You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@chemistry.apache.org by Gabriele Columbro <ga...@apache.org> on 2010/09/01 17:31:55 UTC
Validation of release packages (was: Fwd: [jira] Commented: (CMIS-224) Improve legal/standard aspects of the release process / packaging)
Hey guys,
finally today I could dedicate myself to improve the legal /
distribution aspects of the release. As per the issue below, AFAIU the
packaging issues blocking 0.1.0-rc1 should have been covered.
So, before engaging the release process (also as we're waiting on
[1]), I'd like to ask you guys to have a look the commodity (/dist)
packages I deployed at [1], and help me confirm or deny that:
1. All JARs/WARs have correct info in META-INF (latest SNAPSHOT at [2]
or you can build from trunk)
2. All commodity packages I uploaded at [3] have correct LICENSE and
DISCLAIMER info, and DEPENDENCIES and NOTICE that instead refer to
contained WAR/JAR specific DEPENDENCIES and NOTICE. Docs has not DEPS
and NOTICE, as there are not shipped deps.
Minor glitch, not blocker I believe: the source-release package, being
generated by ASF POM inherited settings is listing superPOM project
deps in DEPENDENCIES and NOTICE.
One question to conclude: referring to Nick's comments at [4], do you
think we should have anything else in NOTICE for all packages? In
other words, which of the licenses mentioned in the various
DEPENDENCIES files actually require a NOTICE?
If you guys are happy with the packages, I'll close CMIS-224 and we
can move on with the release.
Hope this helps!
Gab
[1] https://issues.apache.org/jira/browse/CMIS-247
[2] https://repository.apache.org/content/repositories/snapshots/org/apache/chemistry/
[3] http://people.apache.org/~gabriele/chemistry/opencmis/0.1.0-incubating-SNAPSHOT/release/
[4] http://www.mail-archive.com/general@incubator.apache.org/msg24953.html
Begin forwarded message:
> From: "Gabriele Columbro (JIRA)" <ji...@apache.org>
> Date: September 1, 2010 4:15:53 PM GMT+02:00
> To: gabriele@apache.org
> Subject: [jira] Commented: (CMIS-224) Improve legal/standard aspects
> of the release process / packaging
>
>
> [ https://issues.apache.org/jira/browse/CMIS-224?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905030
> #action_12905030 ]
>
> Gabriele Columbro commented on CMIS-224:
> ----------------------------------------
>
> r 991541 should resolve issues at http://www.mail-archive.com/general@incubator.apache.org/msg24955.html
> :
>
> Now:
> 1. all JARs and WARs have now information in META-INF
> 2. supplemental models are augmented...hopefully everything is in (i
> did not check every single JAR, any volounteer?)
> 3. for the commodity packages (zip/tar.gz), as they are mere
> aggregation of project JARs/WARs, I created dummy DEPENDENCIES/
> NOTICE files which instruct the user to look in the META-INF of the
> opencmis J2EE artifact
>
>
> Sample commodity packages can be found at:
>
> http://people.apache.org/~gabriele/chemistry/opencmis/0.1.0-incubating-SNAPSHOT/release/
>
> If the list (and especially the menthors) give us green light with
> these packages, I'll close the issue and start the release process.
>
>> Improve legal/standard aspects of the release process / packaging
>> -----------------------------------------------------------------
>>
>> Key: CMIS-224
>> URL: https://issues.apache.org/jira/browse/CMIS-224
>> Project: Chemistry
>> Issue Type: Task
>> Components: build&release
>> Affects Versions: 0.1.0-incubating
>> Reporter: Gabriele Columbro
>> Assignee: Gabriele Columbro
>> Priority: Minor
>> Fix For: 0.2.0-incubating
>>
>> Original Estimate: 4h
>> Remaining Estimate: 4h
>>
>> As per ML thread http://mail-archives.apache.org/mod_mbox/incubator-chemistry-dev/201006.mbox/%3C20100625095132.3C4B.60BA733C@jeremias-maerki.ch%3E
>> ,
>> there are some legal aspects of the release process which need QA
>> before be fully compliant with the ASF legal policies.
>> Specifically:
>> - Publish a list of dependencies with their applicable license.
>> Especially required for "category b" type of deps (http://www.apache.org/legal/resolved.html#category-b
>> ) , like JAX-WS RI, mimepull and saaj
>> - add LICENSE and NOTICE also in WARs (and not only in JARs)
>> - cleanup SVN EOL
>> - add missing license headers
>
> --
> This message is automatically generated by JIRA.
> -
> You can reply to this email to add a comment to the issue online.
>
--
Gabriele Columbro
Alfresco Software, Ltd.
http://www.mindthegab.com
http://twitter.com/mindthegabz
" Keyboard not found. Press F1 to continue. "
RE: Validation of release packages (was: Fwd: [jira] Commented:
(CMIS-224) Improve legal/standard aspects of the release process / packaging)
Posted by "Klevenz, Stephan" <st...@sap.com>.
Hi Gab,
In meantime I could run a local release build without having problems. I have checked META-INF info of the local JARs/WARs and the info files containing references. I did not find issues.
To your question about the NOTICE I do not have really an opinion.
Finally I would rate the RC with
+1
Regards,
Stephan
-----Original Message-----
From: Gabriele Columbro [mailto:gabriele@apache.org]
Sent: Mittwoch, 1. September 2010 17:32
To: chemistry-dev@incubator.apache.org
Subject: Validation of release packages (was: Fwd: [jira] Commented: (CMIS-224) Improve legal/standard aspects of the release process / packaging)
Hey guys,
finally today I could dedicate myself to improve the legal /
distribution aspects of the release. As per the issue below, AFAIU the
packaging issues blocking 0.1.0-rc1 should have been covered.
So, before engaging the release process (also as we're waiting on
[1]), I'd like to ask you guys to have a look the commodity (/dist)
packages I deployed at [1], and help me confirm or deny that:
1. All JARs/WARs have correct info in META-INF (latest SNAPSHOT at [2]
or you can build from trunk)
2. All commodity packages I uploaded at [3] have correct LICENSE and
DISCLAIMER info, and DEPENDENCIES and NOTICE that instead refer to
contained WAR/JAR specific DEPENDENCIES and NOTICE. Docs has not DEPS
and NOTICE, as there are not shipped deps.
Minor glitch, not blocker I believe: the source-release package, being
generated by ASF POM inherited settings is listing superPOM project
deps in DEPENDENCIES and NOTICE.
One question to conclude: referring to Nick's comments at [4], do you
think we should have anything else in NOTICE for all packages? In
other words, which of the licenses mentioned in the various
DEPENDENCIES files actually require a NOTICE?
If you guys are happy with the packages, I'll close CMIS-224 and we
can move on with the release.
Hope this helps!
Gab
[1] https://issues.apache.org/jira/browse/CMIS-247
[2] https://repository.apache.org/content/repositories/snapshots/org/apache/chemistry/
[3] http://people.apache.org/~gabriele/chemistry/opencmis/0.1.0-incubating-SNAPSHOT/release/
[4] http://www.mail-archive.com/general@incubator.apache.org/msg24953.html
Begin forwarded message:
> From: "Gabriele Columbro (JIRA)" <ji...@apache.org>
> Date: September 1, 2010 4:15:53 PM GMT+02:00
> To: gabriele@apache.org
> Subject: [jira] Commented: (CMIS-224) Improve legal/standard aspects
> of the release process / packaging
>
>
> [ https://issues.apache.org/jira/browse/CMIS-224?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12905030
> #action_12905030 ]
>
> Gabriele Columbro commented on CMIS-224:
> ----------------------------------------
>
> r 991541 should resolve issues at http://www.mail-archive.com/general@incubator.apache.org/msg24955.html
> :
>
> Now:
> 1. all JARs and WARs have now information in META-INF
> 2. supplemental models are augmented...hopefully everything is in (i
> did not check every single JAR, any volounteer?)
