Re: Find a better name for "sidebar"?

[Andre Fischer]

On 24.05.2013 00:52, Andrea Pescetti wrote:

Jörg Schmidt wrote:

reflect together about a better name for "sidebar", maybe we can find
a better name.


Call it "OpenBar" then.

Open like OpenOffice. Bar like in Toolbar. And "Open Bar" like "get 
everything you want for free". Oh well.



Everything You answer me, that's my suggestion is apparently
uncomfortable.


It isn't. You raised a point that is indeed new. Nobody so far had 
thought about the naming issue.


That is not quite true.  I asked on this list a couple of months ago 
about how to name things.  I did not get many replies, so I chose the 
names myself an noted them in the glossary of the sidebar wiki page.  I 
did not invent any of the names, I just chose from what was already 
there (old Impress tool panel, Symphony sidebar).


I personally still prefer the name "sidebar".  I believe that ,any users 
will have intuitively at least a general understanding when they hear 
that name.  This is a semi-established name.  From [1] :


Sidebar (computing)
The *sidebar* is a term that is used for a GUI element 
 
that displays various forms of information to the side of an application 
or desktop user interface.


Why invent a new name that everybody has to learn.  Besides, for 
practical reasons it would be nice to use the same name for the sidebar 
on the UI and in the implementation.   Not doing this can be quite 
confusing as I have learned from the old Impress sidebar aka toolpanel 
aka taskpane.  It is way to late to rename the implementation.


I do see the need for good marketing and at the moment the sidebar may 
appear to be a shiny new thing.  I do believe that it is an improvement 
of usability.  But lets be objective, it is something that other 
applications and even AOO had for a while: look at wordperfect, kword, 
Impress.


-Andre

[1] http://en.wikipedia.org/wiki/Sidebar_%28computing%29

But I agree that you have a point here: if it is a unique feature, it 
makes sense to at least think about a possible cute name for it. You 
contributed a fresh point of view into the project, and nobody 
complained about this.



It is very important to the AOO has good technical quality, but if we
believe it is sufficient for success, we are wrong.


Our developers are very reasonable people. Juergen gave pragmatic 
answers... that were totally to be expected if you come up with this 
idea on the same day when we finalize the help contents for 
translation! But for sure our developers do not expect to be 
worshipped and they are very friendly towards the community at large 
(remember, they do subscribe to this list and live with it despite the 
huge amount of non-technical content here). So I don't agree with your 
opinion that developers cannot see that marketing is important: they 
do see it, but their day-to-day concern is to produce high-quality 
software... and give other volunteers awesome software to promote!


Regards,
  Andrea.

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: svn git setup instructions.

[Andre Fischer]

On 23.05.2013 19:22, Regina Henschel wrote:

Hi Jan,

Ariel is the expert here. But perhaps some sites help you, which I 
have bookmarked:

https://git.wiki.kernel.org/index.php/GitSvnCrashCourse
http://jan-krueger.net/development/git-cheat-sheet-take-two
http://utsl.gen.nz/talks/git-svn/intro.html
http://trac.parrot.org/parrot/wiki/git-svn-tutorial

janI schrieb:

Hi.

I have now been trying for some time to get git-svn working.

Can someone help me getting it to work, by giving me the 
n-instructions I

need (maybe we should make a wiki page).


I think a Wiki page is a good idea. I can add only things, which I 
have learned as beginner, although that might be helpful for other 
beginners. But I'm busy in my daily job for the next month.


Please do.  I would like to hear more about your experience and that of 
others.  I check in code frequently and locally use git instead of svn.  
But up to now I did not find the courage to use git to commit directly 
to the svn repository :-)


-Andre





I want to be able to commit locally with my smaller changes, and in svn
everytime I have something that works. git-svn should be able to do 
that.

But it seems it does not like:
- merge from trunk (which I of course need from time to time)
- seeing trunk and branch/l10n as 2 different branches on my disk

I am obviously doing something wrong, so please let me hear how are you
getting it to work ?

Currently I have trunk and branches/l10n on my disk as one big "svn 
co" on

ubuntu 12.04

Thanks in advance for your help.


I'm not sure, but have a look at git stash --help. It might fit for 
your problems.

Or the workflow described here:
http://stackoverflow.com/questions/4371044/will-this-git-svn-workflow-work 



Kind regards
Regina

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org




-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: svn git setup instructions.

[Jürgen Schmidt]

On 5/24/13 9:19 AM, Andre Fischer wrote:
> On 23.05.2013 19:22, Regina Henschel wrote:
>> Hi Jan,
>>
>> Ariel is the expert here. But perhaps some sites help you, which I
>> have bookmarked:
>> https://git.wiki.kernel.org/index.php/GitSvnCrashCourse
>> http://jan-krueger.net/development/git-cheat-sheet-take-two
>> http://utsl.gen.nz/talks/git-svn/intro.html
>> http://trac.parrot.org/parrot/wiki/git-svn-tutorial
>>
>> janI schrieb:
>>> Hi.
>>>
>>> I have now been trying for some time to get git-svn working.
>>>
>>> Can someone help me getting it to work, by giving me the
>>> n-instructions I
>>> need (maybe we should make a wiki page).
>>
>> I think a Wiki page is a good idea. I can add only things, which I
>> have learned as beginner, although that might be helpful for other
>> beginners. But I'm busy in my daily job for the next month.
> 
> Please do.  I would like to hear more about your experience and that of
> others.  I check in code frequently and locally use git instead of svn. 
> But up to now I did not find the courage to use git to commit directly
> to the svn repository :-)

for me it looks more that we use svn for only practical reasons, it is
the main repository system at the ASF. Some other projects have migrated
to git already and use git for their normal work.

The whole discussion shows that we should think about a migration of our
code repository to git as well. And please note I talk about the code
repo only. I believe that >90% of our developers prefer to work with git
via git-svn.

I propose that we discuss a potential migration of our code repo to git
after AOO 4.0.

