You are viewing a plain text version of this content. The canonical link for it is here.
Posted to server-dev@james.apache.org by Stefano Bagnara <ap...@bago.org> on 2006/09/30 19:29:43 UTC
svn changes in james/project
I just reorganized james/project folder in svn to include the
tags/trunk/branches structure that I forgot to create when moving it out
of sandbox.
So I created the 3 folders, I moved all the previous content to "trunk"
and I updated all of the pom.xml to include the new "trunk" path in
their definition.
In the meantime I also added apache m1 repository
(http://people.apache.org/repo/m1-ibiblio-rsync-repository) to the main
pom.xml so we don't need to specify it in our subproducts.
Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: Maven 2 and repositories, redux
Posted by robert burrell donkin <ro...@gmail.com>.
On 10/1/06, Stefano Bagnara <ap...@bago.org> wrote:
> robert burrell donkin wrote:
> >> I use minotaur for the distribution management: in fact we are not using
> >> that part now because we don't use site deployment by maven.
> >
> > i'm think that you might find that it's now broken. AIUI minotaur is
> > not accessible for site deployment any more.
>
> Well, we never used it so I never noticed it was broken ;-)
> I generate the website locally, update our james/site/trunk/www
> generated repository in svn and then we simply go to minotaur in
> /www/james.apache.org and run an "svn update" (it is a checkout of the
> above folder).
i checked and it looks like we're back on minotaur now (AIUI for a
while people.apache.org was hosted elsewhere)
- robert
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: Maven 2 and repositories, redux
Posted by Stefano Bagnara <ap...@bago.org>.
robert burrell donkin wrote:
>> I use minotaur for the distribution management: in fact we are not using
>> that part now because we don't use site deployment by maven.
>
> i'm think that you might find that it's now broken. AIUI minotaur is
> not accessible for site deployment any more.
Well, we never used it so I never noticed it was broken ;-)
I generate the website locally, update our james/site/trunk/www
generated repository in svn and then we simply go to minotaur in
/www/james.apache.org and run an "svn update" (it is a checkout of the
above folder).
>> Btw I can fix it: what alias should I use for the server that keep the
>> main
>> website copy? is people.apache.org the best choice or anything else?
>
> use people.apache.org
>
> - robert
Thank you! I will update the poms the next time I will touch them.
Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: Maven 2 and repositories, redux
Posted by robert burrell donkin <ro...@gmail.com>.
On 10/1/06, Stefano Bagnara <ap...@bago.org> wrote:
> robert burrell donkin wrote:
<snip>
> > BTW using minotaur.apache.org in a pom is not recommended. please use
> > an appropriate virtual host (for example people.apache.org).
> >
> > - robert
>
> I use minotaur for the distribution management: in fact we are not using
> that part now because we don't use site deployment by maven.
i'm think that you might find that it's now broken. AIUI minotaur is
not accessible for site deployment any more.
> Btw I can fix it: what alias should I use for the server that keep the main
> website copy? is people.apache.org the best choice or anything else?
use people.apache.org
- robert
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: Maven 2 and repositories, redux
Posted by Stefano Bagnara <ap...@bago.org>.
Noel J. Bergman wrote:
>> <url>http://people.apache.org/repo/m2-ibiblio-rsync-repository</url>
>> <url>http://people.apache.org/repo/m1-ibiblio-rsync-repository</url>
>
> Uh ... are we supposed to publish a POM containing those URLs? Doesn't that
> drive the traffic to our non-mirrored server?
>
>> 3) retrieve any missing *m2* *plugin* from ibiblio
>
>> We could fix 3 to not use ibiblio by adding all of the plugins used by
>> maven to build jspf to the repos/third-party-m1 but I'm not sure this
>> would be good because every project would start to add all of the maven
>> plugins in their own trees.
>
> Please ask on repository@ for both of these issues.
>
> --- Noel
done: let's see if they can find a solution.
Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
RE: Maven 2 and repositories, redux
Posted by "Noel J. Bergman" <no...@devtech.com>.
> <url>http://people.apache.org/repo/m2-ibiblio-rsync-repository</url>
> <url>http://people.apache.org/repo/m1-ibiblio-rsync-repository</url>
Uh ... are we supposed to publish a POM containing those URLs? Doesn't that
drive the traffic to our non-mirrored server?
> 3) retrieve any missing *m2* *plugin* from ibiblio
> We could fix 3 to not use ibiblio by adding all of the plugins used by
> maven to build jspf to the repos/third-party-m1 but I'm not sure this
> would be good because every project would start to add all of the maven
> plugins in their own trees.
Please ask on repository@ for both of these issues.
--- Noel
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: Maven 2 and repositories, redux
Posted by Stefano Bagnara <ap...@bago.org>.
robert burrell donkin wrote:
> AFAICT the maven build for jsdf and mime4j hits the local filesystem
> only and not any ASF servers. opinions differ about whether storing
> artifacts in the repository is a good idea but james does so i see no
> reasons for infrastructure to object to this arrangement.
