shiro-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Kalle Korhonen <>
Subject Re: Shiro artifact distribution
Date Tue, 17 Aug 2010 19:27:13 GMT
On Tue, Aug 17, 2010 at 12:10 PM, Les Hazlewood <> wrote:
>> From my reading of the release documentation either is fine. As a TLP
>> I don't think we have a strict requirement to publish to /dist, it's
>> just an option. However, Clutch checks for the existence of release
>> artifacts at /dist so we better keep the duplicates there. Going
>> forward, I don't think we need to worry about cgi scripts for using
>> mirros either, central is already load-balanced (and proxied and
>> cached).
> We unfortunately can't use m2 central as our primary distribution
> source since that is not considered ASF infrastructure.  At least
> according to the publishing page:
> "The Apache infrastructure must be the primary source for all
> artifacts officially released by the ASF."

Right, ok I see now why you had the links originally pointing at the Pointing to /dist instead would solve that

> I think it's ok at the moment to have the links for the binary .jars
> point to m2 central because they're not really official ASF releases -
> we do it as a convenience.  Although it would be a little nicer to
> have all of our artifacts hosted by the ASF: someone has to pay the
> download bandwidth costs, and it'd be better if the ASF (or one of
> it's agreed mirror partners) did that instead of us passing the bill
> transparently to Sonatype.  Just a thought...

We can figure out how to best use and integrate publishing to the
/dist as a TLP later, but because we are a library project (as opposed
to an application such as Tomcat), I'm pretty certain that most people
will get the libs from Central even if we have them available
somewhere else. Sonatype has a vested interest in seeing Maven succeed
and if people get the jars directly from Central they are much leaner
(and will be cached) than the single source distro zip, so I doubt
Sonatype has that much of a problem with it.


PS. Making the release with Maven was a pleasure. I can see how it
might have been tripping up and annoying lots of non-Maven-built
Apache projects before us and obviously it helped that I've done the
same several times over with different Maven projects but overall,
it's about as streamlined as it currently can be.

View raw message