Return-Path: 
 <mime4j-dev-return-212-apmail-james-mime4j-dev-archive=james.apache.org@james.apache.org>
Delivered-To: apmail-james-mime4j-dev-archive@minotaur.apache.org
Received: (qmail 85513 invoked from network); 15 Feb 2009 20:59:19 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2)
  by minotaur.apache.org with SMTP; 15 Feb 2009 20:59:19 -0000
Received: (qmail 27174 invoked by uid 500); 15 Feb 2009 20:59:19 -0000
Delivered-To: apmail-james-mime4j-dev-archive@james.apache.org
Received: (qmail 27155 invoked by uid 500); 15 Feb 2009 20:59:19 -0000
Mailing-List: contact mime4j-dev-help@james.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:mime4j-dev-help@james.apache.org>
List-Unsubscribe: <mailto:mime4j-dev-unsubscribe@james.apache.org>
List-Post: <mailto:mime4j-dev@james.apache.org>
List-Id: <mime4j-dev.james.apache.org>
Reply-To: mime4j-dev@james.apache.org
Delivered-To: mailing list mime4j-dev@james.apache.org
Received: (qmail 27144 invoked by uid 99); 15 Feb 2009 20:59:19 -0000
Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 15 Feb 2009 12:59:19 -0800
X-ASF-Spam-Status: No, hits=-0.0 required=10.0
	tests=SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (nike.apache.org: domain of bernd.fondermann@googlemail.com
 designates 209.85.220.13 as permitted sender)
Received: from [209.85.220.13] (HELO mail-fx0-f13.google.com) (209.85.220.13)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 15 Feb 2009 20:59:09 +0000
Received: by fxm6 with SMTP id 6so4336211fxm.4
        for <mime4j-dev@james.apache.org>;
 Sun, 15 Feb 2009 12:58:48 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=googlemail.com; s=gamma;
        h=domainkey-signature:mime-version:received:in-reply-to:references
         :date:message-id:subject:from:to:content-type
         :content-transfer-encoding;
        bh=pVRaJJ6TcvR14fLNwnTYjdPWHxzXxErhx75/gbjIOHQ=;
        b=NLPZdKL0pj4wWsplAOmqGUtAhITybN1E1DOc8cat2S+Zu+v3pL4Z3LZVm5xylJpFfN
         eco9hWTMoi+NWmAJ/qgwm8SbY3KKq8o+M7Qq3E4tlqi4YuV8uyLMt84UeJmjcQc3hXGq
         +89K+r1wzw90OtlcYTAOYJ7Mk2ZBUVLUG78pk=
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=googlemail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type:content-transfer-encoding;
        b=IK7OWTvhqVKEFCp9sBgil+KBH8Xm2pHIg2xklq0/DfqwHt7DtjVN9TWFRdSK0TyQgg
         K9wbbP30ESXlPOXfILfJ75F8+kUdQKOi3BKwnT2Sr2LlcbC1xPzLnNJCjEFICytXB+yr
         YfT1jdnXGgvdXzbFdsMyvHfglIFuQkHAbotFk=
MIME-Version: 1.0
Received: by 10.181.201.18 with SMTP id d18mr160077bkq.72.1234731528765; Sun,
	15 Feb 2009 12:58:48 -0800 (PST)
In-Reply-To: <49987DEB.5060509@bago.org>
References: <1234100105.7302.6.camel@ubuntu>
	 <a92573960902080725n37306504t6cbb757876e66abc@mail.gmail.com>
	 <f470f68e0902081203qa658054ue1651cb03448735a@mail.gmail.com>
	 <49907BA0.6010506@apache.org>
	 <a92573960902121211v7272ab40v47759bc4b69fa05@mail.gmail.com>
	 <49983037.9080209@apache.org> <49983B09.8030308@bago.org>
	 <88f6e29a0902151057u100e973ckb96894ce85abe9e@mail.gmail.com>
	 <49987DEB.5060509@bago.org>
Date: Sun, 15 Feb 2009 21:58:48 +0100
Message-ID: <88f6e29a0902151258h5e64f09cu30cf5a03f6fdf1bf@mail.gmail.com>
Subject: Re: m2 and -Plocal (was: mime4j 0.6 preview packages)
From: Bernd Fondermann <bernd.fondermann@googlemail.com>
To: mime4j-dev@james.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Virus-Checked: Checked by ClamAV on apache.org