> 3. for the commodity packages (zip/tar.gz), as they are mere
> aggregation of project JARs/WARs, I created dummy DEPENDENCIES/
> NOTICE files which instruct the user to look in the META-INF of the
> opencmis J2EE artifact
>
>
> Sample commodity packages can be found at:
>
> http://people.apache.org/~gabriele/chemistry/opencmis/0.1.0-incubating-SNAPSHOT/release/
>
> If the list (and especially the menthors) give us green light with
> these packages, I'll close the issue and start the release process.
>
>> Improve legal/standard aspects of the release process / packaging
>> -----------------------------------------------------------------
>>
>> Key: CMIS-224
>> URL: https://issues.apache.org/jira/browse/CMIS-224
>> Project: Chemistry
>> Issue Type: Task
>> Components: build&release
>> Affects Versions: 0.1.0-incubating
>> Reporter: Gabriele Columbro
>> Assignee: Gabriele Columbro
>> Priority: Minor
>> Fix For: 0.2.0-incubating
>>
>> Original Estimate: 4h
>> Remaining Estimate: 4h
>>
>> As per ML thread http://mail-archives.apache.org/mod_mbox/incubator-chemistry-dev/201006.mbox/%3C20100625095132.3C4B.60BA733C@jeremias-maerki.ch%3E
>> ,
>> there are some legal aspects of the release process which need QA
>> before be fully compliant with the ASF legal policies.
>> Specifically:
>> - Publish a list of dependencies with their applicable license.
>> Especially required for "category b" type of deps (http://www.apache.org/legal/resolved.html#category-b
>> ) , like JAX-WS RI, mimepull and saaj
>> - add LICENSE and NOTICE also in WARs (and not only in JARs)
>> - cleanup SVN EOL
>> - add missing license headers
>
> --
> This message is automatically generated by JIRA.
> -
> You can reply to this email to add a comment to the issue online.
>
--
Gabriele Columbro
Alfresco Software, Ltd.
http://www.mindthegab.com
http://twitter.com/mindthegabz
" Keyboard not found. Press F1 to continue. "
Re: Validation of release packages
Posted by Gabriele Columbro <co...@gmail.com>.
Hey Jukka,
On Sep 10, 2010, at 2:37 PM, Jukka Zitting wrote:
> Hi,
>
> On Fri, Sep 10, 2010 at 2:07 PM, Florian Müller
> <fl...@alfresco.com> wrote:
>> That is all really confusing. [1] states for Category B licences:
>> [...]
>> [1] http://www.apache.org/legal/3party.html
>
> That's an outdated draft document (see the status disclaimer at the
> beginning of the page). The official policy is now in
> http://www.apache.org/legal/resolved.html.
Thanks a lot for this clarification. I'm reading thoroughly that page
and adjust the building accordingly.
Will proceed closing https://issues.apache.org/jira/browse/CMIS-224
with release candidate after that.
Thanks again,
Gab
>
> BR,
>
> Jukka Zitting
--
Eng. Gabriele Columbro
Alfresco Software, Ltd.
M: +31 (0)627 565 103
P: +39 320 161 28 46
D: +44 (0)1628 876 654
Skype: gabrielecolumbro
Blog: http://www.mindthegab.com
Twitter: http://twitter.com/mindthegabz
Re: Validation of release packages
Posted by Jukka Zitting <ju...@gmail.com>.
Hi,
On Fri, Sep 10, 2010 at 3:12 PM, Gabriele Columbro <co...@gmail.com> wrote:
> after reading thoroughly http://www.apache.org/legal/resolved.html I can say
> that:
>
> - our DEPENDENCIES file already lists all dependencies per project/commodity
> package with the appropriate license and project URL, as stated by
> http://www.apache.org/legal/resolved.html#category-b
> - this is handled automatically by Maven, so I reckon there's no need for
> additional info in NOTICE (on any other README notice)
> - maybe it's worth (for the deps which have a dual CDDL/GPL license)
> explicitly mentioning that we choose CDDL, as per
> http://www.apache.org/legal/resolved.html#mutually-exclusive
>
> WDYT?
I guess that's good enough, though I'd personally prefer to see a
README entry that at least points people to these existing resources.
It's a fairly standard practice to have a README that serves as the
first entry point to a project.
See the patch I attached to CMIS-224 for a simple draft of such a README.
BR,
Jukka Zitting
Re: Validation of release packages
Posted by Gabriele Columbro <co...@gmail.com>.
Hey Jukka,
after reading thoroughly http://www.apache.org/legal/resolved.html I
can say that:
- our DEPENDENCIES file already lists all dependencies per project/
commodity package with the appropriate license and project URL, as
stated by http://www.apache.org/legal/resolved.html#category-b
- this is handled automatically by Maven, so I reckon there's no need
for additional info in NOTICE (on any other README notice)
- maybe it's worth (for the deps which have a dual CDDL/GPL license)
explicitly mentioning that we choose CDDL, as per http://www.apache.org/legal/resolved.html#mutually-exclusive
WDYT?
Thanks for the support,
Gab
On Sep 10, 2010, at 2:37 PM, Jukka Zitting wrote:
> Hi,
>
> On Fri, Sep 10, 2010 at 2:07 PM, Florian Müller
> <fl...@alfresco.com> wrote:
>> That is all really confusing. [1] states for Category B licences:
>> [...]
>> [1] http://www.apache.org/legal/3party.html
>
> That's an outdated draft document (see the status disclaimer at the
> beginning of the page). The official policy is now in
> http://www.apache.org/legal/resolved.html.
>
> BR,
>
> Jukka Zitting
--
Eng. Gabriele Columbro
Alfresco Software, Ltd.
M: +31 (0)627 565 103
P: +39 320 161 28 46
D: +44 (0)1628 876 654
Skype: gabrielecolumbro
Blog: http://www.mindthegab.com
Twitter: http://twitter.com/mindthegabz
Re: Validation of release packages
Posted by Jukka Zitting <ju...@gmail.com>.
Hi,
On Fri, Sep 10, 2010 at 2:07 PM, Florian Müller
<fl...@alfresco.com> wrote:
> That is all really confusing. [1] states for Category B licences:
> [...]
> [1] http://www.apache.org/legal/3party.html
That's an outdated draft document (see the status disclaimer at the
beginning of the page). The official policy is now in
http://www.apache.org/legal/resolved.html.
BR,
Jukka Zitting
Re: Validation of release packages
Posted by Florian Müller <fl...@alfresco.com>.
Hi Jukka,
That is all really confusing. [1] states for Category B licences:
"Although the source must not be included in Apache products, the NOTICE
file, which is required to be included in each ASF distribution, must
point to the source form of the included binary (more on that in the
forthcoming "Receiving and Releasing Contributions" document)."
That's what we are trying to do: point to the source code of all CDDL
dependencies in the NOTICE file.
Is that not necessary?
- Florian
[1] http://www.apache.org/legal/3party.html
On 10/09/2010 12:53, Jukka Zitting wrote:
> Hi,
>
> On Fri, Sep 10, 2010 at 1:15 PM, Gabriele Columbro<ga...@apache.org> wrote:
>> quick update on this one: as Florian mentioned, working on the assumption
>> the Category B licenses require a pointer to source code in NOTICE (apart
>> from the mention in DEPENDENCIES), I have a working solution which allows
>> maven to produce the notice file in the proper way.
>
> The NOTICE file is for things like clause 3 in AL version 1.1 [1] or
> the advertising clause in the original BSD license. Think of stuff
> that the license mandates you to include in an "About" box in a GUI.
>
> AFAIUI the CDDL does not contain any such clauses, so they IMHO
> shouldn't be mentioned in the NOTICE file. See also LEGAL-59 [1] for
> related discussion about the BSD license.
