Mailing-List: contact legal-discuss-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: legal-discuss@apache.org
Received-SPF: pass (nike.apache.org: domain of elecharny@gmail.com designates
 209.85.212.173 as permitted sender)
Message-ID: <538CE3DE.3090803@gmail.com>
Date: Mon, 02 Jun 2014 22:51:42 +0200
From: =?UTF-8?B?RW1tYW51ZWwgTMOpY2hhcm55?= <elecharny@gmail.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9;
 rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: legal-discuss@apache.org
Subject: Re: Continuous release review
References: 
 <CAOFYJNaqACY-JXUesx-V0PnsiCCkfVo_xKdEMO-N5Nt7Y_JTFQ@mail.gmail.com>
 <CAOFYJNbBK4rdBFrfz5fG-fTg=2US_OJ5g0iGJz4ozknJa-QxPA@mail.gmail.com>
 <CAEWfVJ=ZMUEw44zqhQ-E_S++ikN168z-5reLmQgQK0=NDZ4m4g@mail.gmail.com>
 <A33141F2-52AB-443B-8A48-10F878100656@jaguNET.com>
 <CA+nPnMyGpCdqj8CxaUUXBOGHtCqVi9b4YdwG0fyv7eMuT5Szcw@mail.gmail.com>
 <38278A5A-BBBD-4090-8DD1-9F38DCAD8EB4@jaguNET.com>
 <CAOFYJNaG5snDOj7CVz9Ka-ciEor7R+eaEQ2tC_gXjtCnoQTpdw@mail.gmail.com>
 <CA+nPnMxCPNZDPe1_48PTJM8tDKC9bu1jZNr8T3OCHjtRG=8MEw@mail.gmail.com>
 <CAOFYJNb=B79YmjpvN+0WUi86tS3xhsKnARpR65951cdCg7NNPg@mail.gmail.com>
 <538CA9B7.90308@gmail.com>
 <CAOFYJNa1YOoPM6jD1OYfw1JzANsG1ZZOcKshaD-MDFM+GfRDfA@mail.gmail.com>
In-Reply-To: 
 <CAOFYJNa1YOoPM6jD1OYfw1JzANsG1ZZOcKshaD-MDFM+GfRDfA@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Le 02/06/2014 22:37, Jukka Zitting a écrit :
> Hi,
>
> On Mon, Jun 2, 2014 at 12:43 PM, Emmanuel Lécharny <elecharny@gmail.com> wrote:
>> Le 02/06/2014 17:18, Jukka Zitting a écrit :
>>> For example, if you review and vote on releasing a specific revision
>>> in the SCM, what's the added benefit of repeating the process on the
>>> source bundle produced from that revision?
>> AFAIU, there are two different things. As the bundle is produced by a
>> automated tool (can be the maven packaging phase), the result can be
>> *very* different from what we get when pulling the revision from the
>> repository.
> I personally don't see any compelling reasons why a source release
> should be anything more than a packaged export of a tag, and some very
> good reasons reasons (like the ability to verify that the sources
> actually came from the scm) for why it should be just that. But I
> recognize that others disagree.
I don't disagree. The thing is that most of the Java projects are
depending on Maven to generate the jar, which should be the same than
what you get when doing a svn co/git clone followed by a tar cvf. Except
that if you have made a mistake when configuring maven, you may and with
a difference. Been there...

Checking both should mitigate this risk.

>
> Anyway, this doesn't affect my main premise. As long as there is a
> deterministic process that produces the source bundle from a given scm
> revision (or revisions) and the steps of verifying the correctness and
> quality of that bundle can be automated (given the assumption that the
> correctness and quality of original source has already been reviewed),
> from the "policy invariant" perspective there should be little
> difference in whether the manual review is done on the input or the
> output of the process.
+1


---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org