Actually we touch ASF servers: in our james-project (parent pom) we
define this repositories:
<repository>
<id>central</id>
<name>Apache Main M2 Repository</name>
<url>http://people.apache.org/repo/m2-ibiblio-rsync-repository</url>
<releases><enabled>true</enabled></releases>
<snapshots><enabled>true</enabled></snapshots>
</repository>
<repository>
<id>central-m1</id>
<name>Apache Main M1 Repository</name>
<url>http://people.apache.org/repo/m1-ibiblio-rsync-repository</url>
<layout>legacy</layout>
<releases><enabled>true</enabled></releases>
<snapshots><enabled>true</enabled></snapshots>
</repository>
<repository>
<id>apache.snapshots</id>
<name>Apache Snapshot Repository</name>
<url>http://people.apache.org/repo/m2-snapshot-repository</url>
<releases><enabled>false</enabled></releases>
</repository>
Then in the jspf pom we add:
<repository>
<id>local-jspf-3rd-party-m1</id>
<name>Local jSPF third party repository</name>
<url>file://${basedir}/repos/third-party-m1</url>
<layout>legacy</layout>
<releases>
<enabled>true</enabled>
<checksumPolicy>ignore</checksumPolicy>
</releases>
<snapshots>
<enabled>true</enabled>
<checksumPolicy>ignore</checksumPolicy>
</snapshots>
</repository>
Then we put every 3rd party jar (license compatible) that is not already
published in one of the offial ASF repository in the local
${basedir}/repos/third-party-m1 folder (folder that is part of the
checkout).
This mean that after you checked out the source tree for jspf it will do
these things:
1) retrieve org.apache.james:james-project:1.1-SNAPSHOT from
http://people.apache.org/repo/m2-snapshot-repository
2) retrieve any other ASF dependency from the 3 defined ASF repositories
(m1/m2 ibibio-rsync and m2 snapshot)
3) retrieve any missing *m2* *plugin* from ibiblio
4) copy 3rd party jars from the ${basedir}/repos/third-party-m1 to the
user repository.
We could fix 3 to not use ibiblio by adding all of the plugins used by
maven to build jspf to the repos/third-party-m1 but I'm not sure this
would be good because every project would start to add all of the maven
plugins in their own trees. We should wait for the ASF solution to this
issue, but only if this temporary solution allow us to make a release.
> BTW using minotaur.apache.org in a pom is not recommended. please use
> an appropriate virtual host (for example people.apache.org).
>
> - robert
I use minotaur for the distribution management: in fact we are not using
that part now because we don't use site deployment by maven. Btw I can
fix it: what alias should I use for the server that keep the main
website copy? is people.apache.org the best choice or anything else?
Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: Maven 2 and repositories, redux
Posted by robert burrell donkin <ro...@gmail.com>.
On 10/1/06, Stefano Bagnara <ap...@bago.org> wrote:
> Noel J. Bergman wrote:
<snip>
> > Dims, Steve and Henri did reply to you with very consistent responses. As I
> > understood the suggestion, it is the same as Norman uses, or at least
> > similar: define a local, file-based, repository. Dims, Steve and Henri each
> > explained why that was a good idea, including Henri's comment to you that
> > "[The Infrastructure Team] might be against the idea of putting build
> > dependables on a project's website", and all of them explaining various
> > security concerns. And you replied to Dims that you liked the idea! :-)
> > Was there something else from them that you needed?
>
> In my reply I also raised a few problems with that idea and proposed a
> different solution (evolution of that idea) where we didn't need a
> shared repository but we simply include the per-project jars in the
> source tree for that project like we do for ant-based projects (simply
> using a different convention for the lib folder structure).
> This is how jspf and mime4j currenlty builds and it is working. On
> repository they didn't reply about this solution.
> I think this is the best from both world and much more similar to how we
> do things using ant.
AFAICT the maven build for jsdf and mime4j hits the local filesystem
only and not any ASF servers. opinions differ about whether storing
artifacts in the repository is a good idea but james does so i see no
reasons for infrastructure to object to this arrangement.
BTW using minotaur.apache.org in a pom is not recommended. please use
an appropriate virtual host (for example people.apache.org).
- robert
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: Maven 2 and repositories, redux
Posted by Stefano Bagnara <ap...@bago.org>.
Noel J. Bergman wrote:
> Stefano Bagnara wrote:
>> Noel J. Bergman wrote:
>>> Remember that these are root directories. For another example, the RDF
>>> files don't belong on the web site. They are meta-data published only
> via
>>> SVN for the ASF's internal use. So site/ was the site related content,
> not
>>> just the site. It was what we had factored out from the code trees.