>
> The "appropriately labeled" note in [3] is probably best covered by
> mentioning the weak copyleft dependencies in the README file. In
> practice I've found that automatically tracking such information is
> pretty complicated or even impossible, so the best approach is
> probably to manually maintain such a note in the README. Something
> like the following should be fine:
>
> "Weak Copyleft" dependencies
>
> Apache Chemistry depends on the following libraries with licenses that
> require reciprocal licensing when modified.
>
> * dependency<URL>
>
> See the LICENSE file for the full licensing details.
>
> [1] http://www.apache.org/licenses/LICENSE-1.1
> [2] https://issues.apache.org/jira/browse/LEGAL-59
> [3] http://www.apache.org/legal/resolved.html#category-b
>
> BR,
>
> Jukka Zitting
Re: Validation of release packages
Posted by Jukka Zitting <ju...@gmail.com>.
Hi,
On Fri, Sep 10, 2010 at 1:15 PM, Gabriele Columbro <ga...@apache.org> wrote:
> quick update on this one: as Florian mentioned, working on the assumption
> the Category B licenses require a pointer to source code in NOTICE (apart
> from the mention in DEPENDENCIES), I have a working solution which allows
> maven to produce the notice file in the proper way.
The NOTICE file is for things like clause 3 in AL version 1.1 [1] or
the advertising clause in the original BSD license. Think of stuff
that the license mandates you to include in an "About" box in a GUI.
AFAIUI the CDDL does not contain any such clauses, so they IMHO
shouldn't be mentioned in the NOTICE file. See also LEGAL-59 [1] for
related discussion about the BSD license.
The "appropriately labeled" note in [3] is probably best covered by
mentioning the weak copyleft dependencies in the README file. In
practice I've found that automatically tracking such information is
pretty complicated or even impossible, so the best approach is
probably to manually maintain such a note in the README. Something
like the following should be fine:
"Weak Copyleft" dependencies
Apache Chemistry depends on the following libraries with licenses that
require reciprocal licensing when modified.
* dependency <URL>
See the LICENSE file for the full licensing details.
[1] http://www.apache.org/licenses/LICENSE-1.1
[2] https://issues.apache.org/jira/browse/LEGAL-59
[3] http://www.apache.org/legal/resolved.html#category-b
BR,
Jukka Zitting
Re: Validation of release packages
Posted by Florian Müller <fl...@alfresco.com>.
You are right, we could (and probably should) be more intelligent in the
high level client even though the binding doesn't support it.
If the user has fetched the object and didn't exclude the
cmis:contentStreamFileName property we already have the filename in
memory. If the user filtered that property out, I think the filename
should remain null. Another getObject() call just for the filename is
too expensive.
- Florian
On 10/09/2010 14:43, Florent Guillaume wrote:
> Yes I meant that.
> Ok so don't hold the release then.
>
> But this model mismatch makes some of my high-level unit tests fail
> when run on the atompub bindings, whereas they pass with webservices
> and local bindings.
> I think PersistentDocumentImpl.getContentStream should probably return
> an intelligent content stream object that knows to fetch the stream
> filename if requested.
>
> Florent
>
> On Fri, Sep 10, 2010 at 3:39 PM, Florian Müller
> <fl...@alfresco.com> wrote:
>> Hi Florent,
>>
>> You mean that the OpenCMIS client doesn't return a filename in the
>> ContentStream object when using AtomPub?
>>
>> That is correct. There is no filename in that case.
>>
>>
>> - Florian
>>
>>
>> On 10/09/2010 14:34, Florent Guillaume wrote:
>>>
>>> Can you hold the code freeze until 4PM ? There's I think a bug in the
>>> AtomPub bindings that I'd like to fix or make sure it's not a bug
>>> (getting the filename of a returned content stream).
>>>
>>> Florent
>>>
>>> On Fri, Sep 10, 2010 at 2:26 PM, Florent Guillaume<fg...@nuxeo.com> wrote:
>>>>
>>>> I really hate depending on anything SNAPSHOT during a release.
>>>> Although of course you could give it a date-based version, just
>>>> creating a new maven plugin for that for the first OpenCMIS release
>>>> seems overkill. Can't we do things partially by hand for now?
>>>>
>>>> Anyway, ok for the code freeze at 3PM CET.
>>>>
>>>> Florent
>>>>
>>>> On Fri, Sep 10, 2010 at 1:15 PM, Gabriele Columbro<ga...@apache.org>
>>>> wrote:
>>>>>
>>>>> Hey guys,
>>>>> quick update on this one: as Florian mentioned, working on the
>>>>> assumption
>>>>> the Category B licenses require a pointer to source code in NOTICE
>>>>> (apart
>>>>> from the mention in DEPENDENCIES), I have a working solution which
>>>>> allows
>>>>> maven to produce the notice file in the proper way.
>>>>> Basically I'm using a custom version of the apache-jar-resource-bundle,
>>>>> which lists in NOTICE all the CDDL licensed packages (CDDL is the only
>>>>> Category B dependency we have).
>>>>>
>>>>> Provided that I will pick this us on the Maven Dev list for a possible
>>>>> contribution, a quick solution for now is to:
>>>>>
>>>>> - create a top level project (out of the release, at the same level of
>>>>> the
>>>>> tck [1]), called chemistry-jar-resource-bundle
>>>>> - add the custom NOTICE.vm file there and deploy a SNAPSHOT to
>>>>> repository.apache.org
>>>>> - depend on it by our build and use it in the
>>>>> maven-remote-resource-plugin
>>>>> config
>>>>>
>>>>> I'll perform this right away, unless you guys have some concern. I can
>>>>> later then proceed with the release (ideally I could call a code freeze,
>>>>> let's say, by 3PM CET ? )
>>>>>
>>>>> Let me know your thoughts,
>>>>> Gab
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> [1] http://svn.apache.org/repos/asf/incubator/chemistry/
>>>>>
>>>>>
>>>>>
>>>>> On Sep 9, 2010, at 3:17 PM, Florian Müller wrote:
>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> Gab and my interpretation of the Apache third-party rules [1] is that
>>>>>> all
>>>>>> dependencies with Category B licences have to be mentioned in the
>>>>>> NOTICE
>>>>>> files with a link to the source code.
>>>>>>
>>>>>> We have a bunch of CDDL dependencies. The names and links are already
>>>>>> in
>>>>>> the DEPENDENCIES files. We think copying the CDDL entries to NOTICE
>>>>>> files
>>>>>> should sufficient.
>>>>>>
>>>>>>
>>>>>> Any comments? Experts?
>>>>>>
>>>>>>
>>>>>> - Florian
>>>>>>
>>>>>> [1] http://www.apache.org/legal/3party.html
>>>>>>
>>>>>>
>>>>>>
>>>>>> On 08/09/2010 14:59, Nick Burch wrote:
>>>>>>>
>>>>>>> On Wed, 1 Sep 2010, Gabriele Columbro wrote:
>>>>>>>>
>>>>>>>> One question to conclude: referring to Nick's comments at [4], do you
>>>>>>>> think we should have anything else in NOTICE for all packages? In
>>>>>>>> other words, which of the licenses mentioned in the various
>>>>>>>> DEPENDENCIES files actually require a NOTICE?
>>>>>>>
>>>>>>> The NOTICE file should contain as little as possible. Everything else
>>>>>>> should go in DEPENDENCIES, a readme, the website etc
>>>>>>>
>>>>>>> The reason for this is that every downstream user has to include
>>>>>>> everything in our NOTICE file in their own notices. So, we want it to
>>>>>>> include all the required notices of our upstream dependencies, along
>>>>>>> with our own notice. However, we don't want to full the NOTICE file up
>>>>>>> with things that aren't required, as we don't want to burden our
>>>>>>> users!
>>>>>>>
>>>>>>> To review the NOTICE files, take a look at what's in there, and
>>>>>>> compare
>>>>>>> that to the dependencies list (which is hopefully correct, since maven
>>>>>>> generated it!). The notice file should have our notice in it, and
>>>>>>> after
>>>>>>> that any dependency ones. If a dependency is under a license that
>>>>>>> requires a notice, it should be there. (If not, it shouldn't. The main
>>>>>>> apache 3rd party licenses page may give some help on this)
>>>>>>>
>>>>>>> Does this make sense to everyone?
