On 24/06/2015 18:02, "Markus Weimer" <mar...@weimo.de> wrote:
>> Personally I think the policy should be clarified such that nightly >>builds >> MUST only live on ASF infrastructure (whether that be the Nexus >>SNAPSHOTs >> repo, committer web space etc). As soon as you start putting them on >> external services like DockerHub then they are potentially widely >>visible >> to the general public. > >This is very tricky for projects outside the Java ecosystem. For .NET, >NuGet is the established way to get packages, and the ASF doesn't >provide a NuGet repository in the same way it does provide Maven >repositories. Sontatype Nexus Professional 2 onwards (which the ASF runs) supports NuGet repositories so if ASF projects wanted to use that capability to distribute pre-release builds then they should start a discussion with infrastructure http://books.sonatype.com/nexus-book/reference/nuget.html > >NuGet is just one example, each of the major language ecosystems now >offers at least one (binary) artifact and dependency management >approach. Following through on the above would mean either an incredible >workload for the ASF to support it all, the exclusion of whole languages >from ASF projects or treating some as second class citizens because >their nightly builds wouldn't be testable. Neither of those strike me as >great results. Good points, ultimately I think I did not express what I meant precisely enough Nightly builds generated by a project e.g. by a projects nightly build job on Jenkins MUST live on ASF Infrastructure If there is sufficient mass of projects needing a specific kind of repository service available that isn't currently then there is nothing stopping those projects from starting the appropriate discussions with Infra as to whether such a service could be provided OTOH individuals are free to do whatever they want without their ASF hats on and publish their own personal nightly builds wherever and however they want provided that they appropriately distinguish them from ASF actions and releases. However if individuals start publishing stuff to popular public central repository services then clearly there is a danger of confusion as to the source of the package(s). Rob > >Markus > >--------------------------------------------------------------------- >To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org >For additional commands, e-mail: general-h...@incubator.apache.org > --------------------------------------------------------------------- To unsubscribe, e-mail: general-unsubscr...@incubator.apache.org For additional commands, e-mail: general-h...@incubator.apache.org