>
>> Yes, and this is why james-project doesn't belong to site: it is used to
>> build our maven2 based products, so it is part of the source code of our
>> products.
>
> Spanning a single versionable entity across more than one {ttb} structure is
> rather odd, but it is possible preferable to svn:external.
Sorry, maybe I have not been clear.
Project will be an indipendent releasable/versionable entity, and our
products will depend on specific versions of this entity. It is like a
standard jar depenency, but is a pom.
We now use "-SNAPSHOT" versions for all of them, but to be able to make
a non SNAPSHOT release of jspf maven will require that every dependency
is not SNAPSHOT, also, so we'll have to release also james-project and
maven-skin.
>> From your words it seems to me that ASF has much restrictive requirement
>> for James and that this requirements do not apply to jakarta, directory,
>> maven and other maven based tlp projects, but I can't find documentation
>> on the apache site with regard to this issue (or difference).
>
> Which words? What did you read from any of the folks on repository@, when
> they spoke against using the download mechanism and said to use local,
> file-based, repositories because of problems with Maven-driven traffic and
> security issues that was different?
I'm not sure I fully understant the maven-driven traffic.
A developer that download sources from the repository will create the
same traffic because it does not change things if he download it via SVN
or if the jars are downloaded by maven.
We probably have only to make sure that our source and binary
distributions will not contain references to that repository but will
contain local copy (in the zip/tar.gz) of the dependencies, right?
>> Yes, project has now a ttb structure and we'll need to release it when
>> we'll be ready to release jspf and mime4j.
>
> Release it as what? As PART OF something else, e.g., jSPF?
Release it as a shared dependency for our product. This will not be used
by our users but we (developers) need it.
This is a dependency like jspf for server: before to release next-server
we'll have to release jspf beacuse next-server depends on it.
>> In my reply I also raised a few problems with that idea and proposed a
>> different solution (evolution of that idea where we didn't need a
>> shared repository but we simply include the per-project jars in the
>> source tree for that project like we do for ant-based projects (simply
>> using a different convention for the lib folder structure).
>
> OK, so still a local, file-based, repository? How does this substantively
> differ from what Dims et al suggested? Perhaps they didn't notice anything
> different enough upon which to comment?
The main difference is that it is "local" once you checked out the
source tree, because it is include in the source tree for the product.
Otherwise developers will have to manually search the internet and
verify each artifact.
Putting them in the source tree in a local "maven1 style" (aka legacy)
repository is much more similar to what we did with ant (and the lib
folder).
>> We are lucky because we don't have license restricted dependencies and
>> we can include all of them. My solution would not apply to projects
>> depending on restricted libraries.
>
> That's OK. Such libraries are being so discouraged that I doubt that you
> will see much of them anymore.
I hope so!
My only doubt is junit: can you confirm that we can legally include it
in the repository? I understand that CPL is compatible, but I don't know
why I seem to remember that junit was not good for inclusion...
>> With the current setup jspf and mime4j have a file based repository that
>> is downloaded with the source tree for 3rd party libraries and only uses
>> networking to download jars from official ASF repositories.
>
> That's fine, with the caveat that we should make sure that no one is
> complaining about our driving downloads to ASF servers.
>
> --- Noel
So I have to check out if it is possible to create a source package that
does not include the original pom.xml repositories, but include every
dependency in the final package.
This way it would be really similar to what we did with ant, right?
Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
RE: Maven 2 and repositories, redux
Posted by "Noel J. Bergman" <no...@devtech.com>.
Stefano Bagnara wrote:
> Noel J. Bergman wrote:
> > Remember that these are root directories. For another example, the RDF
> > files don't belong on the web site. They are meta-data published only
via
> > SVN for the ASF's internal use. So site/ was the site related content,
not
> > just the site. It was what we had factored out from the code trees.
> Yes, and this is why james-project doesn't belong to site: it is used to
> build our maven2 based products, so it is part of the source code of our
> products.
Spanning a single versionable entity across more than one {ttb} structure is
rather odd, but it is possible preferable to svn:external.
> It is clear that we don't have a consensus here... and it seems to me
> that is something more religious than technical
I'm not so sure of that, but we can fix anything later.
> From your words it seems to me that ASF has much restrictive requirement
> for James and that this requirements do not apply to jakarta, directory,
> maven and other maven based tlp projects, but I can't find documentation
> on the apache site with regard to this issue (or difference).
Which words? What did you read from any of the folks on repository@, when
they spoke against using the download mechanism and said to use local,
file-based, repositories because of problems with Maven-driven traffic and
security issues that was different?
> Yes, project has now a ttb structure and we'll need to release it when
> we'll be ready to release jspf and mime4j.
Release it as what? As PART OF something else, e.g., jSPF?
> In my reply I also raised a few problems with that idea and proposed a
> different solution (evolution of that idea where we didn't need a
> shared repository but we simply include the per-project jars in the
> source tree for that project like we do for ant-based projects (simply
> using a different convention for the lib folder structure).
