runs
>
> Ant is still debating whether or not to EOL 1.2 support, following
> Sun's lead. I hadnt been over enthused about -and certainly against
> dropping 1.3 support given how some platforms (e.g. FreeBSD) are still
> 1.3 only.
right... so if we were to roll back the API and the lightweight HTTP
provi
> planetapache.org knows everything :)
Yes, I just caught your post :)
> This is cool.
> -what is the local cache name/layout?
Configurable, defaults to ~/.m2/repository and uses the "default"
layout, which is the new one.
>
> I'll add maven2 lib support to ant CVS_HEAD and make it the default
> 1. I see that a Maven2 alpha is out: is it still using the Maven1
> repository structure?
News travels fast... I was going to post about that here this morning :)
New repository: http://www.ibiblio.org/maven2/
m2 can use the m1 structure, but by default it uses a new one. I
believe it is almos
The sync was no longer working due to the www.apache.org name moving.
I've updated it to reference minotaur and am rerunning it now - expect
them there within the hour.
Normally alerts would come to this list, but it was moved to a private
address on request due to some extra noise mails which we
> +1 to only email when a change.
I'm sure Carlos will get to it soon. Sorry for the noise.
> Unsure why, but I'm not seeing a To: address for it in gmail, just a
> Reply-To:.
My guess is that the recipients are all BCC'd. Most mail clients say
something like "To: Undisclosed recipients". This
Hi folks,
I've put up basically a TODO list from recent discussions. Sorry it
took so long.
http://wiki.apache.org/ASFRepository/BrettPorter
Did I miss anything?
I'd hope to integrate this more with the rest of the wiki and clean up
over time.
Cheers,
Brett
ult to the most secure setting. Similar to the new version of yum, it
> won't connect to yum repositories unless you import keys from the
> repositories, or turn off key verification - secure by default.
>
> Tim
>
> -----Original Message-
> From: Brett Porter [mailto:[EMA
> Would we be talking about "gpg --armor --output
> commons-foo-1.2.jar.md5.asc --detach-sig commons-foo-1.2.jar". Or, is
> there some other mechanism we would need to go through?
This is what I'd intended to do in Wagon using Bouncycastle. And as
Steve mentions, it can be at the users discretion:
Hi Steve,
I'd like to do whatever we can to get better security on this stuff. I
just need to get my head around what JAR signing provides in
comparison to key signing, and what impact it might have on existing
code. I'll read up on it.
Is there a rough timeframe on the next Ant release so we can
On Wed, 12 Jan 2005 08:53:04 -0500, Mark R. Diggory <[EMAIL PROTECTED]> wrote:
> As I was discussing in the jakarta-general list earlier. There are a
> number of projects with mavan project properties setup with the
> following parameter.
>
> maven.repo.remote=http://www.apache.org/dist/java-repos
> Clearly there is vague definition here if this symlink can point at a
> release like this.
Yes, this is exactly the problem. Theoretical intention aside, all
SNAPSHOT means in practice now is that if you depend on it, Maven will
always check for something newer. What newer means is at the
discre
te:
> On Wed, 12 Jan 2005, Brett Porter wrote:
>
> > Date: Wed, 12 Jan 2005 09:39:54 +1100
> > From: Brett Porter <[EMAIL PROTECTED]>
> > To: [EMAIL PROTECTED]
> > Subject: Re: Where to publish Xalan code on http://www.apache.org/dist
> > (fwd)
> >
Henk,
My bad. I copied it to the wrong location. I fixed the JARs, forgot
the POMs and will remove them next time I have SSH access.
- Brett
On Tue, 11 Jan 2005 22:34:44 +0100 (MET), Henk P. Penning
<[EMAIL PROTECTED]> wrote:
> On Tue, 11 Jan 2005, Mark R. Diggory wrote:
>
> > Date: Tue, 11 Ja
On Wed, 5 Jan 2005 14:24:13 -0500, Noel J. Bergman <[EMAIL PROTECTED]> wrote:
> Is Maven willing to provide suitable support for Ant to use it? I just want
> to make sure that this is not the Maven repository, but is THE repository.
> Tool-agnostic.
Yes - I've already discussed this and Steve and
> Why not something like:
>
>
...
>
>
>
>
>
>
In Maven 1.0, there is a maven.repo.remote property that allows you to
select what repositories to search on a per-project basis.
Maven 1.1 wil
> I'll be the Ant rep.
Great, thanks.
> I am co-author of the (still stabilising) Ant task; it'd
yeah, I've got to 50 mail threads sitting flagged in gmail to read one
day, as this is about the extent of what I know about it :) (after you
introduced it to repository@ last year)
> 1. security.
putting repository@ back on the list - gmail tends to drop lists
unless you reply to all (hope this is what you intended).
