You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@community.apache.org by lewis john mcgibbney <le...@apache.org> on 2018/02/08 18:26:10 UTC

Issues with hosting unpublished SNAPSHOT then using it in a release candidate

Hi Folks,
Over at Any23 [0], we have, for some time, been depending upon an old
SNAPSHOT of commons-csv which we host in SVN [1] and utilize in our POM [2].
During a recent review process for our 2.2 release candidate, it was
pointed out that there may be an issue with this practice.
Can someone please point me towards documentation on this practice such
that we can determine if we need to fix the issue or if we can release the
candidate then fix for the next release?
Thank you kindly,
Lewis

[0] http://any23.apache.org
[1] https://svn.apache.org/repos/asf/any23/repo-ext/
[2] https://github.com/apache/any23/blob/master/pom.xml#L603-L606

-- 
http://home.apache.org/~lewismc/
http://people.apache.org/keys/committer/lewismc

Re: Issues with hosting unpublished SNAPSHOT then using it in a release candidate

Posted by Bertrand Delacretaz <bd...@apache.org>.
+1 to what Luciano says below.

-Bertrand

On Thu, Feb 8, 2018 at 9:04 PM, Luciano Resende <lu...@gmail.com> wrote:
> ...If you are maintaining your own SNAPSHOT of a given project (e.g.
> commons-csv) and assuming they are not going to perform a release, you
> might be better performing a release yourself...

> ...Having said that, I would really try to discuss with commons-csv if they
> could help and accept your changes and perform a release...

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org

Re: Issues with hosting unpublished SNAPSHOT then using it in a release candidate

Posted by Luciano Resende <lu...@gmail.com>.
SNAPSHOTS can be modified (overridden by a new version of the snapshot or
deleted) and will break the following release policy rule:

'Every ASF release MUST contain one or more source packages, which MUST be
sufficient for a user to build and test the release provided they have
access to the appropriate platform and tools.'

If you are maintaining your own SNAPSHOT of a given project (e.g.
commons-csv) and assuming they are not going to perform a release, you
might be better performing a release yourself (Any23) which is not perfect
but I have seen other projects doing it (e.g.
https://search.maven.org/#search%7Cga%7C1%7Cg%3A%22org.spark-project.hive%22
)

Having said that, I would really try to discuss with commons-csv if they
could help and accept your changes and perform a release.

[1] http://www.apache.org/legal/release-policy.html#source-packages

On Thu, Feb 8, 2018 at 10:26 AM, lewis john mcgibbney <le...@apache.org>
wrote:

> Hi Folks,
> Over at Any23 [0], we have, for some time, been depending upon an old
> SNAPSHOT of commons-csv which we host in SVN [1] and utilize in our POM
> [2].
> During a recent review process for our 2.2 release candidate, it was
> pointed out that there may be an issue with this practice.
> Can someone please point me towards documentation on this practice such
> that we can determine if we need to fix the issue or if we can release the
> candidate then fix for the next release?
> Thank you kindly,
> Lewis
>
> [0] http://any23.apache.org
> [1] https://svn.apache.org/repos/asf/any23/repo-ext/
> [2] https://github.com/apache/any23/blob/master/pom.xml#L603-L606
>
> --
> http://home.apache.org/~lewismc/
> http://people.apache.org/keys/committer/lewismc
>



-- 
Luciano Resende
http://twitter.com/lresende1975
http://lresende.blogspot.com/

Re: Issues with hosting unpublished SNAPSHOT then using it in a release candidate

Posted by Lewis John McGibbney <le...@apache.org>.
Hi Folks,
Thank you to everyone that replied here. Some excellent guidance which I appreciate.
In resolution, we made the upgrade in Any23 https://issues.apache.org/jira/browse/ANY23-264
I think we will most likely drop the release candidate, spin a new one and get back to VOTE'ing.
Thank you
Lewis

