Mailing-List: contact legal-discuss-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: legal-discuss@apache.org
Reply-To: sharan@apache.org
Subject: Re: Request for clarification of Release Policy regarding external
 jar files
References: <575AB39E.5090800@apache.org>
 <CAAS6=7gVXGHqeKVeFV_r1849Qpi0+Ca0jc2QWQBQfRdZnCwVpA@mail.gmail.com>
 <D3803670.6E528%aharui@adobe.com>
To: Alex Harui <aharui@adobe.com>,
 "legal-discuss@apache.org" <legal-discuss@apache.org>
From: Sharan F <sharan@apache.org>
Message-ID: <575D1665.6020400@apache.org>
Date: Sun, 12 Jun 2016 09:59:33 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
 Thunderbird/38.8.0
MIME-Version: 1.0
In-Reply-To: <D3803670.6E528%aharui@adobe.com>
Content-Type: multipart/alternative;
 boundary="------------070404010602030503040206"
archived-at: Sun, 12 Jun 2016 07:59:48 -0000

--------------070404010602030503040206
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

Hi Alex

I'll give you some context as to why I asked the question.

We recently kicked off what we hope to be a large effort to tidy up and 
significantly re-factor our trunk. As as part of that work we wanted to 
explore better ways to handle any external dependencies so before we got 
any further into our discussions, we wanted to check that we had the 
correct understanding of the options available.

Thanks
Sharan


On 10/06/16 18:23, Alex Harui wrote:
>
> On 6/10/16, 7:04 AM, "Marvin Humphrey" <marvin@rectangular.com> wrote:
>
>>> "source releases" do not contain binaries
>> Yes.
> Where binaries == compiled source.  AIUI, you can have other "binaries"
> like images and fonts in the source package.  IIRC, bundling compressed
> sources is discouraged as well.
>
>>> projects may also publish "binary releases"
>> This is not accurate.  Third parties (most often the release manager) may
>> provide compiled packages.  The colloquialism typically used to refer to
>> these
>> packages is "convenience binaries".
>>
>> The Foundation does not endorse binary packages because such packages are
>> opaque and cannot be audited by a PMC.
> All true, but AIUI, if the 3rd party is a release manager, the RM is
> allowed to distribute those binary packages from Apache servers.
>
> I'm curious as to what scenario Sharan is dealing with.
>
> -Alex
>


--------------070404010602030503040206
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    <meta http-equiv="content-type" content="text/html; charset=utf-8">
    <p style="margin-bottom: 0cm; line-height: 100%">Hi Alex<br>
    </p>
    <p style="margin-bottom: 0cm; line-height: 100%">I'll give you some
      context
      as to why I asked the question.<br>
    </p>
    <p style="margin-bottom: 0cm; line-height: 100%">We recently kicked
      off what we hope to be a large effort to tidy up and significantly
      re-factor our trunk. As as part of that work we wanted to explore
      better
      ways to handle any external dependencies so before we got any
      further into our discussions, we wanted to check that we had the
      correct understanding of the options available.<br>
    </p>
    <p style="margin-bottom: 0cm; line-height: 100%">Thanks<br>
      Sharan</p>
    <title></title>
    <meta name="generator" content="LibreOffice 4.2.8.2 (Linux)">
    <style type="text/css">
	<!--
		@page { margin: 2cm }
		p { margin-bottom: 0.25cm; line-height: 120% }
	-->
	</style><br>
    <br>
    <div class="moz-cite-prefix">On 10/06/16 18:23, Alex Harui wrote:<br>
    </div>
    <blockquote cite="mid:D3803670.6E528%25aharui@adobe.com" type="cite">
      <pre wrap="">

On 6/10/16, 7:04 AM, "Marvin Humphrey" <a class="moz-txt-link-rfc2396E" href="mailto:marvin@rectangular.com">&lt;marvin@rectangular.com&gt;</a> wrote:

</pre>
      <blockquote type="cite">
        <pre wrap="">
</pre>
        <blockquote type="cite">
          <pre wrap="">"source releases" do not contain binaries
</pre>
        </blockquote>
        <pre wrap="">
Yes.
</pre>
      </blockquote>
      <pre wrap="">
Where binaries == compiled source.  AIUI, you can have other "binaries"
like images and fonts in the source package.  IIRC, bundling compressed
sources is discouraged as well.

</pre>
      <blockquote type="cite">
        <pre wrap="">
</pre>
        <blockquote type="cite">
          <pre wrap="">projects may also publish "binary releases"
</pre>
        </blockquote>
        <pre wrap="">
This is not accurate.  Third parties (most often the release manager) may
provide compiled packages.  The colloquialism typically used to refer to
these
packages is "convenience binaries".

The Foundation does not endorse binary packages because such packages are
opaque and cannot be audited by a PMC.
</pre>
      </blockquote>
      <pre wrap="">
All true, but AIUI, if the 3rd party is a release manager, the RM is
allowed to distribute those binary packages from Apache servers.

I'm curious as to what scenario Sharan is dealing with.

-Alex

</pre>
    </blockquote>
    <br>
  </body>
</html>

--------------070404010602030503040206--