Juergen


> 
> -Andre
> 
>>
>>>
>>> I want to be able to commit locally with my smaller changes, and in svn
>>> everytime I have something that works. git-svn should be able to do
>>> that.
>>> But it seems it does not like:
>>> - merge from trunk (which I of course need from time to time)
>>> - seeing trunk and branch/l10n as 2 different branches on my disk
>>>
>>> I am obviously doing something wrong, so please let me hear how are you
>>> getting it to work ?
>>>
>>> Currently I have trunk and branches/l10n on my disk as one big "svn
>>> co" on
>>> ubuntu 12.04
>>>
>>> Thanks in advance for your help.
>>
>> I'm not sure, but have a look at git stash --help. It might fit for
>> your problems.
>> Or the workflow described here:
>> http://stackoverflow.com/questions/4371044/will-this-git-svn-workflow-work
>>
>>
>> Kind regards
>> Regina
>>
>> -
>> To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
>> For additional commands, e-mail: dev-h...@openoffice.apache.org
>>
> 
> 
> -
> To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
> For additional commands, e-mail: dev-h...@openoffice.apache.org
> 


-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: Find a better name for "sidebar"?

[Jörg Schmidt]

Hello, 

> From: Andre Fischer [mailto:awf@gmail.com] 

> > Open like OpenOffice. Bar like in Toolbar. And "Open Bar" like "get 
> > everything you want for free". Oh well.
> >
> >> Everything You answer me, that's my suggestion is apparently
> >> uncomfortable.
> >
> > It isn't. You raised a point that is indeed new. Nobody so far had 
> > thought about the naming issue.
> 
> That is not quite true.  I asked on this list a couple of months ago 
> about how to name things.  I did not get many replies, so I chose the 
> names myself an noted them in the glossary of the sidebar 
> wiki page.  I 
> did not invent any of the names, I just chose from what was already 
> there (old Impress tool panel, Symphony sidebar).
> 
> I personally still prefer the name "sidebar".  I believe that 
> ,any users 
> will have intuitively at least a general understanding when they hear 
> that name.  This is a semi-established name.  From [1] :

Sorry, but you do not understand the essential point, of course, as everyone 
understands 'brown soda with cola taste', but is a much better word like 
"Pepsi" or "Coke".

At least that's my thought.

> I do see the need for good marketing 

???

I do not understand this statement.

> But lets be objective, it is something that other 
> applications and even AOO had for a while: look at 
> wordperfect, kword, 
> Impress.

Objectively correct, but that is not the way of looking at how marketing works.

To me it is not so important whether one or marketing code (QA, ...) holds for 
a little more important, but the point is *also a good product* needs good 
marketing.

Or would you do if you you are applying for a job, you actually talk about the 
only one developer to how many other developers as well?

I think you would your benefits (your knowledge, your experience) turn out, 
even if objectively many others the same as you know and can.


Greetings,
Jörg



-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: Find a better name for "sidebar"?

[Jörg Schmidt]

 
> > I do see the need for good marketing 
> 
> ???
> 
> I do not understand this statement.

i am so sorry

I had mistakenly read "dont" instead of "do"



Greetings,
Jörg


-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: Find a better name for "sidebar"?

[Jürgen Schmidt]

On 5/24/13 9:47 AM, Jörg Schmidt wrote:
>  
>>> I do see the need for good marketing 
>>
>> ???
>>
>> I do not understand this statement.
> 
> i am so sorry
> 
> I had mistakenly read "dont" instead of "do"
> 

I believe you put far too much weight in a name of an of course good
feature.

The sidebar is a concept to improve the usability for many features we
already have and it is hopefully only the beginning. And it is also the
entry point to hook external features smoothly in the office. I can
think of many nice things that be hooked as a new deck with one or more
content panels...
But nobody will talk about deck or content panels, that are internal
technical names. People will talk about a new sidebar if at all or will
simply use it.

We can of course do very good marketing by simply start working on a
campaign to promote the feature itself. Again I would love to see some
nice screencast and other useful stuff, blog posts, or complete articles.

But instead of really start working on such a campaign, people start
discussing a name. Such discussion involves always many people because
it is so easy to express the own opinion but do nothing.

And besides the fact that sidebar is already settled in many heads
(including users) we don't have a better name yet. Nothing of the
proposed names is worth the effort of such a change now fro my point of
view.

And I don't think that it is necessary to do proper marketing ;-)

Juergen


> 
> 
> Greetings,
> Jörg
> 
> 
> -
> To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
> For additional commands, e-mail: dev-h...@openoffice.apache.org
> 


-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: Find a better name for "sidebar"?

[Rory O'Farrell]

I'm cutting previous quotes, as many of the arguments in them are not 
immediately relevant to the question of a suuitable name.

I would argue against the use of "bar" in connection with the sidepanel.  It is 
not a bar in the normal understanding of the word in computing - a bar being 
long and thin and (typically) one icon tall, although there can be exceptions.

"Panel" or "box" is in my view more descriptive. 

We might consider variations on a car or aeroplane's "instrument panel" or 
"control panel" or perhaps a ship's "binnacle" or a human "nerve centre" or 
medically a "monitoring console".


-- 
Rory O'Farrell 

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: Find a better name for "sidebar"?

[Andre Fischer]

On 24.05.2013 09:34, Jörg Schmidt wrote:

Hello,


From: Andre Fischer [mailto:awf@gmail.com]

Open like OpenOffice. Bar like in Toolbar. And "Open Bar" like "get
everything you want for free". Oh well.


Everything You answer me, that's my suggestion is apparently
uncomfortable.

It isn't. You raised a point that is indeed new. Nobody so far had
thought about the naming issue.

That is not quite true.  I asked on this list a couple of months ago
about how to name things.  I did not get many replies, so I chose the
names myself an noted them in the glossary of the sidebar
wiki page.  I
did not invent any of the names, I just chose from what was already
there (old Impress tool panel, Symphony sidebar).

I personally still prefer the name "sidebar".  I believe that
,any users
will have intuitively at least a general understanding when they hear
that name.  This is a semi-established name.  From [1] :

Sorry, but you do not understand the essential point, of course, as everyone understands 'brown 
soda with cola taste', but is a much better word like "Pepsi" or "Coke".


I am quite aware of the difference between a generic name and a 
marketable "brand" name.  I just don't think that the sidebar deserves 
this honor.




At least that's my thought.


I do see the need for good marketing

???

I do not understand this statement.


But lets be objective, it is something that other
applications and even AOO had for a while: look at
wordperfect, kword,
Impress.

Objectively correct, but that is not the way of looking at how marketing works.

To me it is not so important whether one or marketing code (QA, ...) holds for 
a little more important, but the point is *also a good product* needs good 
marketing.

