On Fri, Dec 23, 2016 at 1:06 PM, Bernd Eckenfels <e...@zusammenkunft.net> wrote:
> Am Fri, 23 Dec 2016 12:54:14 -0800 > schrieb Charles Honton <c...@honton.org>: > > > The > > official release source tarball contains just the sources, not all > > the project files. Building the artifact from just the src directory > > without the pom would be extremely difficult. > Incorrect. > > Can you name a component where this is true? Afaik all Commons > components have a full featured source archive which is buildable and a > limited source attachment for maven. > That true, the whole point of the *-src.zip and *-src.tar.gz files is to be able to build from scratch. The -sources jar in Maven Central are for IDEs, not for builds. These two kinds of files are somewhat redundant. Gary > > > The commons parent pom > > attaches the source tarball to the maven release for the side effects > > of signing/checksumming the source tarball. > > Only for the -src classifier, this is Maven best practice since IDEs > can download and display this. > > > This induces a manual > > step of removing the source tarballs from the staging repository. > > I dont think removing them is the actual intention. > > > We > > publish convenience binaries to > > https://www.apache.org/dist/commons/XXX/binaries. I doubt anyone > > consumes these binaries. Most developers use Maven Central. > > This depends entirely on the project type they are used in. I would not > divert from this as it helps to actually find the artifacts and > especially release notes. > > > Extremely security conscious downstream projects consume the > > distribution source tarballs. The distribution artifacts are doubled > > in size by providing both .zip and tar.gz versions. > > Why would we care? > > > Slightly > > different artifacts are published to Apache Distribution Site vs > > Maven Central. > > Uh, how can that happen, the release process verifies the checksums. > > Gruss > Bernd > > --------------------------------------------------------------------- > To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org > For additional commands, e-mail: dev-h...@commons.apache.org > > -- E-Mail: garydgreg...@gmail.com | ggreg...@apache.org Java Persistence with Hibernate, Second Edition <https://www.amazon.com/gp/product/1617290459/ref=as_li_tl?ie=UTF8&camp=1789&creative=9325&creativeASIN=1617290459&linkCode=as2&tag=garygregory-20&linkId=cadb800f39946ec62ea2b1af9fe6a2b8> <http:////ir-na.amazon-adsystem.com/e/ir?t=garygregory-20&l=am2&o=1&a=1617290459> JUnit in Action, Second Edition <https://www.amazon.com/gp/product/1935182021/ref=as_li_tl?ie=UTF8&camp=1789&creative=9325&creativeASIN=1935182021&linkCode=as2&tag=garygregory-20&linkId=31ecd1f6b6d1eaf8886ac902a24de418%22> <http:////ir-na.amazon-adsystem.com/e/ir?t=garygregory-20&l=am2&o=1&a=1935182021> Spring Batch in Action <https://www.amazon.com/gp/product/1935182951/ref=as_li_tl?ie=UTF8&camp=1789&creative=9325&creativeASIN=1935182951&linkCode=%7B%7BlinkCode%7D%7D&tag=garygregory-20&linkId=%7B%7Blink_id%7D%7D%22%3ESpring+Batch+in+Action> <http:////ir-na.amazon-adsystem.com/e/ir?t=garygregory-20&l=am2&o=1&a=1935182951> Blog: http://garygregory.wordpress.com Home: http://garygregory.com/ Tweet! http://twitter.com/GaryGregory
