Re: Non-released Dependencies

2014-07-28 Thread sebb
On 28 July 2014 10:20, Greg Stein wrote: > Agreed that #2 is best. > > (and I'll also note I was a bit slack with some commentary; releases need > to be signed, Also source releases must be published via the ASF mirror system. > so a path/revision or git-tag is not necessarily a true s/necessar

Re: Non-released Dependencies

2014-07-28 Thread Greg Stein
Agreed that #2 is best. (and I'll also note I was a bit slack with some commentary; releases need to be signed, so a path/revision or git-tag is not necessarily a true release; just trying to get across that you need a *specific* set of source for a dependency) Seems that Andreas is going to expl

Re: Non-released Dependencies

2014-07-27 Thread Andreas Lehmkuehler
Am 26.07.2014 15:53, schrieb Andreas Lehmkuehler: Am 25.07.2014 16:26, schrieb Greg Stein: I believe you have two options: fork their code into your project, and do some appropriate subpackage renaming to clarify it is distinct. Or, ideally, you join *their* community and help them cut a releas

Re: Non-released Dependencies

2014-07-26 Thread Andreas Lehmkuehler
Am 25.07.2014 16:26, schrieb Greg Stein: I believe you have two options: fork their code into your project, and do some appropriate subpackage renaming to clarify it is distinct. Or, ideally, you join *their* community and help them cut a release, and then base your code on that. Just to clarify

Re: Non-released Dependencies

2014-07-25 Thread Stephen Connolly
I think the key bit here is that releases of Apache projects must have an associated source release and have been voted on by the PMC making the release. If the project you depend on is an independent project, you need to remember that their -SNAPSHOT build is *not* a release. Therefore you need i

Re: Non-released Dependencies

2014-07-25 Thread Matt Hogstrom
We followed option # 1 in Apache Geronimo. We grabbed the source for the dependency projects and built it out of the branch and eventual tag. We hard too many dependencies to wait for all projects to sync up. Matt Hogstrom m...@hogstrom.org +1-919-656-0564 PGP Key: 0x0F143BC1 "Aut Inveniam Vi

Re: Non-released Dependencies

2014-07-25 Thread Greg Stein
[adding dev@community, as I believe this should go there...] On Fri, Jul 25, 2014 at 6:06 AM, Vincent Hennebert wrote: >... > Hi, > > there's an undergoing debate in the XML Graphics project about doing > a release that has a dependency on a snapshot version of another > (Apache, for that matter