OK, so still a local, file-based, repository? How does this substantively
differ from what Dims et al suggested? Perhaps they didn't notice anything
different enough upon which to comment?
> We are lucky because we don't have license restricted dependencies and
> we can include all of them. My solution would not apply to projects
> depending on restricted libraries.
That's OK. Such libraries are being so discouraged that I doubt that you
will see much of them anymore.
> With the current setup jspf and mime4j have a file based repository that
> is downloaded with the source tree for 3rd party libraries and only uses
> networking to download jars from official ASF repositories.
That's fine, with the caveat that we should make sure that no one is
complaining about our driving downloads to ASF servers.
--- Noel
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: Maven 2 and repositories, redux
Posted by Stefano Bagnara <ap...@bago.org>.
Noel J. Bergman wrote:
>> If we use site as a backup/tracker for our website content we shouldn't
>> use the same folder for root poms and other sources.
>
> Remember that these are root directories. For another example, the RDF
> files don't belong on the web site. They are meta-data published only via
> SVN for the ASF's internal use. So site/ was the site related content, not
> just the site. It was what we had factored out from the code trees.
Yes, and this is why james-project doesn't belong to site: it is used to
build our maven2 based products, so it is part of the source code of our
products.
>> I think we need a project folder and I wrote this in the vote, so we
>> could have discussed in that vote
>
> Discuss first, then vote. Votes are to acknowledge a consensus.
It is clear that we don't have a consensus here... and it seems to me
that is something more religious than technical, so a vote would
simplify things.
From your words it seems to me that ASF has much restrictive
requirement for James and that this requirements do not apply to
jakarta, directory, maven and other maven based tlp projects, but I
can't find documentation on the apache site with regard to this issue
(or difference).
>> Imho the pom things was polluting the folder and it was mixing 2 things
>> that had almost nothing to share.
>
> So projects/ is purely mavenization? Since each releasable component,
> jsieve, jspf, server, site, etc., are supposed to have self-contained trees,
> with the common site related information factored out, what does projects/
> do for us? It has a {ttb} structure, so what is project/ as a separately
> versioned entity?
Postage already depends on james-server: so we already have this
dependency between products in our repositories and products are not
self-contained.
Yes, project has now a ttb structure and we'll need to release it when
we'll be ready to release jspf and mime4j.
>> We have multiple maven2 based products in the James project
>
> Well, that's certainly not my fault. ;-)
Of course, I did it. Otherwise we would not have a jspf product and
mime4j would be still on maven1. If you want to write *WORKING* ant
scripts that give us what maven is givin us and keep them updated I will
be happy to dismiss maven and have more free time to work on the code.
>> they have common informations, and that informations in maven
>> (that is Object Oriented) is shared in a "superclass": our
>> james-project.
>
> So this is shared Maven stuff, very similar to how site is shared content.
Yes, shared data for our products. Our "super"/"abstract" product.
>> I found a solution that allow us to make a m2 release without using
>> ibiblio dependencies and without adding repositories. I added the
>> "repo/third-party-m1" as a customized library folder for each product
>> that need this. I proposed this to the repository list but they never
>> replied with considerations on this because they started talking again
>> of repositories security and the fact that they are waiting for your
>> considerations about the security changes proposal for maven2.
>
> Mine? LOL /me goes to look at that list now, too. Ok, well Brett was
> wrong. I didn't even know about his proposal until you just mentioned the
> topic. I'll reply to him there. And I see that Robert has already done his
> usually excellent job of review, along with a few others. :-)
>
> However, with respect to:
>
>> I added the "repo/third-party-m1" as a customized library folder for
>> each product that need this. I proposed this to the repository list
>> but they never replied with considerations
>
> Dims, Steve and Henri did reply to you with very consistent responses. As I
> understood the suggestion, it is the same as Norman uses, or at least
> similar: define a local, file-based, repository. Dims, Steve and Henri each
> explained why that was a good idea, including Henri's comment to you that
> "[The Infrastructure Team] might be against the idea of putting build
> dependables on a project's website", and all of them explaining various
> security concerns. And you replied to Dims that you liked the idea! :-)
> Was there something else from them that you needed?
In my reply I also raised a few problems with that idea and proposed a
different solution (evolution of that idea) where we didn't need a
shared repository but we simply include the per-project jars in the
source tree for that project like we do for ant-based projects (simply
using a different convention for the lib folder structure).
This is how jspf and mime4j currenlty builds and it is working. On
repository they didn't reply about this solution.
I think this is the best from both world and much more similar to how we
do things using ant.
We are lucky because we don't have license restricted dependencies and
we can include all of them. My solution would not apply to projects
depending on restricted libraries.