>>>>>>>
>>>>>>> Nick
>>>>>>
>>>>>
>>>>> --
>>>>>
>>>>> Gabriele Columbro
>>>>> Alfresco Software, Ltd.
>>>>>
>>>>> http://www.mindthegab.com
>>>>> http://twitter.com/mindthegabz
>>>>>
>>>>> " Keyboard not found. Press F1 to continue."
>>>>>
>>>>>
>>>>>
>>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> Florent Guillaume, Director of R&D, Nuxeo
>>>> Open Source, Java EE based, Enterprise Content Management (ECM)
>>>> http://www.nuxeo.com http://www.nuxeo.org +33 1 40 33 79 87
>>>>
>>>
>>>
>>>
>>
>>
>
>
>
Re: Validation of release packages
Posted by Florent Guillaume <fg...@nuxeo.com>.
Yes I meant that.
Ok so don't hold the release then.
But this model mismatch makes some of my high-level unit tests fail
when run on the atompub bindings, whereas they pass with webservices
and local bindings.
I think PersistentDocumentImpl.getContentStream should probably return
an intelligent content stream object that knows to fetch the stream
filename if requested.
Florent
On Fri, Sep 10, 2010 at 3:39 PM, Florian Müller
<fl...@alfresco.com> wrote:
> Hi Florent,
>
> You mean that the OpenCMIS client doesn't return a filename in the
> ContentStream object when using AtomPub?
>
> That is correct. There is no filename in that case.
>
>
> - Florian
>
>
> On 10/09/2010 14:34, Florent Guillaume wrote:
>>
>> Can you hold the code freeze until 4PM ? There's I think a bug in the
>> AtomPub bindings that I'd like to fix or make sure it's not a bug
>> (getting the filename of a returned content stream).
>>
>> Florent
>>
>> On Fri, Sep 10, 2010 at 2:26 PM, Florent Guillaume<fg...@nuxeo.com> wrote:
>>>
>>> I really hate depending on anything SNAPSHOT during a release.
>>> Although of course you could give it a date-based version, just
>>> creating a new maven plugin for that for the first OpenCMIS release
>>> seems overkill. Can't we do things partially by hand for now?
>>>
>>> Anyway, ok for the code freeze at 3PM CET.
>>>
>>> Florent
>>>
>>> On Fri, Sep 10, 2010 at 1:15 PM, Gabriele Columbro<ga...@apache.org>
>>> wrote:
>>>>
>>>> Hey guys,
>>>> quick update on this one: as Florian mentioned, working on the
>>>> assumption
>>>> the Category B licenses require a pointer to source code in NOTICE
>>>> (apart
>>>> from the mention in DEPENDENCIES), I have a working solution which
>>>> allows
>>>> maven to produce the notice file in the proper way.
>>>> Basically I'm using a custom version of the apache-jar-resource-bundle,
>>>> which lists in NOTICE all the CDDL licensed packages (CDDL is the only
>>>> Category B dependency we have).
>>>>
>>>> Provided that I will pick this us on the Maven Dev list for a possible
>>>> contribution, a quick solution for now is to:
>>>>
>>>> - create a top level project (out of the release, at the same level of
>>>> the
>>>> tck [1]), called chemistry-jar-resource-bundle
>>>> - add the custom NOTICE.vm file there and deploy a SNAPSHOT to
>>>> repository.apache.org
>>>> - depend on it by our build and use it in the
>>>> maven-remote-resource-plugin
>>>> config
>>>>
>>>> I'll perform this right away, unless you guys have some concern. I can
>>>> later then proceed with the release (ideally I could call a code freeze,
>>>> let's say, by 3PM CET ? )
>>>>
>>>> Let me know your thoughts,
>>>> Gab
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> [1] http://svn.apache.org/repos/asf/incubator/chemistry/
>>>>
>>>>
>>>>
>>>> On Sep 9, 2010, at 3:17 PM, Florian Müller wrote:
>>>>
>>>>> Hi,
>>>>>
>>>>> Gab and my interpretation of the Apache third-party rules [1] is that
>>>>> all
>>>>> dependencies with Category B licences have to be mentioned in the
>>>>> NOTICE
>>>>> files with a link to the source code.
>>>>>
>>>>> We have a bunch of CDDL dependencies. The names and links are already
>>>>> in
>>>>> the DEPENDENCIES files. We think copying the CDDL entries to NOTICE
>>>>> files
>>>>> should sufficient.
>>>>>
>>>>>
>>>>> Any comments? Experts?
>>>>>
>>>>>
>>>>> - Florian
>>>>>
>>>>> [1] http://www.apache.org/legal/3party.html
>>>>>
>>>>>
>>>>>
>>>>> On 08/09/2010 14:59, Nick Burch wrote:
>>>>>>
>>>>>> On Wed, 1 Sep 2010, Gabriele Columbro wrote:
>>>>>>>
>>>>>>> One question to conclude: referring to Nick's comments at [4], do you
>>>>>>> think we should have anything else in NOTICE for all packages? In
>>>>>>> other words, which of the licenses mentioned in the various
>>>>>>> DEPENDENCIES files actually require a NOTICE?
>>>>>>
>>>>>> The NOTICE file should contain as little as possible. Everything else
>>>>>> should go in DEPENDENCIES, a readme, the website etc
>>>>>>
>>>>>> The reason for this is that every downstream user has to include
>>>>>> everything in our NOTICE file in their own notices. So, we want it to
>>>>>> include all the required notices of our upstream dependencies, along
>>>>>> with our own notice. However, we don't want to full the NOTICE file up
>>>>>> with things that aren't required, as we don't want to burden our
>>>>>> users!
>>>>>>
>>>>>> To review the NOTICE files, take a look at what's in there, and
>>>>>> compare
>>>>>> that to the dependencies list (which is hopefully correct, since maven
>>>>>> generated it!). The notice file should have our notice in it, and
>>>>>> after
>>>>>> that any dependency ones. If a dependency is under a license that
>>>>>> requires a notice, it should be there. (If not, it shouldn't. The main
>>>>>> apache 3rd party licenses page may give some help on this)
>>>>>>
>>>>>> Does this make sense to everyone?
>>>>>>
>>>>>> Nick
>>>>>
>>>>
>>>> --
>>>>
>>>> Gabriele Columbro
>>>> Alfresco Software, Ltd.
>>>>
>>>> http://www.mindthegab.com
>>>> http://twitter.com/mindthegabz
>>>>
>>>> " Keyboard not found. Press F1 to continue."
>>>>
>>>>
>>>>
>>>>
>>>
>>>
>>>
>>> --
>>> Florent Guillaume, Director of R&D, Nuxeo
>>> Open Source, Java EE based, Enterprise Content Management (ECM)
>>> http://www.nuxeo.com http://www.nuxeo.org +33 1 40 33 79 87
>>>
>>
>>
>>
>
>
--
Florent Guillaume, Director of R&D, Nuxeo
Open Source, Java EE based, Enterprise Content Management (ECM)
http://www.nuxeo.com http://www.nuxeo.org +33 1 40 33 79 87
Re: Validation of release packages
Posted by Florian Müller <fl...@alfresco.com>.
Hi Florent,
You mean that the OpenCMIS client doesn't return a filename in the
ContentStream object when using AtomPub?
That is correct. There is no filename in that case.
- Florian
On 10/09/2010 14:34, Florent Guillaume wrote:
> Can you hold the code freeze until 4PM ? There's I think a bug in the
> AtomPub bindings that I'd like to fix or make sure it's not a bug
> (getting the filename of a returned content stream).
