www-repository mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Stefano Bagnara <apa...@bago.org>
Subject maven2 based releases for the james project and ASF policy
Date Sun, 17 Sep 2006 01:04:12 GMT
Hi all,

I know there is an ongoing thread about ASF/maven2 repositories and 
third party library, but it seems to me that we won't have an ASF-wide 
solution in few weeks, am I right?

We (Apache James project) have two "new" products based on maven2 that 
are ready to be released: jSPF and Mime4J.

Both projects depends on third party (license compatible) jars and our 
snapshots currently depends on a maven repository I set up in my 
minotaur home to be able to build the projects.

Of course this is no good because we can't publish official releases
including references to my home or including references to SNAPSHOT
projects.

One of James PMC members is concerned (and we, other PMC member, agree 
on his concerns) about the security issues introduced by downloading 
artifacts from ibiblio or its mirrors, so we are trying to find an 
interim solution while ASF define a common way.

Here is what I've proposed:

1) create a "repository/third-party-m1" folder in our 
svn.apache.org/repos/asf/james repository.

2) commit there our current third party dependencies (BSD/CDDL/MIT/ASF)

3) export the content of this repository on a subfolder of our 
james.apache.org website (james.apache.org/repos/third-party-m1 could be 
a good candidate) so that we don't link directly the SVN server but a 
mirrored resource (websites are mirrored, right?)

4) add this "james.apache.org/repos/third-party-m1" to our main pom 
(overwriting ibiblio).


We would still use the 2 ASF-wide maven repositories to publish our 
official release or to read ASF jars and for our snapshots needs.


Does ASF policy allow us to do this? WDYT?

Stefano


Mime
View raw message