Mailing-List: contact legal-discuss-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: legal-discuss@apache.org
Received-SPF: neutral (nike.apache.org: 74.125.44.30 is neither permitted nor
 denied by domain of brianf@infinity.nu)
Message-ID: <49F9ABE3.2050508@infinity.nu>
Date: Thu, 30 Apr 2009 09:47:15 -0400
From: Brian Fox <brianf@infinity.nu>
User-Agent: Thunderbird 2.0.0.21 (Windows/20090302)
MIME-Version: 1.0
To: legal-discuss@apache.org
Subject: Re: Clarification on the release requirements
References: <49F71CCF.4030204@infinity.nu>
	 <3b3f27c60904291706r27b9eb42l171809ecae43c33c@mail.gmail.com>
	 <C2F38645-A16A-42C2-ABD0-A8E1175FB17F@dslextreme.com>
	 <3b3f27c60904291908k6e01dfdet7abf7a20ad8c6f82@mail.gmail.com>
	 <057BE7E1-F459-4CD6-A5A3-21E093A7D405@dslextreme.com>
	 <caf30e2a0904292018i36040a64rf8b695f825774476@mail.gmail.com>
	 <640823.4954.qm@web54404.mail.yahoo.com>
	 <caf30e2a0904300005sd156beasf9bd568b7c867da4@mail.gmail.com>
	 <49F95145.7030805@rowe-clan.net>
	 <caf30e2a0904300033m24fc8c59ycf700f7eb67a4017@mail.gmail.com>
 <e75283b10904300051o415ebe09j569245e8f565efd7@mail.gmail.com>
In-Reply-To: <e75283b10904300051o415ebe09j569245e8f565efd7@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit


Jochen Wiedmann wrote:
> On Thu, Apr 30, 2009 at 9:33 AM, Niclas Hedhman <niclas@hedhman.org> wrote:
>
>   
>>> But perhaps that's just splitting hairs :)
>>>       
>> Not at all.
>>     
>
> I think it demonstrates that we shouldn't require a particular
> procedure, because the applicability of such procedures depends on a
> multitude of factors. Instead, we should assume *reasonable*
> principles like reproducability. (Discussing whether tags can be moved
> is, IMO, not reasonable, in particular, because it can be traced in
> SVN.)
>
> For example, if we can take the SVN tag as a source, then that's
> sufficiently reproducable for me. I can live (and I'd assume that
> everyone else can) with the requirement to export this tag to an
> archive, both for users convenience and to express the fact that a
> "release" has been performed. (Note, that there are usually more SVN
> tags than releases!)
>
> OTOH, source jar files are definitely insufficient: For example, you
> can't build the thing without a POM file or Ant script, it lacks
> inputs for generating sources, and so on.
>
> If we could agree to that, then we could leave the technical details
> (for example, cut archive first, then create the tag, or vice versa)
> to the proponents of the respective build systems, SCM systems, and so
> on - and that's where it belongs to, IMO.
>
>
>
>   
Well said, +1. The results are the important thing and it's on the 
shoulders of the PMC to meet some basic requirements during voting. If 
the source archive is totally junk, it should be uncovered at that time. 
How it gets produced is very dependent on things that change from 
project to project, lets agree on some simple principals and make sure 
all releases meet them. I'll take a stab:

1) each release must at a minimum: a) have a tag in the associated scm 
system for traceability reasons and b) produce a signed tarball that is 
sufficient to build or otherwise produce the product by the users. This 
would typically take the form of an archive of the source tree 
comprising the release and generally match the contents of the tag.

2) binaries are provided as a convenience to the users. If they are 
provided, the version given to them must match exactly to the version of 
the source used to produce the binary. (the existing text on the site is 
sufficient for this part imo)

3) all artifacts (source and binary) must be cryptographically signed. 
Voting occurs on the set of produced, signed artifacts. The validation 
that these artifacts meet the above requirements is performed by the PMC 
during the voting process.


---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org