Hi legal team, I'd like to raise a discussion about what is the best way to release a Golang client for the ASF projects. Since Golang is a static linking language, Go applications just reference to a Git tag of the source code to use. People don't download the source code package and compile it. A Git tag (with Gitsha) is *immutable* and it lives at Gitbox which is in the ASF infrastructure. Can a Git tag be legally sufficient for an official release for an ASF project?
For the full context of this question, you can check this email thread below. ---------- Forwarded message --------- From: Dave Fisher <w...@apache.org> Date: Thu, Mar 26, 2020 at 11:29 AM Subject: Re: [VOTE] Pulsar Client Go Release 0.1.0 Candidate 1 To: <dev@pulsar.apache.org> Hi - There is an official release policy - http://www.apache.org/legal/release-policy.html#policy It does not include GitHub as a source of official releases. Releases are acts of the Foundation through each PMC. Perhaps that is something to be discussed on legal-discuss@, but that would mean a change to a well established Foundation Policy and would breach the legal shield which protects you as VP, the PMC and the Release Manager. Regards, Dave > On Mar 26, 2020, at 10:41 AM, Matteo Merli <mme...@apache.org> wrote: > > Hi Dave, > > we discussed in past to only release a Git tag for Go. All the users > of this library will just fetch the library directly from Github, > specifying a tag in their Go dependencies tool. > > While we could publish a source tar.gz, it would be of little > practical utility to users. > > Having said that, we'd need to specify the Git tag hash, both here in > the vote thread as in the release notes. > > Dave, do you thing that this would be an acceptable way to "release" a > blessed tag? > -- > Matteo Merli > <mme...@apache.org> > > > On Thu, Mar 26, 2020 at 9:26 AM Dave Fisher <w...@apache.org> wrote: >> >> -1 - What artifacts are we voting on? Where is the source package on the Apache servers? >> >> Packages here https://github.com/apache/pulsar-client-go/releases are not immutable. There are no checksums or signatures. No update to the KEYS file. >> >> Please put release candidates here: https://dist.apache.org/repos/dist/dev/pulsar/ in there own folder. >> >> Regards, >> Dave >> >>> On Mar 26, 2020, at 9:00 AM, Matteo Merli <mme...@apache.org> wrote: >>> >>> +1 >>> >>> >>> -- >>> Matteo Merli >>> <mme...@apache.org> >>> >>> On Thu, Mar 26, 2020 at 4:52 AM Yong Zhang <zhangyong1025...@gmail.com> wrote: >>>> >>>> +1 >>>> >>>> Thanks >>>> Yong >>>> >>>> On Thu, 26 Mar 2020 at 19:44, PengHui Li <peng...@apache.org> wrote: >>>> >>>>> +1 >>>>> >>>>> Sijie Guo <guosi...@gmail.com> 于2020年3月26日周四 上午8:28写道： >>>>> >>>>>> +1 >>>>>> >>>>>> On Tue, Mar 24, 2020 at 11:26 PM anonymitaet _ < anonymita...@hotmail.com >>>>>> >>>>>> wrote: >>>>>> >>>>>>> +1 >>>>>>> >>>>>>> Thanks xiaolong for your great work >>>>>>> >>>>>>> On 2020/3/25, 13:43, "xiaolong ran" <ranxiaolong...@gmail.com> wrote: >>>>>>> >>>>>>> Hi everyone, >>>>>>> >>>>>>> Please review and vote on the release candidate #1 for the version >>>>>>> 0.1.0, as follows: >>>>>>> [ ] +1, Approve the release >>>>>>> [ ] -1, Do not approve the release (please provide specific >>>>> comments) >>>>>>> >>>>>>> This is the first release candidate for Apache Pulsar Go client, >>>>>>> version 0.1.0. >>>>>>> >>>>>>> It fixes the following issues: >>>>>>> >>>>>>> https://github.com/apache/pulsar-client-go/milestone/1?closed=1 < >>>>>>> https://github.com/apache/pulsar-client-go/milestone/1?closed=1> >>>>>>> >>>>>>> Please download the source packages and review this release >>>>>> candidate: >>>>>>> >>>>>>> - Review release notes >>>>>>> - Download the source package and follow the README.md to build and >>>>>>> run the pulsar-client-go. >>>>>>> >>>>>>> The vote will be open for at least 72 hours. It is adopted by >>>>>> majority >>>>>>> approval, with at least 3 PMC affirmative votes. >>>>>>> >>>>>>> Source file: >>>>>>> https://github.com/apache/pulsar-client-go/tree/v0.1.0-candidate-1 >>>>> < >>>>>>> https://github.com/apache/pulsar-client-go/tree/v0.1.0-candidate-1> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>> >>>>> >>
