Mailing-List: contact infrastructure-dev-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: infrastructure-dev@apache.org
Received-SPF: unknown (nike.apache.org: error in processing during lookup of
 aharui@adobe.com)
From: Alex Harui <aharui@adobe.com>
To: "infrastructure-dev@apache.org" <infrastructure-dev@apache.org>
Subject: Re: Discussion on enabling users to specify own machines as dynamic
 hosts
Thread-Topic: Discussion on enabling users to specify own machines as
 dynamic hosts
Thread-Index: 
 AQHPWaXAR4sF/aeED0ynZqfwXuxD5ZsUmi0A//+SoACAAHhNAP//j0YAgAB3owD//5TaAAAPGryAABROkgD//404gIAAhpAAgABghQD//7tfAIAAd+sA//+PO4A=
Date: Thu, 17 Apr 2014 16:55:21 +0000
Message-ID: <CF7552AD.1FC4F%aharui@adobe.com>
References: 
 <CAGaRif1i-LhduVZhDXpgr1WPUyp7rMt0EMnFCzg6fcm-EryWkQ@mail.gmail.com>
 <CACK5iZcCQ5Bar2tiVVQAQpcJC_XM0OxH=65ugBR9k1XSe+-FfA@mail.gmail.com>
 <CF742729.1F96C%aharui@adobe.com>
 <CACK5iZfMQTr7G0Ai7Y1bMUkQJeJseFWEa3VZyOT9s0Fj14J3cg@mail.gmail.com>
 <CF742D98.1F98B%aharui@adobe.com>
 <CAK2iWdRNFKoqaTKavqEHu67-xJQ5EKu4hC0r=+EB2gsfGc1X=g@mail.gmail.com>
 <CF74391A.1F9FB%aharui@adobe.com>
 <CAK2iWdRf8SwQFZb7hAofqWnowXQcK9nrTSRGO-O2UA7cbewBBQ@mail.gmail.com>
 <534F7708.1010708@gmail.com> <CF74C6B4.1FBCD%aharui@adobe.com>
 <534F87A0.5090708@apache.org>
 <CAK2iWdRodAyqmXXU+LXGOeweFi7_YtRkrjukJod4ZJGYF6D9Qg@mail.gmail.com>
 <CF754E14.1FC38%aharui@adobe.com>
 <CAK2iWdT1CcTv0xUgaJEJgMV9e_mFQPRjGybhJti1OLbrrM9TYQ@mail.gmail.com>
In-Reply-To: 
 <CAK2iWdT1CcTv0xUgaJEJgMV9e_mFQPRjGybhJti1OLbrrM9TYQ@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
user-agent: Microsoft-MacOutlook/14.3.9.131030
received-spf: None (: adobe.com does not designate permitted sender hosts)
Content-Type: text/plain; charset="us-ascii"
Content-ID: <19633F1ADD67A54AABFA5F8B10C4629C@namprd02.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0


On 4/17/14 9:38 AM, "jan i" <jani@apache.org> wrote:

>On 17 April 2014 18:29, Alex Harui <aharui@adobe.com> wrote:
>
>>
>> I'm not sure Flex will be able to use it since our users really want our
>> binaries to bundle proprietary build tools and I'm not sure Apache will
>> ever allow that.
>>
>
>I am very sure that apache will not sign tools, that are not build from
>our
>own sources.
Well, you're not signing the tools, but rather, signing the entire binary
package right?  What if an Apache project has a binary that bundles a JAR
that is under Apache License but is not built/hosted at Apache?  Will the
ASF sign that?

>
>I assume the flex project only releases sources, and third party makes the
>bundling. With/without signing I dont believe ASF allows a project to
>include category-x tools in a binary that are sent to the public.
I assume that even with signing, even AOO will still "only release
sources".  Right now there is no third-party for Flex, but one might be
created.  Right now the Flex convenience binaries have a build script that
still needs to run that downloads optional stuff.  And we have created an
Installer application that downloads the category x tools and the
convenience binary and automates the management of all of those pieces.
The complaint we got from our users was that because of Apache "rules"
folks had to separately download the tools then download the binary then
run a script to download other optional dependencies whereas in the
pre-Apache days they simply downloaded and uncompressed a package.  The
installer automates that (it is written in Flex and interprets an Apache
Ant scrip).  I suppose we may want to have the installer signed by the
ASF, but we eventually might rely on some third-party entity to provide a
complete package as that will be simplest for our users.

Thanks,
-Alex