Or would you do if you you are applying for a job, you actually talk about the 
only one developer to how many other developers as well?

I think you would your benefits (your knowledge, your experience) turn out, 
even if objectively many others the same as you know and can.


Hm, I think that we should be careful about our claims.  The sidebar in 
itself is a me-too feature, not the first of its kind.  If we want to 
market it then we have to find the aspects of the sidebar that are 
unique or better than in other applications.  If we already have them, 
great.  If not then we should work for 4.1 to get them. It appears that 
the sidebar now gets attention from a lot of people in this community.  
It would be great if we could turn this attention into a list of new 
ideas for improvements and new features of the sidebar.


-Andre




Greetings,
Jörg



-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org




-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

[Extension Repository] Cannot publish new extension

[Kázmér Koleszár]

We already have several extensions in the Repository (EuroOffice
extensions), but some weeks ago,  as we tried to publish some new
extensions, we just couldn't find any "Publish" checkbox or button. We can
update our published extensions, the problem is only with the new ones.
Please let me know what could be the cause...

Thank you,
Kázmér Koleszár
MultiRáció, Hungary
+36 30 3995080

Re: [buildbot] investigate nightly windows build

[Oliver-Rainer Wittmann]

Hi,

On 23.05.2013 09:19, Oliver-Rainer Wittmann wrote:


[snip]



I have seen that #621 of aoo-win7 also had this error and that you had
again cleaned up the hanging processes.

In order to get some error output I will switch off the HTML output (no
"--html" option) and the multiprocessor build (no "-P2 -- -P2" options)
before the weekly clean build of aoo-win7 and for the aoo-w7ia2 build
which is always clean.



Build #113 of aoo-w7ia2 went well.
The failure occured just because I forgot to disable the collection of
the HTML build logs.

I'm confused - was there something wrong with the w7ia2 build.  The
previous two builds were clean: http://ci.apache.org/builders/aoo-w7ia2
Other than stumbling over hung processes, I don't think there is an
issue with ia2.


We had observed the problem of the hanging process.
#105 had hanging process
#106 went well after your process cleaning
#107, #108, #109, #110 had again problems with hanging processes
#111 went well after your process cleaning
#112 the first successful build without your invention
#113 went well with my first temporary investigation stuff - failure
just because of error in copying non-existing HTML logs.
#114 went well with my second investigation stuff

I decided to do some investigation stuff as the problem showed up two
times in the last days. Currently, we do not hit the problem. But when
it occurs again, we will have some more information due to the different
logging. The problem of the current HTML logging is that we do not have
it, when the hanging process error occurs.

As #114 went well I will now switch on the default multiprocesses builds
- 2 modules built in parallel with each using 2 make/dmake processes.



#115 build of aoo-w7ia2 having standard multiprocessor builds (options 
"-P2 -- -P2") went well.
I will leave the HTML output switched off until Monday. May be the 
problem with the hanging process occurs. Then we have some output when 
and where it occurs.


For the coming clean build of aoo-win7 at the weekend I will switch off 
its HTML output in order to have some output in case the problem with 
the hanging process occurs.



Best regards, Oliver.

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: CMIS - First Code using Apache Chemistry Java API

[Jürgen Schmidt]

On 5/21/13 6:28 PM, Rajath Shashidhara wrote:
> Hello everyone,
> I began developing using Apache Chemistry API today inorder to get used to
> it before GSoC. I have written some code. It has some runtime errors. Help
> me in correcting it.
> 
> https://github.com/rajaths589/CMISTrial.git
> 

Hi Rajath,

sorry for answering late but I was busy with many other things. I don't
know what your current problem is or if it still exists. Chemistry
provides a lot of samples and it is probably a good idea to work through
this samples to become familiar with the library and the API's.

And the Chemistry project has also a dev mailing list and I am sure they
are open to answer your questions regarding Chemistry. They are of
course the experts of the CMIS stuff and we are the experts on the
office stuff ;-)

Regards

Juergen

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: svn git setup instructions.

[janI]

On 24 May 2013 09:33, Jürgen Schmidt  wrote:

> On 5/24/13 9:19 AM, Andre Fischer wrote:
> > On 23.05.2013 19:22, Regina Henschel wrote:
> >> Hi Jan,
> >>
> >> Ariel is the expert here. But perhaps some sites help you, which I
> >> have bookmarked:
> >> https://git.wiki.kernel.org/index.php/GitSvnCrashCourse
> >> http://jan-krueger.net/development/git-cheat-sheet-take-two
> >> http://utsl.gen.nz/talks/git-svn/intro.html
> >> http://trac.parrot.org/parrot/wiki/git-svn-tutorial
> >>
> >> janI schrieb:
> >>> Hi.
> >>>
> >>> I have now been trying for some time to get git-svn working.
> >>>
> >>> Can someone help me getting it to work, by giving me the
> >>> n-instructions I
> >>> need (maybe we should make a wiki page).
> >>
> >> I think a Wiki page is a good idea. I can add only things, which I
> >> have learned as beginner, although that might be helpful for other
> >> beginners. But I'm busy in my daily job for the next month.
> >
> > Please do.  I would like to hear more about your experience and that of
> > others.  I check in code frequently and locally use git instead of svn.
> > But up to now I did not find the courage to use git to commit directly
> > to the svn repository :-)
>
> for me it looks more that we use svn for only practical reasons, it is
> the main repository system at the ASF. Some other projects have migrated
> to git already and use git for their normal work.
>
> The whole discussion shows that we should think about a migration of our
> code repository to git as well. And please note I talk about the code
> repo only. I believe that >90% of our developers prefer to work with git
> via git-svn.
>
> I propose that we discuss a potential migration of our code repo to git
> after AOO 4.0.
>

I am looking at INFRA-5590 to see if it can be speeded up, that would give
us the best of 2 worlds. svn with a git-hub allowing developers to choose.

I we on the other prefer a pure GIT environment in the mid.-term, I am not
sure I succeed in getting us a git-hub temporary.

rgds
jan I.