>
> Florent
>
> On Fri, Sep 10, 2010 at 2:26 PM, Florent Guillaume<fg...@nuxeo.com> wrote:
>> I really hate depending on anything SNAPSHOT during a release.
>> Although of course you could give it a date-based version, just
>> creating a new maven plugin for that for the first OpenCMIS release
>> seems overkill. Can't we do things partially by hand for now?
>>
>> Anyway, ok for the code freeze at 3PM CET.
>>
>> Florent
>>
>> On Fri, Sep 10, 2010 at 1:15 PM, Gabriele Columbro<ga...@apache.org> wrote:
>>> Hey guys,
>>> quick update on this one: as Florian mentioned, working on the assumption
>>> the Category B licenses require a pointer to source code in NOTICE (apart
>>> from the mention in DEPENDENCIES), I have a working solution which allows
>>> maven to produce the notice file in the proper way.
>>> Basically I'm using a custom version of the apache-jar-resource-bundle,
>>> which lists in NOTICE all the CDDL licensed packages (CDDL is the only
>>> Category B dependency we have).
>>>
>>> Provided that I will pick this us on the Maven Dev list for a possible
>>> contribution, a quick solution for now is to:
>>>
>>> - create a top level project (out of the release, at the same level of the
>>> tck [1]), called chemistry-jar-resource-bundle
>>> - add the custom NOTICE.vm file there and deploy a SNAPSHOT to
>>> repository.apache.org
>>> - depend on it by our build and use it in the maven-remote-resource-plugin
>>> config
>>>
>>> I'll perform this right away, unless you guys have some concern. I can
>>> later then proceed with the release (ideally I could call a code freeze,
>>> let's say, by 3PM CET ? )
>>>
>>> Let me know your thoughts,
>>> Gab
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>> [1] http://svn.apache.org/repos/asf/incubator/chemistry/
>>>
>>>
>>>
>>> On Sep 9, 2010, at 3:17 PM, Florian Müller wrote:
>>>
>>>> Hi,
>>>>
>>>> Gab and my interpretation of the Apache third-party rules [1] is that all
>>>> dependencies with Category B licences have to be mentioned in the NOTICE
>>>> files with a link to the source code.
>>>>
>>>> We have a bunch of CDDL dependencies. The names and links are already in
>>>> the DEPENDENCIES files. We think copying the CDDL entries to NOTICE files
>>>> should sufficient.
>>>>
>>>>
>>>> Any comments? Experts?
>>>>
>>>>
>>>> - Florian
>>>>
>>>> [1] http://www.apache.org/legal/3party.html
>>>>
>>>>
>>>>
>>>> On 08/09/2010 14:59, Nick Burch wrote:
>>>>>
>>>>> On Wed, 1 Sep 2010, Gabriele Columbro wrote:
>>>>>>
>>>>>> One question to conclude: referring to Nick's comments at [4], do you
>>>>>> think we should have anything else in NOTICE for all packages? In
>>>>>> other words, which of the licenses mentioned in the various
>>>>>> DEPENDENCIES files actually require a NOTICE?
>>>>>
>>>>> The NOTICE file should contain as little as possible. Everything else
>>>>> should go in DEPENDENCIES, a readme, the website etc
>>>>>
>>>>> The reason for this is that every downstream user has to include
>>>>> everything in our NOTICE file in their own notices. So, we want it to
>>>>> include all the required notices of our upstream dependencies, along
>>>>> with our own notice. However, we don't want to full the NOTICE file up
>>>>> with things that aren't required, as we don't want to burden our users!
>>>>>
>>>>> To review the NOTICE files, take a look at what's in there, and compare
>>>>> that to the dependencies list (which is hopefully correct, since maven
>>>>> generated it!). The notice file should have our notice in it, and after
>>>>> that any dependency ones. If a dependency is under a license that
>>>>> requires a notice, it should be there. (If not, it shouldn't. The main
>>>>> apache 3rd party licenses page may give some help on this)
>>>>>
>>>>> Does this make sense to everyone?
>>>>>
>>>>> Nick
>>>>
>>>
>>> --
>>>
>>> Gabriele Columbro
>>> Alfresco Software, Ltd.
>>>
>>> http://www.mindthegab.com
>>> http://twitter.com/mindthegabz
>>>
>>> " Keyboard not found. Press F1 to continue."
>>>
>>>
>>>
>>>
>>
>>
>>
>> --
>> Florent Guillaume, Director of R&D, Nuxeo
>> Open Source, Java EE based, Enterprise Content Management (ECM)
>> http://www.nuxeo.com http://www.nuxeo.org +33 1 40 33 79 87
>>
>
>
>
Re: Validation of release packages
Posted by Florent Guillaume <fg...@nuxeo.com>.
Can you hold the code freeze until 4PM ? There's I think a bug in the
AtomPub bindings that I'd like to fix or make sure it's not a bug
(getting the filename of a returned content stream).
Florent
On Fri, Sep 10, 2010 at 2:26 PM, Florent Guillaume <fg...@nuxeo.com> wrote:
> I really hate depending on anything SNAPSHOT during a release.
> Although of course you could give it a date-based version, just
> creating a new maven plugin for that for the first OpenCMIS release
> seems overkill. Can't we do things partially by hand for now?
>
> Anyway, ok for the code freeze at 3PM CET.
>
> Florent
>
> On Fri, Sep 10, 2010 at 1:15 PM, Gabriele Columbro <ga...@apache.org> wrote:
>> Hey guys,
>> quick update on this one: as Florian mentioned, working on the assumption
>> the Category B licenses require a pointer to source code in NOTICE (apart
>> from the mention in DEPENDENCIES), I have a working solution which allows
>> maven to produce the notice file in the proper way.
>> Basically I'm using a custom version of the apache-jar-resource-bundle,
>> which lists in NOTICE all the CDDL licensed packages (CDDL is the only
>> Category B dependency we have).
>>
>> Provided that I will pick this us on the Maven Dev list for a possible
>> contribution, a quick solution for now is to:
>>
>> - create a top level project (out of the release, at the same level of the
>> tck [1]), called chemistry-jar-resource-bundle
>> - add the custom NOTICE.vm file there and deploy a SNAPSHOT to
>> repository.apache.org
>> - depend on it by our build and use it in the maven-remote-resource-plugin
>> config
>>
>> I'll perform this right away, unless you guys have some concern. I can
>> later then proceed with the release (ideally I could call a code freeze,
>> let's say, by 3PM CET ? )
>>
>> Let me know your thoughts,
>> Gab
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> [1] http://svn.apache.org/repos/asf/incubator/chemistry/
>>
>>
>>
>> On Sep 9, 2010, at 3:17 PM, Florian Müller wrote:
>>
>>> Hi,
>>>
>>> Gab and my interpretation of the Apache third-party rules [1] is that all
>>> dependencies with Category B licences have to be mentioned in the NOTICE
>>> files with a link to the source code.
>>>
>>> We have a bunch of CDDL dependencies. The names and links are already in
>>> the DEPENDENCIES files. We think copying the CDDL entries to NOTICE files
>>> should sufficient.
>>>
>>>
>>> Any comments? Experts?
>>>
>>>
>>> - Florian
>>>
>>> [1] http://www.apache.org/legal/3party.html
>>>
>>>
>>>
>>> On 08/09/2010 14:59, Nick Burch wrote:
>>>>
>>>> On Wed, 1 Sep 2010, Gabriele Columbro wrote:
>>>>>
>>>>> One question to conclude: referring to Nick's comments at [4], do you
>>>>> think we should have anything else in NOTICE for all packages? In
>>>>> other words, which of the licenses mentioned in the various
>>>>> DEPENDENCIES files actually require a NOTICE?
>>>>
>>>> The NOTICE file should contain as little as possible. Everything else
>>>> should go in DEPENDENCIES, a readme, the website etc
>>>>
>>>> The reason for this is that every downstream user has to include
>>>> everything in our NOTICE file in their own notices. So, we want it to
>>>> include all the required notices of our upstream dependencies, along
>>>> with our own notice. However, we don't want to full the NOTICE file up
>>>> with things that aren't required, as we don't want to burden our users!