On Sun, Feb 15, 2009 at 21:41, Stefano Bagnara <apache@bago.org> wrote:
> Bernd Fondermann ha scritto:
>> On Sun, Feb 15, 2009 at 16:55, Stefano Bagnara <apache@bago.org> wrote:
>> <snip/>
>>
>>>>> Is maven version 2.0.6 still sufficient?
>>>>> And for me "mvn package" always did the job; no -U, no -Plocal..
>>>>>
>>>> Neither option is required. I guess -Plocal can come handy when building
>>>> packages while off-line.
>>> -Plocal has been introduced as a *compromise* by me 2 years ago, after
>>> working weeks (if not months) trying to satisfy really strict security
>>> requirements from other PMC members. They was rejecting the use of maven
>>> to make releases if this meant to use remote repositories because of
>>> security concerns.
>>>
>>> Even if I understand and share the security issues and the
>>> reproducibility issues with m2, I always thought that the whole issue
>>> was a big waste of time for me and for the JAMES project. THE solution
>>> for maven and this issue is to setup our own repository with a
>>> repository manager. Unfortunately it seems there is no will to setup
>>> this kind of 3rd party repository inside the ASF.
>>>
>>> The whole thing had already found inconsistency when we decided that we
>>> was not entitled shipping poms for jars that we ship in the stage folder
>>> (expecially wrt javamail stuff).
>>>
>>> That said, here is my +1 to remove the -Plocal suggestion in BUILDING.txt.
>>
>> For me the foremost reason to not rely on a remote maven repos is that
>> I firmly believe that any ASF project should be self-hosting.
>> (I'm repeating myself here of course, but I'd like to say it again as
>> the maven question has been brought up again.)
>> Self-hosting has its limits, of course we won't keep copies of ant or
>> the JDK around. But all the funny (to use a nice f-word) little maven
>> dependencies and plug-ins can really make your day, especially when
>> not accessible, either because servers are unreachable or working
>> offline.
>
> Have you ever tried a repository manager? (e.g: Nexus, or Archiva if you
> want to stay Apache).

I know them. There are simply no additional benefits for me in them.

>> For example: I'm connected to the net right now. I run 'mvn
>> dependency:tree', on a James server trunk checkout and I'm getting
>> errors. Mmhhh. Maybe this mvn build is not maintained, but the general
>> experience is: If maven works, you're fine. But if you get dependency
>> errors, you are really in trouble.
>
> I feel the same with any build tool I don't know. Whenever I have to
> build a python or perl project if it works I'm fine, but if I get any
> error I'm really in trouble. It's just a matter of knowledge of the
> tool. The choice of the build tool is just as important as the choice of
> the language or the choice of a dependency.

I know maven well enough. I use it nearly every day. That's not the
problem here.

>> Purging a local m2 repo cannot be recommended. So prestine builds are
>> not really happening, because of the local m2.
>
> You can specify a custom local repository when you run m2.

I know. But who does that before building? Robert. But no other sane person.

>> What if somebody wants to build one of our mvn dependent products in 5
>> or 10 years? Should that work? I firmly doubt it will!
>
> IMO to release is much more important than to be able to reproduce a
> release in 10 years.

We primarily ship code. Do you say we should stop that, because it's
not important if that works (now or in 1 or 5 or 10 years)? To build a
src dist with mvn you need resolve much to much dependencies (IMHO).

> So first we should be able to release with no PITA,

at least this works with maven ;-)

> then when there will be spare cycle we'll find time to create a virtual
> machine with the right os, the right libraries, the right JVM, the right
> DATE/TIME of the virtual machine, the right build tool, and all the
> dependencies.
>
>> Maybe the solution is to establish a repo for our James product
>> dependencies here in our own project. But that will likely create
>> distribution issues.
>>
>> I don't want to be a PITA, you can change the build to not depend on
>> -Plocal. I backup my local m2 anyway.
>
> IMHO ASF should have an ASF managed m2 repository (the maven central is
> managed by apache people, but not with their apache hats). Or even
> better, each PMC should have its own repository (disk space is cheap,
> cheaper than discussions to achieve compromises).
>
> Stefano
>

Bernd