>
> Juergen
>
>
> >
> > -Andre
> >
> >>
> >>>
> >>> I want to be able to commit locally with my smaller changes, and in svn
> >>> everytime I have something that works. git-svn should be able to do
> >>> that.
> >>> But it seems it does not like:
> >>> - merge from trunk (which I of course need from time to time)
> >>> - seeing trunk and branch/l10n as 2 different branches on my disk
> >>>
> >>> I am obviously doing something wrong, so please let me hear how are you
> >>> getting it to work ?
> >>>
> >>> Currently I have trunk and branches/l10n on my disk as one big "svn
> >>> co" on
> >>> ubuntu 12.04
> >>>
> >>> Thanks in advance for your help.
> >>
> >> I'm not sure, but have a look at git stash --help. It might fit for
> >> your problems.
> >> Or the workflow described here:
> >>
> http://stackoverflow.com/questions/4371044/will-this-git-svn-workflow-work
> >>
> >>
> >> Kind regards
> >> Regina
> >>
> >> -
> >> To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
> >> For additional commands, e-mail: dev-h...@openoffice.apache.org
> >>
> >
> >
> > -
> > To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
> > For additional commands, e-mail: dev-h...@openoffice.apache.org
> >
>
>
> -
> To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
> For additional commands, e-mail: dev-h...@openoffice.apache.org
>
>

Re: Alternative to ooo-extras?

[Rob Weir]

On Thu, May 23, 2013 at 3:26 AM, Herbert Dürr  wrote:
> Just a heads up:
>
> We are using ooo-extras [1] as reliable mirror to the upstream locations of
> third party code with non-permissive licenses. Today's google opensource
> blog [2] says that this method will stop working in 2014. We need to find an
> alternative.
>

Maybe we bite the bullet and have the long discussion with Infra/Legal
and the ASF Board if necessary to explain why storing this on ASF
servers makes the most sense in terms of serving our downstream
consumers and ensuring the long-term stability and usefulness of our
releases.  It would be a painful discussion since we're not doing the
same thing that everyone else does, and anything unusual is instantly
suspected of being immoral.But I think we have very good reasons
for what we're doing that are entirely conformant with ASF policy
goals.

-Rob

> Herbert
>
> [1] https://code.google.com/a/apache-extras.org/p/ooo-extras/
> [2]
> http://google-opensource.blogspot.com/2013/05/a-change-to-google-code-download-service.html
>
> -
> To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
> For additional commands, e-mail: dev-h...@openoffice.apache.org
>

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: CMIS - First Code using Apache Chemistry Java API

[Rajath Shashidhara]

Hello Juergen,

I have mailed the Chemistry dev group as well.
The run-time error is probably caused due to wrong build configurations on
my eclipse.
There is nothing wrong with my code.
So, I'm trying to get it working!!

Thanks anyways.


On Fri, May 24, 2013 at 1:58 PM, Jürgen Schmidt wrote:

> On 5/21/13 6:28 PM, Rajath Shashidhara wrote:
> > Hello everyone,
> > I began developing using Apache Chemistry API today inorder to get used
> to
> > it before GSoC. I have written some code. It has some runtime errors.
> Help
> > me in correcting it.
> >
> > https://github.com/rajaths589/CMISTrial.git
> >
>
> Hi Rajath,
>
> sorry for answering late but I was busy with many other things. I don't
> know what your current problem is or if it still exists. Chemistry
> provides a lot of samples and it is probably a good idea to work through
> this samples to become familiar with the library and the API's.
>
> And the Chemistry project has also a dev mailing list and I am sure they
> are open to answer your questions regarding Chemistry. They are of
> course the experts of the CMIS stuff and we are the experts on the
> office stuff ;-)
>
> Regards
>
> Juergen
>
> -
> To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
> For additional commands, e-mail: dev-h...@openoffice.apache.org
>
>


-- 
Rajath S,
M.Sc(Hons.) Physics,
Birla Institute of Technology and Science - Pilani,
Pilani

Re: svn git setup instructions.

[Albino B Neto]

2013/5/24 Jürgen Schmidt :
> for me it looks more that we use svn for only practical reasons, it is
> the main repository system at the ASF. Some other projects have migrated
> to git already and use git for their normal work.

Me too.

> The whole discussion shows that we should think about a migration of our
> code repository to git as well. And please note I talk about the code
> repo only. I believe that >90% of our developers prefer to work with git
> via git-svn.
>
> I propose that we discuss a potential migration of our code repo to git
> after AOO 4.0.

Yes.

 Albino

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: [Extension Repository] Cannot publish new extension

[Roberto Galoppini]

Sorry about that, we have been under spam attack and we had to suspend
automatic publishing.

Please let us know your username and/or your links, and we'll activate
them right away.

Sorry for the incovenience it might have caused you.

Roberto

2013/5/24 Kázmér Koleszár :
> We already have several extensions in the Repository (EuroOffice
> extensions), but some weeks ago,  as we tried to publish some new
> extensions, we just couldn't find any "Publish" checkbox or button. We can
> update our published extensions, the problem is only with the new ones.
> Please let me know what could be the cause...
>
> Thank you,
> Kázmér Koleszár
> MultiRáció, Hungary
> +36 30 3995080

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Fwd: Official code signing certificate

[janI]

Hi.

we are not alone in ASF wishing code signing, but we might get run over (as
I did today on IRC) if we do not formulate our requirements very clearly.

rgds
jan I.

-- Forwarded message --
From: Scott Deboy 
Date: 24 May 2013 18:59
Subject: Re: Official code signing certificate
To: infrastructure-...@apache.org


Logging Services has a simple requirement:

Have the Chainsaw build artifacts signed by a Java code signing cert
that is signed by a trusted/root CA so the jars can be downloaded via
WebStart without the user receiving a warning that the signed jars
aren't trusted.

The Chainsaw maven script supports signing jars - infra just needs to
point it to the cert.

I don't know whether or not an ASF-wide Java code signing cert makes
sense or a Logging Services-specific Java code signing cert makes
sense.  I don't even know if it is possible to have TLP-specific Java
code signing certs.  I defer to infra on that decision.

I believe the code signing service WRowe described will meet our
requirements.  Hopefully infra can spend some time looking at the
service and see how it can meet their requirements.

Logging Services would like to be a guinea pig for the Java code
signing service WRowe described above.  If there are additional
details needed by infra, we are happy to provide them.

