On Fri, Dec 23, 2016 at 1:06 PM, Bernd Eckenfels <e...@zusammenkunft.net>
wrote:

> Am Fri, 23 Dec 2016 12:54:14 -0800
> schrieb Charles Honton <c...@honton.org>:
>
> > The
> > official release source tarball contains just the sources, not all
> > the project files.  Building the artifact from just the src directory
> > without the pom would be extremely difficult.
>

Incorrect.


>
> Can you name a component where this is true? Afaik all Commons
> components have a full featured source archive which is buildable and a
> limited source attachment for maven.
>

That true, the whole point of the *-src.zip and *-src.tar.gz files is to be
able to build from scratch.

The -sources jar in Maven Central are for IDEs, not for builds. These two
kinds of files are somewhat redundant.

Gary

>
> > The commons parent pom
> > attaches the source tarball to the maven release for the side effects
> > of signing/checksumming the source tarball.
>
> Only for the -src classifier, this is Maven best practice since IDEs
> can download and display this.
>
> > This induces a manual
> > step of removing the source tarballs from the staging repository.
>
> I dont think removing them is the actual intention.
>
> > We
> > publish convenience binaries to
> > https://www.apache.org/dist/commons/XXX/binaries.  I doubt anyone
> > consumes these binaries.  Most developers use Maven Central.
>
> This depends entirely on the project type they are used in. I would not
> divert from this as it helps to actually find the artifacts and
> especially release notes.
>
> > Extremely security conscious downstream projects consume the
> > distribution source tarballs. The distribution artifacts are doubled
> > in size by providing both .zip and tar.gz versions.
>
> Why would we care?
>
> > Slightly
> > different artifacts are published to Apache Distribution Site vs
> > Maven Central.
>
> Uh, how can that happen, the release process verifies the checksums.
>
> Gruss
> Bernd
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org
> For additional commands, e-mail: dev-h...@commons.apache.org
>
>


-- 
E-Mail: garydgreg...@gmail.com | ggreg...@apache.org
Java Persistence with Hibernate, Second Edition
<https://www.amazon.com/gp/product/1617290459/ref=as_li_tl?ie=UTF8&camp=1789&creative=9325&creativeASIN=1617290459&linkCode=as2&tag=garygregory-20&linkId=cadb800f39946ec62ea2b1af9fe6a2b8>

<http:////ir-na.amazon-adsystem.com/e/ir?t=garygregory-20&l=am2&o=1&a=1617290459>
JUnit in Action, Second Edition
<https://www.amazon.com/gp/product/1935182021/ref=as_li_tl?ie=UTF8&camp=1789&creative=9325&creativeASIN=1935182021&linkCode=as2&tag=garygregory-20&linkId=31ecd1f6b6d1eaf8886ac902a24de418%22>

<http:////ir-na.amazon-adsystem.com/e/ir?t=garygregory-20&l=am2&o=1&a=1935182021>
Spring Batch in Action
<https://www.amazon.com/gp/product/1935182951/ref=as_li_tl?ie=UTF8&camp=1789&creative=9325&creativeASIN=1935182951&linkCode=%7B%7BlinkCode%7D%7D&tag=garygregory-20&linkId=%7B%7Blink_id%7D%7D%22%3ESpring+Batch+in+Action>
<http:////ir-na.amazon-adsystem.com/e/ir?t=garygregory-20&l=am2&o=1&a=1935182951>
Blog: http://garygregory.wordpress.com
Home: http://garygregory.com/
Tweet! http://twitter.com/GaryGregory

Reply via email to