>> On the repository list Henri Yandell say different things from you and
>> say that creating a folder in svn adding there 3rd party libraries that
>> are compatible with the ASF license is something we can do.
>
> I've read everyone's replies, including Henri's, and if you think that we
> said different things, you misunderstood one of us. The ability to have
> third party jars in SVN, so long as they are license compatible, is not a
> problem and as clarified again during the licensing discussions. However,
> having an SVN directory and using it as a Maven repository are not the same
> thing. Just ask how upset people can get when they see XML schema
> downloaded directly from ASF infrastructure by tools. This is one reason
> why we have talked about having an ASF-hosted repository for them, but there
> are outstanding issues to make sure that it can be done securely and
> efficiently. In the meantime ...
I don't want to talk about this again: of course I don't agree, but I
think I already provided a lot of information against this arguments and
now I moved to a different proposal that does not include the creation
of a james repository so it does not make sense to discuss again of this
one.
>> I just need a solution to be able to release our m2 based products
>> (mime4j and jspf first of all).
>
> So what's the problem? People download the binaries and use them. For
> people working from source, follow the pattern recommended on repository@:
> self-contained projects with local, file-based, repositories. Just forget
> that Maven can download anything. It is a bad idea, anyway, at least for
> now. If I understood him correctly, Norman tells me that he downloads all
> dependents, himself, and never has Maven download anything ever. That
> sounds like the best strategy until the ASF has its own repository, and
> Maven can authenticate downloads.
With the current setup jspf and mime4j have a file based repository that
is downloaded with the source tree for 3rd party libraries and only uses
networking to download jars from official ASF repositories.
Plugins are still downloaded from ibiblio if you don't have them.
All of other ASF products releasing on m2 do the same: we already are
one step beyond because we don't use ibiblio for dependencies we
redistribute.
>>> the lack of an answer doesn't mean that you should simply bypass ASF
> policy
>> I think I never bypassed the policy
>
> To be clear, I am complaining about one thing in specific: svn commits when
> you know that there are no commit notices. That is the specific issue. You
> should have understood this from when Bernd accidentally committed without
> notices: notices are considered essential to our oversight process. So
> essential that we even have a tool for re-running the notices if they've
> gotten lost, but it is rather not fun to use.
Notices have been done MANUALLY: so we HAD notices: and the fact that
everyone was aware of this manual notices prove they worked. You was not
aware of this, but you also missed 6 mails in 2 weeks window were I
asked you to add the notifications, so maybe you have been to busy to
give the needed oversight on this project.
>>> In any event, I talking with infrastructure to make sure of the correct
>>> changes to have changes at the james/ level notify general@, and
> everything
>>> else that isn't specifically defined notify server-dev.
>
> With a bit of luck, I've got the notices in place and didn't break the
> mailer doing it. Unfortunately, I'm going to be off-line for the 36 hours
> or so, so if anything IS wrong, please notify the infrastructure team
> directly, or see if Serge can fix it.
>
> --- Noel
Sure, thank you,
Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Maven 2 and repositories, redux
Posted by "Noel J. Bergman" <no...@devtech.com>.
Stefano Bagnara wrote:
> Noel J. Bergman wrote:
>>> It contains the commons informations for the James project (website,
>>> repositories, developers, licenses). Think at it as the AbstractPOM
>>> for our POMs (m2 has many Object Oriented things in its architecture)
>> It seems to me that the site/ structure was being used for that purpose.
>> That is also where the RDF files, KEYS, etc., have been located.
> If we use site as a backup/tracker for our website content we shouldn't
> use the same folder for root poms and other sources.
Remember that these are root directories. For another example, the RDF
files don't belong on the web site. They are meta-data published only via
SVN for the ASF's internal use. So site/ was the site related content, not
just the site. It was what we had factored out from the code trees.
> I think we need a project folder and I wrote this in the vote, so we
> could have discussed in that vote
Discuss first, then vote. Votes are to acknowledge a consensus.
> Imho the pom things was polluting the folder and it was mixing 2 things
> that had almost nothing to share.
So projects/ is purely mavenization? Since each releasable component,
jsieve, jspf, server, site, etc., are supposed to have self-contained trees,
with the common site related information factored out, what does projects/
do for us? It has a {ttb} structure, so what is project/ as a separately
versioned entity?
> We have multiple maven2 based products in the James project
Well, that's certainly not my fault. ;-)
> they have common informations, and that informations in maven
> (that is Object Oriented) is shared in a "superclass": our
> james-project.
So this is shared Maven stuff, very similar to how site is shared content.
> I found a solution that allow us to make a m2 release without using
> ibiblio dependencies and without adding repositories. I added the
> "repo/third-party-m1" as a customized library folder for each product
> that need this. I proposed this to the repository list but they never
> replied with considerations on this because they started talking again
> of repositories security and the fact that they are waiting for your
> considerations about the security changes proposal for maven2.
