www-repository mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Mark R. Diggory" <mdigg...@latte.harvard.edu>
Subject Re: Developer Repository
Date Tue, 20 Jan 2004 01:39:44 GMT

Dirk-Willem van Gulik wrote:

> On Mon, 19 Jan 2004, Mark R. Diggory wrote:
>>Just to clarify, the maven repository at ibiblio is not just for apache,
>>there is content within it that is not created by apache.
> Sure - that is clear, and that is not the concern.
>>www.ibiblio.org/maven is the "canonical" source for the maven repository
>>specifically because it is an "organizationally neutral" location.
> Clear - but ass explained before; neutral is exactly -not- what is
> required for the authoritative copy or tools as under an ASF banner. On
> the other hand if maven wants to be totally "organizationally neutral"
> it should not be an shelter as an ASF project.
> Again - if the Foundation, for whatever reason, needs to pull a file or
> release; its own tools better follow suit as appropriate. In developer
> terms: Sure, clients can override, there can be caching; but if we pull a
> file, and some person, a week later can 'take a clean machine, fetch maven
> from the asf, do a 'default' install' then it should not contain that
> pulled file. If it does we have a problem. A lot of our protection relies
> on not beeing an attractive target when infringing; i.e. we pull, we clean
> - then analyse and put the file back or apologize as appropriate. As soon
> as we loose that control it starts to border on will full infringement,
> punitive damages and other things taking up developer energy.

Seems that client side caching (esp. in mirrors) will make that 
difficult. I don't consider the current mirroring scheme we've cooked up 
between ibiblio and Apache as long-term. The primary goal is to get 
Apache developers who use Maven to be publishing artifacts to a Maven 
repository under the apache domain (and yes, thus we can manage the 
legality of the contents more methodically).

As long as Jason's script at ibiblio is not caching files when it transfers




then the Apache contents of the ibiblio maven repository should be 
consistent with that of the  /dist/java-repository contents. Currently 
ibiblio is pulling once a day. Its suggested we can up that to every 4 

> This problem can be solved in many ways; metadata is one; while still
> using ibiblio and others for mirroring in a neutral fashion.

> But as soon as we hardcode things to any third part in ASF released code
> we better understand what relation we have with that party. Often that is
> not an issue; but releases are one of the few areas where we do have
> exposure. And no - having an MoU is propably not the right thing to do.

I won't argue that the current repository model at ibiblio has a few 
shortcomings when it comes to distributed contents. There wouldn't be a 
"repository project" otherwise :-). Currently the only mechanism in 
Maven for designating more alternate repositories is configuring ones 
client to look elsewhere.

I suspect the ideas coming out of the URISyntax will alleviate some of 
this stuff. But possibly also having some sort of mirror/discovery 
mechanism would also be beneficial?


Mark Diggory
Software Developer
Harvard MIT Data Center

View raw message