Thanks,

Scott

On 4/12/13, sebb  wrote:
> You are now in http://wiki.apache.org/general/ContributorsGroup
>
>
> On 12 April 2013 17:32, William A. Rowe Jr.  wrote:
>
>> On Fri, 12 Apr 2013 10:47:29 -0500
>> "William A. Rowe Jr."  wrote:
>>
>> > On Tue, 26 Mar 2013 00:56:06 +0200
>> > Daniel Shahaf  wrote:
>> >
>> > > Can you write this all down somewhere?  A wiki page maybe
>> >
>> > http://wiki.apache.org/general/ASFCodeSigning
>>
>> Could one of the page editors please grant WilliamARoweJr some
>> karma?  I'll document the first-draft approach and the Symantec
>> service-based approach.
>>
>

Re: pootle server.

[Claudio Filho]

Hi

I tried to access the Pootle and returned the Sonar, at
https://analysis.apache.org/. Is correct it?

Bests,
Claudio

2013/5/23 janI :
> Hi.
>
> We have to take pootle down for about 2 hours due to a urgently needed
> maintenance, sorry for the short warning.
>
> Downtime is expected to be: UTC 18:00 to UTC 20:00 max.
>
> rgds
> jan I.

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: pootle server.

[jan iversen]

Den 24/05/2013 20.06 skrev "Claudio Filho" :
>
> Hi
>
> I tried to access the Pootle and returned the Sonar, at
> https://analysis.apache.org/. Is correct it

refresh the page. it is because your cached an old version.
we changed the pottle technical setup yesterday.

rgds
Jan i
>
> Bests,
> Claudio
>
> 2013/5/23 janI :
> > Hi.
> >
> > We have to take pootle down for about 2 hours due to a urgently needed
> > maintenance, sorry for the short warning.
> >
> > Downtime is expected to be: UTC 18:00 to UTC 20:00 max.
> >
> > rgds
> > jan I.
>
> -
> To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
> For additional commands, e-mail: dev-h...@openoffice.apache.org
>

Re: pootle server.

[Claudio Filho]

2013/5/24 jan iversen :
> refresh the page. it is because your cached an old version.
> we changed the pottle technical setup yesterday.

Thanks, Jan. The problem is my (corporative) proxy. :-(

But is fine with my 3G connection. Thanks!

Claudio

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: Official code signing certificate

[Rob Weir]

On Fri, May 24, 2013 at 1:50 PM, janI  wrote:
> Hi.
>
> we are not alone in ASF wishing code signing, but we might get run over (as
> I did today on IRC) if we do not formulate our requirements very clearly.
>

Can you give us a better sense of what part of AOO code signing is
unclear to Infra?  We've been discussing this for more than a year
now, so I'd be surprised if there are any technological questions
remaining at this point.

-Rob


> rgds
> jan I.
>
> -- Forwarded message --
> From: Scott Deboy 
> Date: 24 May 2013 18:59
> Subject: Re: Official code signing certificate
> To: infrastructure-...@apache.org
>
>
> Logging Services has a simple requirement:
>
> Have the Chainsaw build artifacts signed by a Java code signing cert
> that is signed by a trusted/root CA so the jars can be downloaded via
> WebStart without the user receiving a warning that the signed jars
> aren't trusted.
>
> The Chainsaw maven script supports signing jars - infra just needs to
> point it to the cert.
>
> I don't know whether or not an ASF-wide Java code signing cert makes
> sense or a Logging Services-specific Java code signing cert makes
> sense.  I don't even know if it is possible to have TLP-specific Java
> code signing certs.  I defer to infra on that decision.
>
> I believe the code signing service WRowe described will meet our
> requirements.  Hopefully infra can spend some time looking at the
> service and see how it can meet their requirements.
>
> Logging Services would like to be a guinea pig for the Java code
> signing service WRowe described above.  If there are additional
> details needed by infra, we are happy to provide them.
>
> Thanks,
>
> Scott
>
> On 4/12/13, sebb  wrote:
>> You are now in http://wiki.apache.org/general/ContributorsGroup
>>
>>
>> On 12 April 2013 17:32, William A. Rowe Jr.  wrote:
>>
>>> On Fri, 12 Apr 2013 10:47:29 -0500
>>> "William A. Rowe Jr."  wrote:
>>>
>>> > On Tue, 26 Mar 2013 00:56:06 +0200
>>> > Daniel Shahaf  wrote:
>>> >
>>> > > Can you write this all down somewhere?  A wiki page maybe
>>> >
>>> > http://wiki.apache.org/general/ASFCodeSigning
>>>
>>> Could one of the page editors please grant WilliamARoweJr some
>>> karma?  I'll document the first-draft approach and the Symantec
>>> service-based approach.
>>>
>>

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: Official code signing certificate

[Juergen Schmidt]

Am Freitag, 24. Mai 2013 um 19:50 schrieb janI:

> Hi.
> 
> we are not alone in ASF wishing code signing, but we might get run over (as
> I did today on IRC) if we do not formulate our requirements very clearly.
> 
> 

decisions are made on mailing lists, correct? That is what I learned at Apache, 
what not happened on a mailing list, is not relevant ;-)
Well it seems that infra is always special.
I tried several times to discuss it on the infra mailing list and I believe I 
have described very clearly what we need and how it works today for OpenOffice 
if we would have a cert. I also proposed a solution that can work from my point 
of view and I started to collect the info on a wiki page as suggested. 
There might be other solutions to do it but I have no in place and nobody 
convinced me that my proposed approach can not work. 
I agree that it's not easy and I simply have no energy to discuss further at 
the moment. I have enough other things to do. 

Juergen
> 
> rgds
> jan I.
> 
> -- Forwarded message --
> From: Scott Deboy 
> Date: 24 May 2013 18:59
> Subject: Re: Official code signing certificate
> To: infrastructure-...@apache.org
> 
> 
> Logging Services has a simple requirement:
> 
> Have the Chainsaw build artifacts signed by a Java code signing cert
> that is signed by a trusted/root CA so the jars can be downloaded via
> WebStart without the user receiving a warning that the signed jars
> aren't trusted.
> 
> The Chainsaw maven script supports signing jars - infra just needs to
> point it to the cert.
> 
> I don't know whether or not an ASF-wide Java code signing cert makes
> sense or a Logging Services-specific Java code signing cert makes
> sense. I don't even know if it is possible to have TLP-specific Java
> code signing certs. I defer to infra on that decision.
> 
> I believe the code signing service WRowe described will meet our
> requirements. Hopefully infra can spend some time looking at the
> service and see how it can meet their requirements.
> 
> Logging Services would like to be a guinea pig for the Java code
> signing service WRowe described above. If there are additional
> details needed by infra, we are happy to provide them.
> 
> Thanks,
> 
> Scott
> 
> On 4/12/13, sebb  wrote:
> > You are now in http://wiki.apache.org/general/ContributorsGroup
> > 
> > 
> > On 12 April 2013 17:32, William A. Rowe Jr.  wrote:
> > 
> > > On Fri, 12 Apr 2013 10:47:29 -0500
> > > "William A. Rowe Jr."  wrote:
> > > 
> > > > On Tue, 26 Mar 2013 00:56:06 +0200
> > > > Daniel Shahaf  wrote:
> > > > 
> > > > > Can you write this all down somewhere? A wiki page maybe
> > > > 
> > > > http://wiki.apache.org/general/ASFCodeSigning
> > > 
> > > Could one of the page editors please grant WilliamARoweJr some
> > > karma? I'll document the first-draft approach and the Symantec
> > > service-based approach.
> > > 
> > 
> > 
> 
> 
> 