Mine? LOL /me goes to look at that list now, too. Ok, well Brett was
wrong. I didn't even know about his proposal until you just mentioned the
topic. I'll reply to him there. And I see that Robert has already done his
usually excellent job of review, along with a few others. :-)
However, with respect to:
> I added the "repo/third-party-m1" as a customized library folder for
> each product that need this. I proposed this to the repository list
> but they never replied with considerations
Dims, Steve and Henri did reply to you with very consistent responses. As I
understood the suggestion, it is the same as Norman uses, or at least
similar: define a local, file-based, repository. Dims, Steve and Henri each
explained why that was a good idea, including Henri's comment to you that
"[The Infrastructure Team] might be against the idea of putting build
dependables on a project's website", and all of them explaining various
security concerns. And you replied to Dims that you liked the idea! :-)
Was there something else from them that you needed?
> On the repository list Henri Yandell say different things from you and
> say that creating a folder in svn adding there 3rd party libraries that
> are compatible with the ASF license is something we can do.
I've read everyone's replies, including Henri's, and if you think that we
said different things, you misunderstood one of us. The ability to have
third party jars in SVN, so long as they are license compatible, is not a
problem and as clarified again during the licensing discussions. However,
having an SVN directory and using it as a Maven repository are not the same
thing. Just ask how upset people can get when they see XML schema
downloaded directly from ASF infrastructure by tools. This is one reason
why we have talked about having an ASF-hosted repository for them, but there
are outstanding issues to make sure that it can be done securely and
efficiently. In the meantime ...
> I just need a solution to be able to release our m2 based products
> (mime4j and jspf first of all).
So what's the problem? People download the binaries and use them. For
people working from source, follow the pattern recommended on repository@:
self-contained projects with local, file-based, repositories. Just forget
that Maven can download anything. It is a bad idea, anyway, at least for
now. If I understood him correctly, Norman tells me that he downloads all
dependents, himself, and never has Maven download anything ever. That
sounds like the best strategy until the ASF has its own repository, and
Maven can authenticate downloads.
> > the lack of an answer doesn't mean that you should simply bypass ASF
policy
> I think I never bypassed the policy
To be clear, I am complaining about one thing in specific: svn commits when
you know that there are no commit notices. That is the specific issue. You
should have understood this from when Bernd accidentally committed without
notices: notices are considered essential to our oversight process. So
essential that we even have a tool for re-running the notices if they've
gotten lost, but it is rather not fun to use.
> > In any event, I talking with infrastructure to make sure of the correct
> > changes to have changes at the james/ level notify general@, and
everything
> > else that isn't specifically defined notify server-dev.
With a bit of luck, I've got the notices in place and didn't break the
mailer doing it. Unfortunately, I'm going to be off-line for the 36 hours
or so, so if anything IS wrong, please notify the infrastructure team
directly, or see if Serge can fix it.
--- Noel
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: svn changes in james/project
Posted by Stefano Bagnara <ap...@bago.org>.
Noel J. Bergman wrote:
>> It contains the commons informations for the James project (website,
>> repositories, developers, licenses). Think at it as the AbstractPOM
>> for our POMs (m2 has many Object Oriented things in its architecture)
>
> It seems to me that the site/ structure was being used for that purpose.
> That is also where the RDF files, KEYS, etc., have been located. Ok,
> perhaps that name "site" wasn't ideal. But at least we're discussing this,
> so fine.
If we use site as a backup/tracker for our website content we shouldn't
use the same folder for root poms and other sources.
I think we need a project folder and I wrote this in the vote, so we
could have discussed in that vote if people wanted to put that somewhere
else.
I still think that the project folder is the right position, if you
don't feel so just start a vote to move it under the site folder.
>> So I think this does not belong to site even if it include many sources
>> for the site generation.
>
> When you are done doing what you propose, what would site/ be used for?
For the very same things it was used before I started working on james:
keys, rdf, the generated content.
Imho the pom things was polluting the folder and it was mixing 2 things
that had almost nothing to share.
>> "james-project" would be the root artifact for every product
>> released under the apache james umbrella.
>
> Clarify. james/ is the root for the james project. Is this just more
> Mavenization?
I don't think I can be more clear than this. We have multiple maven2
based products in the James project, they have common informations, and
that informations in maven (that is Object Oriented) is shared in a
"superclass": our james-project.
If we consider that all of our website (even for non-maven2 products) is
generated by maven this is a core part of our development cycle and
should have as much visibility as possible.
>> You simply replied "That does not seem appropriate." and then ignored my
>> requests for explanations.
>
> I recall the former. Don't recall seeing the latter. Of course, we've had
> a very high volume of e-mail lately, and I've been on the road non-stop
> since September 9th, with only Sept 16-17 to even try catching up, and the
> Incubator PMC report was a higher priority that weekend, as was working on
> the code that Norman's waiting for me to finish.