On 2018/02/08 20:52:15, Phil Steitz <ph...@gmail.com> wrote: 
> Hi Lewis,
> 
> Did you build the snapshot jar yourself?  If not, where did you get
> it?  Are you bundling the compiled jar with your distribution?
> 
> It would be much better to either upgrade to a released version (the
> best alternative) or if that is too painful, grab the sources,
> repackage them and incorporate the source into your distro.   It
> looks like there is a revision number in the snapshot jar name, so
> you could probably recover the source by checking out the revision
> it refers to. The problem with depending on (and I assume
> distributing) an unreleased snapshot jar is you can't be sure what
> is in it and keeping the package name also makes it effectively a
> release of the snapshotted component, which was not voted by the
> owning PMC, which is a no-no (see below).  Pulling in and
> repackaging the sources makes it clear what is going on and also
> gives users access to the source.  Or better, just upgrade to a
> released version.
> 
> In terms of policy, see the section in [1] on "Distribution of
> unreleased materials."  If you bundle the unreleased jar, you are
> violating this policy.  If you incorporate the source, included it
> in your distribution and release it, then *you* are releasing it,
> which is OK, though repackaging should be done in this case to avoid
> confusion with source and artifacts from the other PMC.
> 
> Phil
> 
> [1] http://www.apache.org/dev/release-distribution.html
> 
> On 2/8/18 11:26 AM, lewis john mcgibbney wrote:
> > Hi Folks,
> > Over at Any23 [0], we have, for some time, been depending upon an old
> > SNAPSHOT of commons-csv which we host in SVN [1] and utilize in our POM [2].
> > During a recent review process for our 2.2 release candidate, it was
> > pointed out that there may be an issue with this practice.
> > Can someone please point me towards documentation on this practice such
> > that we can determine if we need to fix the issue or if we can release the
> > candidate then fix for the next release?
> > Thank you kindly,
> > Lewis
> >
> > [0] http://any23.apache.org
> > [1] https://svn.apache.org/repos/asf/any23/repo-ext/
> > [2] https://github.com/apache/any23/blob/master/pom.xml#L603-L606
> >
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
> For additional commands, e-mail: dev-help@community.apache.org
> 
> 

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org

Re: Issues with hosting unpublished SNAPSHOT then using it in a release candidate

Posted by Phil Steitz <ph...@gmail.com>.
Hi Lewis,

Did you build the snapshot jar yourself?  If not, where did you get
it?  Are you bundling the compiled jar with your distribution?

It would be much better to either upgrade to a released version (the
best alternative) or if that is too painful, grab the sources,
repackage them and incorporate the source into your distro.   It
looks like there is a revision number in the snapshot jar name, so
you could probably recover the source by checking out the revision
it refers to. The problem with depending on (and I assume
distributing) an unreleased snapshot jar is you can't be sure what
is in it and keeping the package name also makes it effectively a
release of the snapshotted component, which was not voted by the
owning PMC, which is a no-no (see below).  Pulling in and
repackaging the sources makes it clear what is going on and also
gives users access to the source.  Or better, just upgrade to a
released version.

In terms of policy, see the section in [1] on "Distribution of
unreleased materials."  If you bundle the unreleased jar, you are
violating this policy.  If you incorporate the source, included it
in your distribution and release it, then *you* are releasing it,
which is OK, though repackaging should be done in this case to avoid
confusion with source and artifacts from the other PMC.

Phil

[1] http://www.apache.org/dev/release-distribution.html

On 2/8/18 11:26 AM, lewis john mcgibbney wrote:
> Hi Folks,
> Over at Any23 [0], we have, for some time, been depending upon an old
> SNAPSHOT of commons-csv which we host in SVN [1] and utilize in our POM [2].
> During a recent review process for our 2.2 release candidate, it was
> pointed out that there may be an issue with this practice.
> Can someone please point me towards documentation on this practice such
> that we can determine if we need to fix the issue or if we can release the
> candidate then fix for the next release?
> Thank you kindly,
> Lewis
>
> [0] http://any23.apache.org
> [1] https://svn.apache.org/repos/asf/any23/repo-ext/
> [2] https://github.com/apache/any23/blob/master/pom.xml#L603-L606
>


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org