Re: Official code signing certificate

[janI]

On 24 May 2013 22:30, Juergen Schmidt  wrote:

>
>
> Am Freitag, 24. Mai 2013 um 19:50 schrieb janI:
>
> > Hi.
> >
> > we are not alone in ASF wishing code signing, but we might get run over
> (as
> > I did today on IRC) if we do not formulate our requirements very clearly.
> >
> >
>
> decisions are made on mailing lists, correct? That is what I learned at
> Apache, what not happened on a mailing list, is not relevant ;-)
> Well it seems that infra is always special.
> I tried several times to discuss it on the infra mailing list and I
> believe I have described very clearly what we need and how it works today
> for OpenOffice if we would have a cert. I also proposed a solution that can
> work from my point of view and I started to collect the info on a wiki page
> as suggested.
> There might be other solutions to do it but I have no in place and nobody
> convinced me that my proposed approach can not work.
> I agree that it's not easy and I simply have no energy to discuss further
> at the moment. I have enough other things to do.
>
> Juergen
> >
> > rgds
> > jan I.
> >
> > -- Forwarded message --
> > From: Scott Deboy 
> > Date: 24 May 2013 18:59
> > Subject: Re: Official code signing certificate
> > To: infrastructure-...@apache.org
> >
> >
> > Logging Services has a simple requirement:
> >
> > Have the Chainsaw build artifacts signed by a Java code signing cert
> > that is signed by a trusted/root CA so the jars can be downloaded via
> > WebStart without the user receiving a warning that the signed jars
> > aren't trusted.
> >
> > The Chainsaw maven script supports signing jars - infra just needs to
> > point it to the cert.
> >
> > I don't know whether or not an ASF-wide Java code signing cert makes
> > sense or a Logging Services-specific Java code signing cert makes
> > sense. I don't even know if it is possible to have TLP-specific Java
> > code signing certs. I defer to infra on that decision.
> >
> > I believe the code signing service WRowe described will meet our
> > requirements. Hopefully infra can spend some time looking at the
> > service and see how it can meet their requirements.
> >
> > Logging Services would like to be a guinea pig for the Java code
> > signing service WRowe described above. If there are additional
> > details needed by infra, we are happy to provide them.
> >
> > Thanks,
> >
> > Scott
> >
> > On 4/12/13, sebb  wrote:
> > > You are now in http://wiki.apache.org/general/ContributorsGroup
> > >
> > >
> > > On 12 April 2013 17:32, William A. Rowe Jr. 
> wrote:
> > >
> > > > On Fri, 12 Apr 2013 10:47:29 -0500
> > > > "William A. Rowe Jr."  wrote:
> > > >
> > > > > On Tue, 26 Mar 2013 00:56:06 +0200
> > > > > Daniel Shahaf  wrote:
> > > > >
> > > > > > Can you write this all down somewhere? A wiki page maybe
> > > > >
> > > > > http://wiki.apache.org/general/ASFCodeSigning
> > > >
> > > > Could one of the page editors please grant WilliamARoweJr some
> > > > karma? I'll document the first-draft approach and the Symantec
> > > > service-based approach.
> > > >
> > >
> > >
> >
>
I am truly sorry that I tried to helpwith those 2 replies, I only
forwarded a mail for your information, I will for sure forget all about
code signing, and leave it to the experts.

During the discussion on IRC, a blog from adobe was thrown in, showing just
how complicated it can be for full time security profs. to ensure the
certificate is not misused.

I am sorry I defended our viewpoint, and made this list aware that there
are other projects with similar needs. You just managed to kill the
messenger, next time this issue is discussed on IRC, I will refer to this
thread and keep silent.

rgds
jan I.

>
> >
>
>
>

Re: Official code signing certificate

[Rob Weir]