Ok, so we should restart discussing as soon as you will catch up and you
will have replied to that threads: it does not make sense to start new
threads without replying to the previous one.
>> I need an answer to my repository proposal
>
> And as I've indicated, there are a variety of considerations going into the
> use of proper (including efficient and permissible) use of repositories at
> the ASF, so this must be coordinated with repository@apache.org. And, yes,
> I am aware that as of 16 Sept, you started communicating on that list, so
> I'll trust that you'll continue. :)
Yes, I found a solution that allow us to make a m2 release without using
ibiblio dependencies and without adding repositories. I added the
"repo/third-party-m1" as a customized library folder for each product
that need this. I proposed this to the repository list but they never
replied with considerations on this because they started talking again
of repositories security and the fact that they are waiting for your
considerations about the security changes proposal for maven2.
On the repository list Henri Yandell say different things from you and
say that creating a folder in svn adding there 3rd party libraries that
are compatible with the ASF license is something we can do.
Btw I don't have so much time, so I look at concrete things: I just need
a solution to be able to release our m2 based products (mime4j and jspf
first of all). I think the current solution will let us to release them,
and I will start a proposal later that will not include the use of any
network based repository but the one provided by ASF. If you have
alternative solutions please write them: I would be happy if someone
else but me could loose a little of his time figuring out a solution for
this issue.
MANY ASF products based on maven2 are being officially released by ASF
so I guess we'll not be blocked by ASF for this kind of issues: we just
need to do what the others did. I think I already improved the james
solution more than what is required by ASF introducing the local
repository "hack" in mime4j and jspf and replacing ibiblio with the main
ASF repository for the "central" repository in our main pom.
>> if no answer I need Noel to setup the svn notifications so I can really
>> work on james repository) and few other things.
>
>> I asked this 6 times in 2 weeks then I decided it was much more easy for
>> me to manually do the notifications.
>
> I didn't see those e-mails. And although I am sorry that you are
> frustrated, the lack of an answer doesn't mean that you should simply bypass
> ASF policy regarding PMC oversight and do what you want anyway. That's my
> complaint. The rest is relatively minor, and I do understand your point of
> view.
I think I never bypassed the policy: in fact I did manually every things
was needed to let the PMC knows what happened on the repository and it
seems that every PMC member but you was aware of what was going on and
saw my manual notifications. If this is not correct than provide me the
links where I can read the documentation about this policy, because I
didn't find this.
> In any event, I talking with infrastructure to make sure of the correct
> changes to have changes at the james/ level notify general@, and everything
> else that isn't specifically defined notify server-dev.
>
> --- Noel
Thank you,
Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
RE: svn changes in james/project
Posted by "Noel J. Bergman" <no...@devtech.com>.
Stefano Bagnara wrote (merged from two replies):
> Noel J. Bergman wrote:
> > AGAIN, why isn't the project/ directory under site/, which IS known to
the
> > mailer? I have raised this before, and not gotten a reply.
> It is under project because it does not contains only site specific
things.
> In fact the main project/pom.xml is the parent pom of all our m2 based
> products and we use it instead of the main apache:apache:3 pom because
> we want to override the usage of ibibio as default central repository by
> using ASF repository as central.
> It also contains common informations for the James products: license,
> developers, distribution informations, organization infos, and so on.
> It contains the commons informations for the James project (website,
> repositories, developers, licenses). Think at it as the AbstractPOM
> for our POMs (m2 has many Object Oriented things in its architecture)
It seems to me that the site/ structure was being used for that purpose.
That is also where the RDF files, KEYS, etc., have been located. Ok,
perhaps that name "site" wasn't ideal. But at least we're discussing this,
so fine.
> So I think this does not belong to site even if it include many sources
> for the site generation.
When you are done doing what you propose, what would site/ be used for?
> About the "AGAIN" and "not gotten a reply" maybe you missed this thread
> titled "Re: [PROPOSAL] maven2 and james repository short term solution"
> from general@ 17/09/2006:
Correct, I have not seen a reply there.
> "james-project" would be the root artifact for every product
> released under the apache james umbrella.
Clarify. james/ is the root for the james project. Is this just more
Mavenization?
> You simply replied "That does not seem appropriate." and then ignored my
> requests for explanations.
I recall the former. Don't recall seeing the latter. Of course, we've had
a very high volume of e-mail lately, and I've been on the road non-stop
since September 9th, with only Sept 16-17 to even try catching up, and the
Incubator PMC report was a higher priority that weekend, as was working on
the code that Norman's waiting for me to finish.
> I need an answer to my repository proposal
And as I've indicated, there are a variety of considerations going into the
use of proper (including efficient and permissible) use of repositories at
the ASF, so this must be coordinated with repository@apache.org. And, yes,
I am aware that as of 16 Sept, you started communicating on that list, so
I'll trust that you'll continue. :)
> if no answer I need Noel to setup the svn notifications so I can really
> work on james repository) and few other things.