> Seems a reasonable first step. However it seems a little fragile if a
> project changes artifact names or splits an existing artifact. e.g. if
> commons-jelly splits into je
> Take the commons-jelly/ directories on ibiblio and place them in a
> similar structure as an example.
org/apache/commons/jelly/commons-jelly/1.0/commons-jelly-1.0.jar[.md5|.asc], etc
org/apache/commons/jelly/commons-jelly-tags-ant/1.0/commons-jelly-1.0.jar
org/apache/commons/jelly/commons-jelly
> Ant is adding a task so that providers can plug into it, and Wagon can
> continue to be used in Ant.
Absolutely - all I meant was that Wagon maintaining its own Ant task
was probably not necessary given that. Wagon can plugin in to that.
> If we splinter implementations, the repository effort w
Hi,
Firstly, can I check who is still actively involved here other than
Nicola, Mark and myself?
Continuing on what was started in this thread:
> I'd add that to use a common repository, there needs an implementation
> for all projects to use. It's easy, correct and resonable to think that
> it
> 1.) just delete any interim builds (they are already archived on
> archive.apache.org)
>
> 2.) delete and any snapshot symlinks referring to them.
>
> 3.) delete and sanpshot-version files referring to an interim build.
+1 to these with some questions and additions:
4) document this as policy
Hi,
Was there a final decision made to change the format of md5's to:
d1dcb0fbee884bb855bb327b8190af36 commons-collections-3.1.jar
ie, md5 hash, 1 space, filename
If so, I'd like to drop the change into Maven 1.1.
Will this cause any problems for any scripts running on ASF boxes?
Cheers,
Bret
> I suspect this is the same issue encountered earlier in the month where
> Dion Gillard had updated/published some jars using maven. At the same
> point in time some modifications occurred int he directory which we
> could not identify the origin of.
Maven was previously setting some funny permis
Hi Mark,
Interesting idea. Doing this always makes me feel a little uneasy,
though given the reasons you've listed I can't think of any problems
other than a gut feel.
I guess the reason for that is that JARs really shouldn't be changed
once published. The exception is snapshots (not even timesta
aired_repo/commons-jelly/jars/
(you can obviously grab these directly on cvs.apache.org)
I'd really appreciate you looking into this, so that the corrupted
jars don't spread.
I still have no idea how the jars actually got changed... weird.
Thanks,
Brett
On Wed, 29 Sep 2004 01:38:00 +1000,
I tried to build maven 1.0 clean today and found out that on Sep 2,
commons-jelly and a few of its tag libs had changed on ibiblio. These
were already released jars that changed size. I checked around and
discovered the source of the change seems to be java-repository at
Apache.
Any ideas how this
I don't see it on ibiblio (beanutils-core and beanutils-collections
are there, but beanutils itself is not).
Do you have the correct permissions on java-repository?
- Brett
On Tue, 3 Aug 2004 22:04:51 +0100, robert burrell donkin
<[EMAIL PROTECTED]> wrote:
> i uploaded the jars from the beanutil
I definitely use thunderbird from home... but I can't use it at work
because I need the outlook calendar, etc. I'm certainly tempted though
:)
- Brett
On Wed, 30 Jun 2004 08:52:42 +0200, Nicola Ken Barozzi
<[EMAIL PROTECTED]> wrote:
>
> Brett Porter wrote:
>
>
Apologies for continually sending in HTML format BTW - Outlook at work
insists on "deciding the best format" for me despite setting the email
address to plain text only. I'll resubscribe from a different email address
and use webmail :)
- Brett
-Original Message-----
From: Bre
Title: RE: betwixt 0.5 release jars
Thanks for clarifying that Mark - makes sense.
While Maven uploads directly, I make a habit of doing it on a machine with a fast connection so shouldn't have a problem with our releases, however this could still be a concern.
Are there any filenames that
Title: RE: betwixt 0.5 release jars
> i'm a little sensitive to the needs for supervision at the moment
> (after being strongly reminded on this list before by members
> who know
> about these issues). the jar's i've posted have been approved for
> release. i don't really want to have
Title: RE: betwixt 0.5 release jars
Hi Robert,
Do you build the final release with Maven or Ant?
If it is Maven, the commons build would need to be changed to automate this, but it's pretty easy.
Change:
/www/jakarta.apache.org/builds/jakarta-commons
To:
www.apache.org
/www/www.apache.or
Title: RE: Proposals
I imagine:
.../httpd/dists/httpd-2.0.45-src.zip
.../httpd/dists/httpd-2.0.45-src.tar.gz
.../httpd/dists/httpd-2.0.45-bin-solaris.tar.gz
.../httpd/dists/httpd-2.0.45-bin-linux.tar.gz
So I guess type != ext, which makes sense.
I would prefer, for example:
.../so/mod_
Title: RE: Proposals
Maven's is
http:s/[-][-].
Which should cover all platforms (as artifact_type can be dll, jar, maven-plugin, doc, etc).
This also means http://repo.apache.org/org.apache.xerces can be the single place to download Xerces in C++, Java, cobol, whatever.
I imagined the
45 matches
Mail list logo