On Fri, May 24, 2013 at 5:01 PM, janI  wrote:
> On 24 May 2013 22:30, Juergen Schmidt  wrote:
>
>>
>>
>> Am Freitag, 24. Mai 2013 um 19:50 schrieb janI:
>>
>> > Hi.
>> >
>> > we are not alone in ASF wishing code signing, but we might get run over
>> (as
>> > I did today on IRC) if we do not formulate our requirements very clearly.
>> >
>> >
>>
>> decisions are made on mailing lists, correct? That is what I learned at
>> Apache, what not happened on a mailing list, is not relevant ;-)
>> Well it seems that infra is always special.
>> I tried several times to discuss it on the infra mailing list and I
>> believe I have described very clearly what we need and how it works today
>> for OpenOffice if we would have a cert. I also proposed a solution that can
>> work from my point of view and I started to collect the info on a wiki page
>> as suggested.
>> There might be other solutions to do it but I have no in place and nobody
>> convinced me that my proposed approach can not work.
>> I agree that it's not easy and I simply have no energy to discuss further
>> at the moment. I have enough other things to do.
>>
>> Juergen
>> >
>> > rgds
>> > jan I.
>> >
>> > -- Forwarded message --
>> > From: Scott Deboy 
>> > Date: 24 May 2013 18:59
>> > Subject: Re: Official code signing certificate
>> > To: infrastructure-...@apache.org
>> >
>> >
>> > Logging Services has a simple requirement:
>> >
>> > Have the Chainsaw build artifacts signed by a Java code signing cert
>> > that is signed by a trusted/root CA so the jars can be downloaded via
>> > WebStart without the user receiving a warning that the signed jars
>> > aren't trusted.
>> >
>> > The Chainsaw maven script supports signing jars - infra just needs to
>> > point it to the cert.
>> >
>> > I don't know whether or not an ASF-wide Java code signing cert makes
>> > sense or a Logging Services-specific Java code signing cert makes
>> > sense. I don't even know if it is possible to have TLP-specific Java
>> > code signing certs. I defer to infra on that decision.
>> >
>> > I believe the code signing service WRowe described will meet our
>> > requirements. Hopefully infra can spend some time looking at the
>> > service and see how it can meet their requirements.
>> >
>> > Logging Services would like to be a guinea pig for the Java code
>> > signing service WRowe described above. If there are additional
>> > details needed by infra, we are happy to provide them.
>> >
>> > Thanks,
>> >
>> > Scott
>> >
>> > On 4/12/13, sebb  wrote:
>> > > You are now in http://wiki.apache.org/general/ContributorsGroup
>> > >
>> > >
>> > > On 12 April 2013 17:32, William A. Rowe Jr. 
>> wrote:
>> > >
>> > > > On Fri, 12 Apr 2013 10:47:29 -0500
>> > > > "William A. Rowe Jr."  wrote:
>> > > >
>> > > > > On Tue, 26 Mar 2013 00:56:06 +0200
>> > > > > Daniel Shahaf  wrote:
>> > > > >
>> > > > > > Can you write this all down somewhere? A wiki page maybe
>> > > > >
>> > > > > http://wiki.apache.org/general/ASFCodeSigning
>> > > >
>> > > > Could one of the page editors please grant WilliamARoweJr some
>> > > > karma? I'll document the first-draft approach and the Symantec
>> > > > service-based approach.
>> > > >
>> > >
>> > >
>> >
>>
> I am truly sorry that I tried to helpwith those 2 replies, I only
> forwarded a mail for your information, I will for sure forget all about
> code signing, and leave it to the experts.
>
> During the discussion on IRC, a blog from adobe was thrown in, showing just
> how complicated it can be for full time security profs. to ensure the
> certificate is not misused.
>
> I am sorry I defended our viewpoint, and made this list aware that there
> are other projects with similar needs. You just managed to kill the
> messenger, next time this issue is discussed on IRC, I will refer to this
> thread and keep silent.
>

Jan, I'm sure we all appreciate your attempt to "defend our
viewpoint", but you might not be aware that this has been discussed
repeatedly with Infra, since before you were even involved in the
project.  If there is any frustration expressed it is not with you.

The fact that security is hard or that other projects would benefit
from code signing -- none of this is news.  That doesn't mean that you
were wrong to discuss it.  It just means that you did not have the
information and background that Juergen and I have from trying to push
this forward over a much longer period of time.

There is a thread with 93 posts on infra-dev on this topic dating back
a year.  It probably makes sense to read up on what has been discussed
previously before as background information.

-Rob

> rgds
> jan I.
>
>>
>> >
>>
>>
>>

-
To unsubscribe, e-mail: dev-unsubscr...@openoffice.apache.org
For additional commands, e-mail: dev-h...@openoffice.apache.org

Re: Official code signing certificate

[Rob Weir]

And I should mention that pushing the code signing side is probably
premature until we have the build side more solidly automated.

Every discussion we have had code signing led to the conclusion that
if something is signed it must come from a trusted build traceable to
an SVN revision.  So the pre-req for code signing would be to get the
Windows and MacOS builds, in full release form, with all languages,
built via buildbots.

So moving this forward means moving forward things like:

https://issues.apache.org/jira/browse/INFRA-4902

Then it would be possible to introduce daily builds signed with a
self-signed test certificate.  And then, once this is working
end-to-end, we would use a real certificate.

Code signing is well-understood.  It has been part of Windows
development for nearly 20 years.  The technology is not novel, hard to
understand or difficult to implement.   The main issues are more
procedural than technical.  ASF projects have a release procedure that
is decentralized, whereas code signing works most cleanly in a
centralized/controlled release environment.  That is why the initial
focus should be on getting the releases spun directly from the
buildbots, traceable to approved source revisions.

-Rob


On Fri, May 24, 2013 at 5:21 PM, Rob Weir  wrote:
> On Fri, May 24, 2013 at 5:01 PM, janI  wrote:
>> On 24 May 2013 22:30, Juergen Schmidt  wrote:
>>
>>>
>>>
>>> Am Freitag, 24. Mai 2013 um 19:50 schrieb janI:
>>>
>>> > Hi.
>>> >
>>> > we are not alone in ASF wishing code signing, but we might get run over
>>> (as
>>> > I did today on IRC) if we do not formulate our requirements very clearly.
>>> >
>>> >
>>>
>>> decisions are made on mailing lists, correct? That is what I learned at
>>> Apache, what not happened on a mailing list, is not relevant ;-)
>>> Well it seems that infra is always special.
>>> I tried several times to discuss it on the infra mailing list and I
>>> believe I have described very clearly what we need and how it works today
>>> for OpenOffice if we would have a cert. I also proposed a solution that can
>>> work from my point of view and I started to collect the info on a wiki page
>>> as suggested.
>>> There might be other solutions to do it but I have no in place and nobody
>>> convinced me that my proposed approach can not work.
>>> I agree that it's not easy and I simply have no energy to discuss further
>>> at the moment. I have enough other things to do.
>>>
>>> Juergen
>>> >
>>> > rgds
>>> > jan I.
>>> >
>>> > -- Forwarded message --
>>> > From: Scott Deboy 
>>> > Date: 24 May 2013 18:59
>>> > Subject: Re: Official code signing certificate
>>> > To: infrastructure-...@apache.org
>>> >
>>> >
>>> > Logging Services has a simple requirement:
>>> >
>>> > Have the Chainsaw build artifacts signed by a Java code signing cert
>>> > that is signed by a trusted/root CA so the jars can be downloaded via
>>> > WebStart without the user receiving a warning that the signed jars
>>> > aren't trusted.
>>> >
>>> > The Chainsaw maven script supports signing jars - infra just needs to
>>> > point it to the cert.
>>> >
>>> > I don't know whether or not an ASF-wide Java code signing cert makes
>>> > sense or a Logging Services-specific Java code signing cert makes
>>> > sense. I don't even know if it is possible to have TLP-specific Java
>>> > code signing certs. I defer to infra on that decision.
>>> >
>>> > I believe the code signing service WRowe described will meet our
>>> > requirements. Hopefully infra can spend some time looking at the
>>> > service and see how it can meet their requirements.
>>> >
>>> > Logging Services would like to be a guinea pig for the Java code
>>> > signing service WRowe described above. If there are additional
>>> > details needed by infra, we are happy to provide them.
>>> >
>>> > Thanks,
>>> >
>>> > Scott
>>> >
>>> > On 4/12/13, sebb  wrote:
>>> > > You are now in http://wiki.apache.org/general/ContributorsGroup
>>> > >
>>> > >
>>> > > On 12 April 2013 17:32, William A. Rowe Jr. 
>>> wrote:
>>> > >
>>> > > > On Fri, 12 Apr 2013 10:47:29 -0500
>>> > > > "William A. Rowe Jr."  wrote:
>>> > > >
>>> > > > > On Tue, 26 Mar 2013 00:56:06 +0200
>>> > > > > Daniel Shahaf  wrote:
>>> > > > >
>>> > > > > > Can you write this all down somewhere? A wiki page maybe
>>> > > > >
>>> > > > > http://wiki.apache.org/general/ASFCodeSigning
>>> > > >
>>> > > > Could one of the page editors please grant WilliamARoweJr some
>>> > > > karma? I'll document the first-draft approach and the Symantec
>>> > > > service-based approach.
>>> > > >
>>> > >
>>> > >
>>> >
>>>
>> I am truly sorry that I tried to helpwith those 2 replies, I only
>> forwarded a mail for your information, I will for sure forget all about
>> code signing, and leave it to the experts.
>>
>> During the discussion on IRC, a blog from adobe was thrown in, showing just
>> how complicated it can be for full time security profs. to ensure the
>> certificate is not misused.
>>
>> I am sorry I defe

