From general-return-64317-archive-asf-public=cust-asf.ponee.io@incubator.apache.org Thu May 10 13:17:35 2018 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by mx-eu-01.ponee.io (Postfix) with SMTP id D6F3318063A for ; Thu, 10 May 2018 13:17:34 +0200 (CEST) Received: (qmail 38978 invoked by uid 500); 10 May 2018 11:17:33 -0000 Mailing-List: contact general-help@incubator.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: general@incubator.apache.org Delivered-To: mailing list general@incubator.apache.org Received: (qmail 38966 invoked by uid 99); 10 May 2018 11:17:32 -0000 Received: from pnap-us-west-generic-nat.apache.org (HELO spamd2-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 10 May 2018 11:17:32 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd2-us-west.apache.org (ASF Mail Server at spamd2-us-west.apache.org) with ESMTP id 0E19F1A18AB for ; Thu, 10 May 2018 11:17:32 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd2-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: -0.101 X-Spam-Level: X-Spam-Status: No, score=-0.101 tagged_above=-999 required=6.31 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=disabled Authentication-Results: spamd2-us-west.apache.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mx1-lw-us.apache.org ([10.40.0.8]) by localhost (spamd2-us-west.apache.org [10.40.0.9]) (amavisd-new, port 10024) with ESMTP id NnTsCbsu3ucM for ; Thu, 10 May 2018 11:17:31 +0000 (UTC) Received: from mail-pf0-f182.google.com (mail-pf0-f182.google.com [209.85.192.182]) by mx1-lw-us.apache.org (ASF Mail Server at mx1-lw-us.apache.org) with ESMTPS id D5E5C5FB51 for ; Thu, 10 May 2018 11:17:30 +0000 (UTC) Received: by mail-pf0-f182.google.com with SMTP id x9-v6so922702pfm.2 for ; Thu, 10 May 2018 04:17:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=quTe6Pg1XsK6EDUh6i+6cvQsKCCZZo6eRPti6y46AHM=; b=iiGml20J9HRlSKD/QkfUIIqawqYQeRp81QnZ4VEZlR9aWFcJGClmWcx6iMx+zNCDes Z6ENXD22AyBXY0RrzTnYHzLSWrmM9SmYx4el2c7kUfUJDl/sZb8O54xbqzF5DATHVkIA vvPEApbjPddo1g7pHk+VgaVibN3OyNi4ajctSCKPbDt+yoTFipMUjAWHrTJL4VpGxStC 5RG4D8IFvLLqSE6URkCzMdQojg8Bc2Hm1d1PxRFCRKx5DG2+QWidwEJ2N6wYNNHiRAsn cIpP/dJ3PnEuzNG2i8ZNr7p/Ti0fbhMTpTnD0m5UdLeXgpVxiWeOzvR5Zuc3ddku+LJ7 HgJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=quTe6Pg1XsK6EDUh6i+6cvQsKCCZZo6eRPti6y46AHM=; b=k9t/yl0oH0ytE/nBxaNXrny5mhLWCSdz2A7drybY1snFcV2xqkm+vNJ0XkZIwLNsoF ohb86ZTdwZSiXEAJlbYjbwc2HVzKJiSTNM2P05cZMTf7vjmT/81pVAUTTbOs9QI6ulqI cwGfA49arf+f01OuFDfuu16oUkqEupBa9q08g1PT7n06UIG3dWUKu3TKfsVciqpnAnWD phO4OekPfhncVDI6tQpBInzhoSgLCJbctc3VLOIw+gqsoKq0pAY46R9FTLGuNLfcNo8/ Eb6nSNLE0tF7f/BtCM4gLo8dZgyQfcgldmR21NyOJAt4DiwivHA0SGiuhgePwGiZBM2R L3Fw== X-Gm-Message-State: ALKqPwdyI203IP0/xm+wc5JdcpnsSrrHi+nwW1G1zP9uAUEQM1ANjtua b1XIz19Bo1D6oZ9q5+OUDpdxozR1JmDrlPo+G7w8zQ== X-Google-Smtp-Source: AB8JxZrOk+jHj2xrjRmYg28JLDOaYGy7os+HflOSUD4YBRzRS2XDLMZ/MWQdwV5NahEDnoITaWY7kTMgk++0IaPFw6Q= X-Received: by 2002:a63:7e4e:: with SMTP id o14-v6mr818431pgn.18.1525951049659; Thu, 10 May 2018 04:17:29 -0700 (PDT) MIME-Version: 1.0 Received: by 10.236.163.135 with HTTP; Thu, 10 May 2018 04:17:28 -0700 (PDT) In-Reply-To: References: From: sebb Date: Thu, 10 May 2018 12:17:28 +0100 Message-ID: Subject: Re: Publishing Maven artifacts under third-party coordinates (was: Set up Nexus staging profile for Dubbo ...) To: general@incubator.apache.org Cc: dev@dubbo.apache.org Content-Type: text/plain; charset="UTF-8" On 10 May 2018 at 11:37, Greg Stein wrote: > On Thu, May 10, 2018 at 3:31 AM, Huxing Zhang wrote: > >> Hi, >> >> On Thu, May 10, 2018 at 3:59 PM, Willem Jiang >> wrote: >> > Is there any plan for going through the vote process of Binary file? >> >> Yes, binaries will also go through the vote process. > > > No. It makes no sense. > > There is NO WAY to verify a binary. Even compiling from source to binary on > your machine, and trying to compare against a target binary will generally > fail since timestamps are embedded. Or maybe there are different compilers > being used. > > The Foundation *never* votes on binaries, because the Foundation DOES NOT > RELEASE BINARIES. The Foundation only votes/authorizes/releases source > code. REPEAT: only source code. > > Only source. Which is verifiable. Which has provenance. The LICENCE and NOTICE files that accompany the binary artifact are text, and IMO should be checked against the contents of the binary artifact. For example, if the binary bundles jars from other projects, the L&N need to agree with the bundled contents. > Regards, > -g > (Member, skipping my Infra hat) --------------------------------------------------------------------- To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org For additional commands, e-mail: general-help@incubator.apache.org