>>>>
>>>> To review the NOTICE files, take a look at what's in there, and compare
>>>> that to the dependencies list (which is hopefully correct, since maven
>>>> generated it!). The notice file should have our notice in it, and after
>>>> that any dependency ones. If a dependency is under a license that
>>>> requires a notice, it should be there. (If not, it shouldn't. The main
>>>> apache 3rd party licenses page may give some help on this)
>>>>
>>>> Does this make sense to everyone?
>>>>
>>>> Nick
>>>
>>
>> --
>>
>> Gabriele Columbro
>> Alfresco Software, Ltd.
>>
>> http://www.mindthegab.com
>> http://twitter.com/mindthegabz
>>
>> " Keyboard not found. Press F1 to continue. "
>>
>>
>>
>>
>
>
>
> --
> Florent Guillaume, Director of R&D, Nuxeo
> Open Source, Java EE based, Enterprise Content Management (ECM)
> http://www.nuxeo.com http://www.nuxeo.org +33 1 40 33 79 87
>
--
Florent Guillaume, Director of R&D, Nuxeo
Open Source, Java EE based, Enterprise Content Management (ECM)
http://www.nuxeo.com http://www.nuxeo.org +33 1 40 33 79 87
Re: Validation of release packages
Posted by Gabriele Columbro <co...@gmail.com>.
Hey Florent,
thanks for the comment. Couple of clarifications though:
On Sep 10, 2010, at 2:26 PM, Florent Guillaume wrote:
> I really hate depending on anything SNAPSHOT during a release.
> Although of course you could give it a date-based version, just
> creating a new maven plugin for that for the first OpenCMIS release
> seems overkill. Can't we do things partially by hand for now?
1. It's not *really* a Maven dependency (otherwise the maven-release-
plugin won't pass): it's a reference to a bundle in the maven-remote-
resources-plugin. I don't like it either but seems cleaner than
handling things manually.
2. It's actually only one custom velocity file (NOTICE.vm) in one
otherwise empty JAR. I don't customize the plugin, just configure it
in the POM to use a different bundle .
3. It was already working :)
All in all seemed the proper way to do it, but (reading Jukka's last
note) seems the add-ons to NOTICE for CDDL are *not* needed (will
close http://issues.apache.org/jira/browse/CMIS-224)
I'm doing the last double check using http://www.apache.org/legal/resolved.html
as a reference and will proceed with codefreeze/release procedure.
Thanks,
Gab
>
> Anyway, ok for the code freeze at 3PM CET.
>
> Florent
>
> On Fri, Sep 10, 2010 at 1:15 PM, Gabriele Columbro <gabriele@apache.org
> > wrote:
>> Hey guys,
>> quick update on this one: as Florian mentioned, working on the
>> assumption
>> the Category B licenses require a pointer to source code in NOTICE
>> (apart
>> from the mention in DEPENDENCIES), I have a working solution which
>> allows
>> maven to produce the notice file in the proper way.
>> Basically I'm using a custom version of the apache-jar-resource-
>> bundle,
>> which lists in NOTICE all the CDDL licensed packages (CDDL is the
>> only
>> Category B dependency we have).
>>
>> Provided that I will pick this us on the Maven Dev list for a
>> possible
>> contribution, a quick solution for now is to:
>>
>> - create a top level project (out of the release, at the same level
>> of the
>> tck [1]), called chemistry-jar-resource-bundle
>> - add the custom NOTICE.vm file there and deploy a SNAPSHOT to
>> repository.apache.org
>> - depend on it by our build and use it in the maven-remote-resource-
>> plugin
>> config
>>
>> I'll perform this right away, unless you guys have some concern. I
>> can
>> later then proceed with the release (ideally I could call a code
>> freeze,
>> let's say, by 3PM CET ? )
>>
>> Let me know your thoughts,
>> Gab
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> [1] http://svn.apache.org/repos/asf/incubator/chemistry/
>>
>>
>>
>> On Sep 9, 2010, at 3:17 PM, Florian Müller wrote:
>>
>>> Hi,
>>>
>>> Gab and my interpretation of the Apache third-party rules [1] is
>>> that all
>>> dependencies with Category B licences have to be mentioned in the
>>> NOTICE
>>> files with a link to the source code.
>>>
>>> We have a bunch of CDDL dependencies. The names and links are
>>> already in
>>> the DEPENDENCIES files. We think copying the CDDL entries to
>>> NOTICE files
>>> should sufficient.
>>>
>>>
>>> Any comments? Experts?
>>>
>>>
>>> - Florian
>>>
>>> [1] http://www.apache.org/legal/3party.html
>>>
>>>
>>>
>>> On 08/09/2010 14:59, Nick Burch wrote:
>>>>
>>>> On Wed, 1 Sep 2010, Gabriele Columbro wrote:
>>>>>
>>>>> One question to conclude: referring to Nick's comments at [4],
>>>>> do you
>>>>> think we should have anything else in NOTICE for all packages? In
>>>>> other words, which of the licenses mentioned in the various
>>>>> DEPENDENCIES files actually require a NOTICE?
>>>>
>>>> The NOTICE file should contain as little as possible. Everything
>>>> else
>>>> should go in DEPENDENCIES, a readme, the website etc
>>>>
>>>> The reason for this is that every downstream user has to include
>>>> everything in our NOTICE file in their own notices. So, we want
>>>> it to
>>>> include all the required notices of our upstream dependencies,
>>>> along
>>>> with our own notice. However, we don't want to full the NOTICE
>>>> file up
>>>> with things that aren't required, as we don't want to burden our
>>>> users!
>>>>
>>>> To review the NOTICE files, take a look at what's in there, and
>>>> compare
>>>> that to the dependencies list (which is hopefully correct, since
>>>> maven
>>>> generated it!). The notice file should have our notice in it, and
>>>> after
>>>> that any dependency ones. If a dependency is under a license that
>>>> requires a notice, it should be there. (If not, it shouldn't. The
>>>> main
>>>> apache 3rd party licenses page may give some help on this)
>>>>
>>>> Does this make sense to everyone?
>>>>
>>>> Nick
>>>
>>
>> --
>>
>> Gabriele Columbro
>> Alfresco Software, Ltd.
>>
>> http://www.mindthegab.com
>> http://twitter.com/mindthegabz
>>
>> " Keyboard not found. Press F1 to continue. "
>>
>>
>>
>>
>
>
>
> --
> Florent Guillaume, Director of R&D, Nuxeo
> Open Source, Java EE based, Enterprise Content Management (ECM)
> http://www.nuxeo.com http://www.nuxeo.org +33 1 40 33 79 87
--
Eng. Gabriele Columbro
Alfresco Software, Ltd.
M: +31 (0)627 565 103
P: +39 320 161 28 46
D: +44 (0)1628 876 654
Skype: gabrielecolumbro
Blog: http://www.mindthegab.com
Twitter: http://twitter.com/mindthegabz
Re: Validation of release packages
Posted by Florent Guillaume <fg...@nuxeo.com>.
I really hate depending on anything SNAPSHOT during a release.
Although of course you could give it a date-based version, just
creating a new maven plugin for that for the first OpenCMIS release
seems overkill. Can't we do things partially by hand for now?
Anyway, ok for the code freeze at 3PM CET.
Florent
On Fri, Sep 10, 2010 at 1:15 PM, Gabriele Columbro <ga...@apache.org> wrote:
> Hey guys,
> quick update on this one: as Florian mentioned, working on the assumption
> the Category B licenses require a pointer to source code in NOTICE (apart
> from the mention in DEPENDENCIES), I have a working solution which allows
> maven to produce the notice file in the proper way.
> Basically I'm using a custom version of the apache-jar-resource-bundle,
> which lists in NOTICE all the CDDL licensed packages (CDDL is the only
> Category B dependency we have).
