Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Message-ID: <48D1B1E8.3010700@rowe-clan.net>
Date: Wed, 17 Sep 2008 20:42:00 -0500
From: "William A. Rowe, Jr." <wrowe@rowe-clan.net>
User-Agent: Thunderbird 2.0.0.16 (X11/20080723)
MIME-Version: 1.0
To: general@incubator.apache.org
Subject: Re: Incubator Maven repo [WAS Re: [VOTE] [POLICY] Allow extra release
 distribution channels like the central Maven repository]
References: <fbdc6a970809161549r11bbcf8ewf3808ac3ee224112@mail.gmail.com>
	 <200809170657.47757.dkulp@apache.org>
	 <1221696340.25066.4.camel@forge.local>	 <48D1AB65.2050603@rowe-clan.net>
 <19e0530f0809171825k36681f7dqde8160e343c3d20@mail.gmail.com>
In-Reply-To: <19e0530f0809171825k36681f7dqde8160e343c3d20@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Davanum Srinivas wrote:
> 
> Since you are stating facts. Let's make it clear that when someone
> download the artifacts, there's a good chance that you will see the
> disclaimers. With maven, we don't. That's the hiccup that caused the
> policy in place right now and the bruising battle now being fought is
> caused by the fact that there is no other
> maven-pmc-blessed-and-approved-way to inform the folks who
> auto-magically pull dependencies as of this moment and there is not
> likely to be one in the future AFAICT.

We don't disagree.  For that matter, there are licenses, notices and
other critical information present in maven artifacts which are unlikely
to be noticed.  That's a failure of maven and not germane to this
discussion, although I certainly hope that maven addresses it!  But in
most cases, the disclaimer was only relevant to the individual developer
who incited the dependency and triggered a maven build to fetch that
particular artifact.  Our disclaimer is really meaningless to the end
user of that developer's combined work.

Similarly, the issue of signature validation is a significant flaw which
I also hope maven addresses even more promptly, and which they are aware
of.  The alternatives are to take down maven until it is secure, or to
continue to populate maven with various released artifacts.  And this too
isn't germane to the question above, which is;

   "Allow extra release distribution channels like the central Maven
    repository?"

If an incubating release is a release, with a specific DISCLAIMER (no
different than incorporating other NOTICEs or LICENSE), and a specific
release name format (apache-incubating-{podling}-{rev}), then the Maven
specific side of this argument should happen on the Maven list, and this
discussion should finally come to an end.

Bill


---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org