Re: Official code signing certificate

[Dave Fisher]

Hi Rob,

This is a very well written summary of the situation with Code Signing.

The main concern that the ASF has with digitally signing with a singular 
apache.org certificate for the whole foundation is keeping it in strict 
control. For some this means physical machines. This is a high bar.

I wonder if the ASF would allow AOO to experiment with an OpenOffice.org 
codesigning certificate?

We never thought we would get the wildcard certificate, but hey who knows?

Regards,
Dave

On May 24, 2013, at 2:43 PM, Rob Weir wrote:

> And I should mention that pushing the code signing side is probably
> premature until we have the build side more solidly automated.
> 
> Every discussion we have had code signing led to the conclusion that
> if something is signed it must come from a trusted build traceable to
> an SVN revision.  So the pre-req for code signing would be to get the
> Windows and MacOS builds, in full release form, with all languages,
> built via buildbots.
> 
> So moving this forward means moving forward things like:
> 
> https://issues.apache.org/jira/browse/INFRA-4902
> 
> Then it would be possible to introduce daily builds signed with a
> self-signed test certificate.  And then, once this is working
> end-to-end, we would use a real certificate.
> 
> Code signing is well-understood.  It has been part of Windows
> development for nearly 20 years.  The technology is not novel, hard to
> understand or difficult to implement.   The main issues are more
> procedural than technical.  ASF projects have a release procedure that
> is decentralized, whereas code signing works most cleanly in a
> centralized/controlled release environment.  That is why the initial
> focus should be on getting the releases spun directly from the
> buildbots, traceable to approved source revisions.
> 
> -Rob
> 
> 
> On Fri, May 24, 2013 at 5:21 PM, Rob Weir  wrote:
>> On Fri, May 24, 2013 at 5:01 PM, janI  wrote:
>>> On 24 May 2013 22:30, Juergen Schmidt  wrote:
>>> 
 
 
 Am Freitag, 24. Mai 2013 um 19:50 schrieb janI:
 
> Hi.
> 
> we are not alone in ASF wishing code signing, but we might get run over
 (as
> I did today on IRC) if we do not formulate our requirements very clearly.
> 
> 
 
 decisions are made on mailing lists, correct? That is what I learned at
 Apache, what not happened on a mailing list, is not relevant ;-)
 Well it seems that infra is always special.
 I tried several times to discuss it on the infra mailing list and I
 believe I have described very clearly what we need and how it works today
 for OpenOffice if we would have a cert. I also proposed a solution that can
 work from my point of view and I started to collect the info on a wiki page
 as suggested.
 There might be other solutions to do it but I have no in place and nobody
 convinced me that my proposed approach can not work.
 I agree that it's not easy and I simply have no energy to discuss further
 at the moment. I have enough other things to do.
 
 Juergen
> 
> rgds
> jan I.
> 
> -- Forwarded message --
> From: Scott Deboy 
> Date: 24 May 2013 18:59
> Subject: Re: Official code signing certificate
> To: infrastructure-...@apache.org
> 
> 
> Logging Services has a simple requirement:
> 
> Have the Chainsaw build artifacts signed by a Java code signing cert
> that is signed by a trusted/root CA so the jars can be downloaded via
> WebStart without the user receiving a warning that the signed jars
> aren't trusted.
> 
> The Chainsaw maven script supports signing jars - infra just needs to
> point it to the cert.
> 
> I don't know whether or not an ASF-wide Java code signing cert makes
> sense or a Logging Services-specific Java code signing cert makes
> sense. I don't even know if it is possible to have TLP-specific Java
> code signing certs. I defer to infra on that decision.
> 
> I believe the code signing service WRowe described will meet our
> requirements. Hopefully infra can spend some time looking at the
> service and see how it can meet their requirements.
> 
> Logging Services would like to be a guinea pig for the Java code
> signing service WRowe described above. If there are additional
> details needed by infra, we are happy to provide them.
> 
> Thanks,
> 
> Scott
> 
> On 4/12/13, sebb  wrote:
>> You are now in http://wiki.apache.org/general/ContributorsGroup
>> 
>> 
>> On 12 April 2013 17:32, William A. Rowe Jr. 
 wrote:
>> 
>>> On Fri, 12 Apr 2013 10:47:29 -0500
>>> "William A. Rowe Jr."  wrote:
>>> 
 On Tue, 26 Mar 2013 00:56:06 +0200
 Daniel Shahaf  wrote:
 
> Can you write this all down somewhere? A wiki page maybe
 
 http://wiki.apache.org/general/ASFCodeSigning
>>>