> I asked this 6 times in 2 weeks then I decided it was much more easy for
> me to manually do the notifications.
I didn't see those e-mails. And although I am sorry that you are
frustrated, the lack of an answer doesn't mean that you should simply bypass
ASF policy regarding PMC oversight and do what you want anyway. That's my
complaint. The rest is relatively minor, and I do understand your point of
view.
In any event, I talking with infrastructure to make sure of the correct
changes to have changes at the james/ level notify general@, and everything
else that isn't specifically defined notify server-dev.
--- Noel
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: svn changes in james/project
Posted by Stefano Bagnara <ap...@bago.org>.
Noel J. Bergman wrote:
>> I just reorganized james/project folder in svn
>
> AGAIN, why isn't the project/ directory under site/, which IS known to the
> mailer? I have raised this before, and not gotten a reply.
>
> --- Noel
About the "AGAIN" and "not gotten a reply" maybe you missed this thread
titled "Re: [PROPOSAL] maven2 and james repository short term solution"
from general@ 17/09/2006:
Bernd asked:
> "project" is only website-related?
> if yes, please let's find a better name, for example "site-general"
or "project-site"
> if no, what is it for?
I replied:
No, "james-project" would be the root artifact for every product
released under the apache james umbrella.
It contains the commons informations for the James project (website,
repositories, developers, licenses).
Think at it as the AbstractPOM for our POMs (m2 has many Object Oriented
things in its architecture)
That said it seems that I'm the one that is not getting replies about
the svn notifications. I asked you to add svn notifications for the
whole james project at least 6 times (5 via mailing list, 1 via personal
email, 1 via IM):
You simply replied "That does not seem appropriate." and then ignored my
requests for explanations.
general@james 14/09/2006
Re: [PROPOSAL] maven2 and james repository short term solution:
---
Noel: can you please change the svn notification so that it works on the
full james repository? If you have specific options it would be good if
server commits had the server-dev reply-to and the other had the general
reply-to.
---
server-dev@james 15/09/2006
Re: JAMES v2.4 Road Map
---
At my best I could help you with the website stuff (as I refactored all
and maybe I better know the new maven2 site builds), with the maven spf
builds (but I need an answer to my repository proposal and if no answer
I need Noel to setup the svn notifications so I can really work on james
repository) and few other things.
---
personal email 16/09/2006
James svn notifications
----
Can you setup generic notification for james repository?
I would say:
james/server => notifications to server-cvs, reply-to server-dev
james/site => notifications to site-dev, reply-to site-dev
james => notification to server-cvs, reply-to general
Is it possible to have the last rule (james excluding james/server and
james/site) ?
If not I can send you the list of directories: let me know!
----
general@james 18/09/2006
Re: [PROPOSAL] maven2 and james repository short term solution:
---
Independently from the result of this proposal we need the notifications
working in all the folders of the repository or we are unable to keep
under control what it happens. Currenlty if someone (even by mistake)
commit something in a folder that has no notification we don't see this
and this is not good.
----
A private list 27/09/2006
Re: PMC oversight and SVN
----
Can we create a james-cvs for all but server?
Can we create an exclusive rule like all but server and site is notified
there?
Imo it is important to have a notification for the full repository
otherwise someone could commit something in james/newfolder and we would
never know anything!
-----
As you can see it seems a bit unfair that you write "AGAIN" like I did
something wrong.
I asked this 6 times in 2 weeks then I decided it was much more easy for
me to manually do the notifications.
Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
Re: svn changes in james/project
Posted by Stefano Bagnara <ap...@bago.org>.
Noel J. Bergman wrote:
>> I just reorganized james/project folder in svn
>
> AGAIN, why isn't the project/ directory under site/, which IS known to the
> mailer? I have raised this before, and not gotten a reply.
It is under project because it does not contains only site specific things.
In fact the main project/pom.xml is the parent pom of all our m2 based
products and we use it instead of the main apache:apache:3 pom because
we want to override the usage of ibibio as default central repository by
using ASF repository as central.
It also contains common informations for the James products: license,
developers, distribution informations, organization infos, and so on.
So I think this does not belong to site even if it include many sources
for the site generation.
As a sidenote: working on the site folder I found a bad thing to have
source and generated things in the same folder. Open the site folder
under eclipse (or another ide) and you will find that the 10000
generated files in the www folder slow down the usage of the source
folders. With the new layout it is much more easy to manage that
Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org
RE: svn changes in james/project
Posted by "Noel J. Bergman" <no...@devtech.com>.
> I just reorganized james/project folder in svn
AGAIN, why isn't the project/ directory under site/, which IS known to the
mailer? I have raised this before, and not gotten a reply.
--- Noel
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org