Mailing-List: contact legal-discuss-help@apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (athena.apache.org: domain of hyandell@gmail.com designates
 209.85.146.182 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
        b=Im+7XpXp7mUkOjZPCYJgdV5hwdvZMlkYikmbKZxtj0Wi5frfLLI7CmBDQD/ZVuAggv7lULW8g63buJJ9iIqWn4SCeDCG+srN+CC2pl+gjr5wQvTXhxlYQiGBgy1zoeX01Zv62VGRaHMQTLNLeF34+zq3cM0xsNkkKDkyj0qH23o=
Message-ID: <2d12b2f00712202358j57d10186u4e5e4f0a3f0a3874@mail.gmail.com>
Date: Thu, 20 Dec 2007 23:58:04 -0800
From: "Henri Yandell" <bayard@apache.org>
Sender: hyandell@gmail.com
To: "Roland Weber" <ossfwot@dubioso.net>
Subject: Re: LICENSE and NOTICE files and SVN
Cc: "Legal Discuss" <legal-discuss@apache.org>
In-Reply-To: <476B40F7.8060209@dubioso.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <25aac9fc0712171137q67c3a7cfu5012b10da9f52725@mail.gmail.com>
	 <BA2CBE5D-452A-457B-9282-1FE8D902DA06@SUN.com>
	 <18B50A19-3D3B-49ED-A459-17CD3BFA69DB@yahoo.com>
	 <25aac9fc0712191719m1b004b2et5969d718e6e0bc75@mail.gmail.com>
	 <510143ac0712192051n32bb4c3ckf51c3bdcf4aba98d@mail.gmail.com>
	 <5c902b9e0712192216w3a23ac5fh131121bc27e8dae2@mail.gmail.com>
	 <b23ecedc0712200048keb5072fl11f46a1b0fed2713@mail.gmail.com>
	 <802B7BC1-D956-45B3-B68B-CC89522FC606@gbiv.com>
	 <476B40F7.8060209@dubioso.net>

On Dec 20, 2007 8:28 PM, Roland Weber <ossfwot@dubioso.net> wrote:
> Roy T. Fielding wrote:
> > PMCs can vote on just about anything.  However, a release vote is on
> > a packaged artifact containing the complete source code and signed
> > by the release manager.  If you haven't voted on that, the PMC has
> > not performed a valid release.
> >
> > Binaries are generated from release source packages. If the PMC is
> > doing something else, then it has seriously screwed the pooch and
> > may not even be releasing open source.
>
> Are there any plans to fix Maven? AFAIK, Maven tags the source in
> the repository, then builds binary and source release packages from
> that tag. It does not build a source package that is signed before
> or after the binary gets built from that source. It builds both
> from the same tag, and both are signed afterwards.
> Either my understanding of Maven is wrong, or you are saying that
> every Apache project that uses Maven to generate the release
> packages is making invalid releases.

The various Ant builds I've used do the same thing. You tag trunk,
then run 'dist' (etc) and get a source and binary build. Thanks for
pointing out that part of Roy's reply - it hadn't sunk in when I read
it the first time.

Hen

---------------------------------------------------------------------
DISCLAIMER: Discussions on this list are informational and educational
only.  Statements made on this list are not privileged, do not
constitute legal advice, and do not necessarily reflect the opinions
and policies of the ASF.  See <http://www.apache.org/licenses/> for
official ASF policies and documents.
---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org