>
> Provided that I will pick this us on the Maven Dev list for a possible
> contribution, a quick solution for now is to:
>
> - create a top level project (out of the release, at the same level of the
> tck [1]), called chemistry-jar-resource-bundle
> - add the custom NOTICE.vm file there and deploy a SNAPSHOT to
> repository.apache.org
> - depend on it by our build and use it in the maven-remote-resource-plugin
> config
>
> I'll perform this right away, unless you guys have some concern. I can
> later then proceed with the release (ideally I could call a code freeze,
> let's say, by 3PM CET ? )
>
> Let me know your thoughts,
> Gab
>
>
>
>
>
>
>
>
>
> [1] http://svn.apache.org/repos/asf/incubator/chemistry/
>
>
>
> On Sep 9, 2010, at 3:17 PM, Florian Müller wrote:
>
>> Hi,
>>
>> Gab and my interpretation of the Apache third-party rules [1] is that all
>> dependencies with Category B licences have to be mentioned in the NOTICE
>> files with a link to the source code.
>>
>> We have a bunch of CDDL dependencies. The names and links are already in
>> the DEPENDENCIES files. We think copying the CDDL entries to NOTICE files
>> should sufficient.
>>
>>
>> Any comments? Experts?
>>
>>
>> - Florian
>>
>> [1] http://www.apache.org/legal/3party.html
>>
>>
>>
>> On 08/09/2010 14:59, Nick Burch wrote:
>>>
>>> On Wed, 1 Sep 2010, Gabriele Columbro wrote:
>>>>
>>>> One question to conclude: referring to Nick's comments at [4], do you
>>>> think we should have anything else in NOTICE for all packages? In
>>>> other words, which of the licenses mentioned in the various
>>>> DEPENDENCIES files actually require a NOTICE?
>>>
>>> The NOTICE file should contain as little as possible. Everything else
>>> should go in DEPENDENCIES, a readme, the website etc
>>>
>>> The reason for this is that every downstream user has to include
>>> everything in our NOTICE file in their own notices. So, we want it to
>>> include all the required notices of our upstream dependencies, along
>>> with our own notice. However, we don't want to full the NOTICE file up
>>> with things that aren't required, as we don't want to burden our users!
>>>
>>> To review the NOTICE files, take a look at what's in there, and compare
>>> that to the dependencies list (which is hopefully correct, since maven
>>> generated it!). The notice file should have our notice in it, and after
>>> that any dependency ones. If a dependency is under a license that
>>> requires a notice, it should be there. (If not, it shouldn't. The main
>>> apache 3rd party licenses page may give some help on this)
>>>
>>> Does this make sense to everyone?
>>>
>>> Nick
>>
>
> --
>
> Gabriele Columbro
> Alfresco Software, Ltd.
>
> http://www.mindthegab.com
> http://twitter.com/mindthegabz
>
> " Keyboard not found. Press F1 to continue. "
>
>
>
>
--
Florent Guillaume, Director of R&D, Nuxeo
Open Source, Java EE based, Enterprise Content Management (ECM)
http://www.nuxeo.com http://www.nuxeo.org +33 1 40 33 79 87
Re: Validation of release packages
Posted by Stephan Klevenz <st...@klaeff.de>.
+1
Am 10.09.2010 um 13:15 schrieb Gabriele Columbro:
> Hey guys,
> quick update on this one: as Florian mentioned, working on the assumption the Category B licenses require a pointer to source code in NOTICE (apart from the mention in DEPENDENCIES), I have a working solution which allows maven to produce the notice file in the proper way.
> Basically I'm using a custom version of the apache-jar-resource-bundle, which lists in NOTICE all the CDDL licensed packages (CDDL is the only Category B dependency we have).
>
> Provided that I will pick this us on the Maven Dev list for a possible contribution, a quick solution for now is to:
>
> - create a top level project (out of the release, at the same level of the tck [1]), called chemistry-jar-resource-bundle
> - add the custom NOTICE.vm file there and deploy a SNAPSHOT to repository.apache.org
> - depend on it by our build and use it in the maven-remote-resource-plugin config
>
> I'll perform this right away, unless you guys have some concern. I can later then proceed with the release (ideally I could call a code freeze, let's say, by 3PM CET ? )
>
> Let me know your thoughts,
> Gab
>
>
>
>
>
>
>
>
>
> [1] http://svn.apache.org/repos/asf/incubator/chemistry/
>
>
>
> On Sep 9, 2010, at 3:17 PM, Florian Müller wrote:
>
>> Hi,
>>
>> Gab and my interpretation of the Apache third-party rules [1] is that all dependencies with Category B licences have to be mentioned in the NOTICE files with a link to the source code.
>>
>> We have a bunch of CDDL dependencies. The names and links are already in the DEPENDENCIES files. We think copying the CDDL entries to NOTICE files should sufficient.
>>
>>
>> Any comments? Experts?
>>
>>
>> - Florian
>>
>> [1] http://www.apache.org/legal/3party.html
>>
>>
>>
>> On 08/09/2010 14:59, Nick Burch wrote:
>>> On Wed, 1 Sep 2010, Gabriele Columbro wrote:
>>>> One question to conclude: referring to Nick's comments at [4], do you
>>>> think we should have anything else in NOTICE for all packages? In
>>>> other words, which of the licenses mentioned in the various
>>>> DEPENDENCIES files actually require a NOTICE?
>>>
>>> The NOTICE file should contain as little as possible. Everything else
>>> should go in DEPENDENCIES, a readme, the website etc
>>>
>>> The reason for this is that every downstream user has to include
>>> everything in our NOTICE file in their own notices. So, we want it to
>>> include all the required notices of our upstream dependencies, along
>>> with our own notice. However, we don't want to full the NOTICE file up
>>> with things that aren't required, as we don't want to burden our users!
>>>
>>> To review the NOTICE files, take a look at what's in there, and compare
>>> that to the dependencies list (which is hopefully correct, since maven
>>> generated it!). The notice file should have our notice in it, and after
>>> that any dependency ones. If a dependency is under a license that
>>> requires a notice, it should be there. (If not, it shouldn't. The main
>>> apache 3rd party licenses page may give some help on this)
>>>
>>> Does this make sense to everyone?
>>>
>>> Nick
>>
>
> --
>
> Gabriele Columbro
> Alfresco Software, Ltd.
>
> http://www.mindthegab.com
> http://twitter.com/mindthegabz
>
> " Keyboard not found. Press F1 to continue. "
>
>
>
----
Stephan Klevenz
Fabrikstr. 45
69126 Heidelberg
Tel.: +49 6221 879625
Fax.: +49 6221 339926
Re: Validation of release packages
Posted by Florian Müller <fl...@alfresco.com>.
+1
On 10/09/2010 12:15, Gabriele Columbro wrote:
> Hey guys,
> quick update on this one: as Florian mentioned, working on the
> assumption the Category B licenses require a pointer to source code in
> NOTICE (apart from the mention in DEPENDENCIES), I have a working
> solution which allows maven to produce the notice file in the proper way.
> Basically I'm using a custom version of the apache-jar-resource-bundle,
> which lists in NOTICE all the CDDL licensed packages (CDDL is the only
> Category B dependency we have).
>
> Provided that I will pick this us on the Maven Dev list for a possible
> contribution, a quick solution for now is to:
>
> - create a top level project (out of the release, at the same level of
> the tck [1]), called chemistry-jar-resource-bundle
> - add the custom NOTICE.vm file there and deploy a SNAPSHOT to
> repository.apache.org
> - depend on it by our build and use it in the
> maven-remote-resource-plugin config
>
> I'll perform this right away, unless you guys have some concern. I can
> later then proceed with the release (ideally I could call a code freeze,
> let's say, by 3PM CET ? )
>
> Let me know your thoughts,
> Gab
>
>
>
>
>
>
>
>
>
> [1] http://svn.apache.org/repos/asf/incubator/chemistry/
>
>
>
> On Sep 9, 2010, at 3:17 PM, Florian Müller wrote:
>
>> Hi,
>>
>> Gab and my interpretation of the Apache third-party rules [1] is that
>> all dependencies with Category B licences have to be mentioned in the
>> NOTICE files with a link to the source code.
