I thought I would initiate this discussion on the dependency issue I have run into with projects dependent on G 2.0.1.  But, then I had to go "offline" for a few days.  Now that someone else has run into the same problem, I guess it needs to be addressed for good.

On 8/31/07, Jeff Genender <jgenender@apache.org> wrote:
Hi,

I was building a 3rd party application with a dependency on the Geronimo
specs (jee)...and I could not get it to build because it was looking for

axis-saaj-1.3-r562247

For the life of me, I thought I had that usual maven corrupt repo issues
and I wiped out my local repo...a number of times.  I began looking
through repos and sure enough it didn't exist.  Well..I decided to look
in our pom and I found:

<axis2Version>1.3-r562247</axis2Version>

Further discussion with others resulted in finding that we have a
"special" repository that pulls these special versions. (Ok I forgot
about that).

This is going to be a problem for anyone who has a dependency on our
jars (ie. wanting to use the specs jars for a web applications, etc).
If I (a committer) had to go through this much trouble trying to figure
out how to get that dependency...I can't imagine what the standard user
will go through when writing a web or webservices application.

The point I am making here is if we are going to have special versions
of jars, we need to make these more readily available.

Here are some options I thought of:

A) Place the special jars in central so they are automatically available
to others. (Easiest approach for the user - but we are going to have to
convince other projects to put them out into their locations - that may
prove difficult).

B) Heavily, heavily document how to get around this problem by adding
our repo to their pom.  This should be easily Googled and placed in a
FAQ, because I would hazard to guess this will be a frequent question.
(probably the easiest approach for us, but this needs to be a short term
solution - and its still a PITA for our users).

I got past the problem by adding a special repo (I called it geronimo-201-private) http://svn.apache.org/repos/asf/geronimo/server/tags/2.0.1/repository.  Some of the artifacts in this repo do not have check-sum files.  I don't know if that will create a problem if some "verify-check-sum" option is enabled in the build.

C) Convince the other projects to get their releases in order and get
good versions of their product on central. (Should do this regardless of
any other option).

D) Rename our special versions to g-axis-saaj-1.3-r562247 and house
those under our own control (org.apache.geronimo...) in central on our
next build (2.0.2). (The easy and quick, and very temprary fix!)

Thoughts? Comments?

Thanks,

Jeff