>>
>> We have a bunch of CDDL dependencies. The names and links are already
>> in the DEPENDENCIES files. We think copying the CDDL entries to NOTICE
>> files should sufficient.
>>
>>
>> Any comments? Experts?
>>
>>
>> - Florian
>>
>> [1] http://www.apache.org/legal/3party.html
>>
>>
>>
>> On 08/09/2010 14:59, Nick Burch wrote:
>>> On Wed, 1 Sep 2010, Gabriele Columbro wrote:
>>>> One question to conclude: referring to Nick's comments at [4], do you
>>>> think we should have anything else in NOTICE for all packages? In
>>>> other words, which of the licenses mentioned in the various
>>>> DEPENDENCIES files actually require a NOTICE?
>>>
>>> The NOTICE file should contain as little as possible. Everything else
>>> should go in DEPENDENCIES, a readme, the website etc
>>>
>>> The reason for this is that every downstream user has to include
>>> everything in our NOTICE file in their own notices. So, we want it to
>>> include all the required notices of our upstream dependencies, along
>>> with our own notice. However, we don't want to full the NOTICE file up
>>> with things that aren't required, as we don't want to burden our users!
>>>
>>> To review the NOTICE files, take a look at what's in there, and compare
>>> that to the dependencies list (which is hopefully correct, since maven
>>> generated it!). The notice file should have our notice in it, and after
>>> that any dependency ones. If a dependency is under a license that
>>> requires a notice, it should be there. (If not, it shouldn't. The main
>>> apache 3rd party licenses page may give some help on this)
>>>
>>> Does this make sense to everyone?
>>>
>>> Nick
>>
>
Re: Validation of release packages
Posted by Gabriele Columbro <ga...@apache.org>.
Hey guys,
quick update on this one: as Florian mentioned, working on the
assumption the Category B licenses require a pointer to source code in
NOTICE (apart from the mention in DEPENDENCIES), I have a working
solution which allows maven to produce the notice file in the proper
way.
Basically I'm using a custom version of the apache-jar-resource-
bundle, which lists in NOTICE all the CDDL licensed packages (CDDL is
the only Category B dependency we have).
Provided that I will pick this us on the Maven Dev list for a possible
contribution, a quick solution for now is to:
- create a top level project (out of the release, at the same level of
the tck [1]), called chemistry-jar-resource-bundle
- add the custom NOTICE.vm file there and deploy a SNAPSHOT to
repository.apache.org
- depend on it by our build and use it in the maven-remote-resource-
plugin config
I'll perform this right away, unless you guys have some concern. I
can later then proceed with the release (ideally I could call a code
freeze, let's say, by 3PM CET ? )
Let me know your thoughts,
Gab
[1] http://svn.apache.org/repos/asf/incubator/chemistry/
On Sep 9, 2010, at 3:17 PM, Florian Müller wrote:
> Hi,
>
> Gab and my interpretation of the Apache third-party rules [1] is
> that all dependencies with Category B licences have to be mentioned
> in the NOTICE files with a link to the source code.
>
> We have a bunch of CDDL dependencies. The names and links are
> already in the DEPENDENCIES files. We think copying the CDDL entries
> to NOTICE files should sufficient.
>
>
> Any comments? Experts?
>
>
> - Florian
>
> [1] http://www.apache.org/legal/3party.html
>
>
>
> On 08/09/2010 14:59, Nick Burch wrote:
>> On Wed, 1 Sep 2010, Gabriele Columbro wrote:
>>> One question to conclude: referring to Nick's comments at [4], do
>>> you
>>> think we should have anything else in NOTICE for all packages? In
>>> other words, which of the licenses mentioned in the various
>>> DEPENDENCIES files actually require a NOTICE?
>>
>> The NOTICE file should contain as little as possible. Everything else
>> should go in DEPENDENCIES, a readme, the website etc
>>
>> The reason for this is that every downstream user has to include
>> everything in our NOTICE file in their own notices. So, we want it to
>> include all the required notices of our upstream dependencies, along
>> with our own notice. However, we don't want to full the NOTICE file
>> up
>> with things that aren't required, as we don't want to burden our
>> users!
>>
>> To review the NOTICE files, take a look at what's in there, and
>> compare
>> that to the dependencies list (which is hopefully correct, since
>> maven
>> generated it!). The notice file should have our notice in it, and
>> after
>> that any dependency ones. If a dependency is under a license that
>> requires a notice, it should be there. (If not, it shouldn't. The
>> main
>> apache 3rd party licenses page may give some help on this)
>>
>> Does this make sense to everyone?
>>
>> Nick
>
--
Gabriele Columbro
Alfresco Software, Ltd.
http://www.mindthegab.com
http://twitter.com/mindthegabz
" Keyboard not found. Press F1 to continue. "
Re: Validation of release packages
Posted by Florian Müller <fl...@alfresco.com>.
Hi,
Gab and my interpretation of the Apache third-party rules [1] is that
all dependencies with Category B licences have to be mentioned in the
NOTICE files with a link to the source code.
We have a bunch of CDDL dependencies. The names and links are already in
the DEPENDENCIES files. We think copying the CDDL entries to NOTICE
files should sufficient.
Any comments? Experts?
- Florian
[1] http://www.apache.org/legal/3party.html
On 08/09/2010 14:59, Nick Burch wrote:
> On Wed, 1 Sep 2010, Gabriele Columbro wrote:
>> One question to conclude: referring to Nick's comments at [4], do you
>> think we should have anything else in NOTICE for all packages? In
>> other words, which of the licenses mentioned in the various
>> DEPENDENCIES files actually require a NOTICE?
>
> The NOTICE file should contain as little as possible. Everything else
> should go in DEPENDENCIES, a readme, the website etc
>
> The reason for this is that every downstream user has to include
> everything in our NOTICE file in their own notices. So, we want it to
> include all the required notices of our upstream dependencies, along
> with our own notice. However, we don't want to full the NOTICE file up
> with things that aren't required, as we don't want to burden our users!
>
> To review the NOTICE files, take a look at what's in there, and compare
> that to the dependencies list (which is hopefully correct, since maven
> generated it!). The notice file should have our notice in it, and after
> that any dependency ones. If a dependency is under a license that
> requires a notice, it should be there. (If not, it shouldn't. The main
> apache 3rd party licenses page may give some help on this)
>
> Does this make sense to everyone?
>
> Nick
Re: Validation of release packages (was: Fwd: [jira] Commented:
(CMIS-224) Improve legal/standard aspects of the release process /
packaging)
Posted by Nick Burch <ni...@alfresco.com>.
On Wed, 1 Sep 2010, Gabriele Columbro wrote:
> One question to conclude: referring to Nick's comments at [4], do you
> think we should have anything else in NOTICE for all packages? In other
> words, which of the licenses mentioned in the various DEPENDENCIES files
> actually require a NOTICE?
The NOTICE file should contain as little as possible. Everything else
should go in DEPENDENCIES, a readme, the website etc
The reason for this is that every downstream user has to include
everything in our NOTICE file in their own notices. So, we want it to
include all the required notices of our upstream dependencies, along with
our own notice. However, we don't want to full the NOTICE file up with
things that aren't required, as we don't want to burden our users!
To review the NOTICE files, take a look at what's in there, and compare
that to the dependencies list (which is hopefully correct, since maven
generated it!). The notice file should have our notice in it, and after
that any dependency ones. If a dependency is under a license that requires
a notice, it should be there. (If not, it shouldn't. The main apache 3rd
party licenses page may give some help on this)
Does this make sense to everyone?
Nick