Shiro artifact distribution

[Les Hazlewood <lh...@apache.org>]

Per the Incubator list, we need to ensure our source distribution
comes from Apache's mirrored infrastructure.  Kalle, I noticed that
you changed the links in the meantime to point to the m2 repo
(thanks), but we're mandated to distribute from the ASF
infrastructure.  The links to the .jars point to m2 as a convenience,
but since they're not a source distro, the ASF doesn't care about them
as much - we just can't do that with our source distro.

I was just going to place them in a directory under the 'static'
directory of our website on people.apache.org.  At least this is what
is recommended by [1].  Any objections?

Les

[1] http://www.apache.org/dev/release-publishing.html#distribution

Re: Shiro artifact distribution

[Les Hazlewood <lh...@apache.org>]

Awesome, thanks for the pointer Craig.  Also, next time we go through
a release process, I think we should write a step-by-step flow of the
process so anyone can repeat it.

Kalle did a beautiful job getting us through our first release, but I
don't think I could brainlessly repeat it (yet).  I'm a big fan of
making guides like this to essentially eliminate human error (or
accidental omission) so that anyone can do the process, even if
they're completely new to it.

Les

On Tue, Aug 17, 2010 at 11:36 AM, Craig L Russell
<cr...@oracle.com> wrote:
> Hi Les,
>
> There is a cgi script that projects use to allow downloads from mirrors.
> Here's how JDO does it
> http://svn.apache.org/repos/asf/db/jdo/HowToReleaseJDO.html in section "Site
> updates". You can adapt the script to Shiro's purposes easily enough. (JDO
> borrowed it from another project, probably ultimately from httpd).
>
> Craig
>
> On Aug 17, 2010, at 11:29 AM, Les Hazlewood wrote:
>
>> Yes, it did slip - and don't worry, I didn't do anything :)
>>
>> I'll have to go back through the release threads - is there something
>> that you used that automates copying the resources to that location?
>> Also, just out of curiosity, why do we publish there instead of the
>> mentioned location in the release-publishing.html page?
>>
>> In any event, I'll change the wiki links to point to these artifacts
>> instead of the m2 repo.
>>
>> Thanks,
>>
>> Les
>>
>> On Tue, Aug 17, 2010 at 10:49 AM, Kalle Korhonen
>> <ka...@gmail.com> wrote:
>>>
>>> Hold your horses - I did that as well when I made the release. The
>>> official incubator distribution area for our project is at
>>> http://www.apache.org/dist/incubator/shiro/, see the files there. I'm
>>> sure I mentioned this at the release time but perhaps slipped through
>>> your eyes.
>>>
>>> Kalle
>>>
>>>
>>> On Tue, Aug 17, 2010 at 10:35 AM, Les Hazlewood <lh...@apache.org>
>>> wrote:
>>>>
>>>> Per the Incubator list, we need to ensure our source distribution
>>>> comes from Apache's mirrored infrastructure.  Kalle, I noticed that
>>>> you changed the links in the meantime to point to the m2 repo
>>>> (thanks), but we're mandated to distribute from the ASF
>>>> infrastructure.  The links to the .jars point to m2 as a convenience,
>>>> but since they're not a source distro, the ASF doesn't care about them
>>>> as much - we just can't do that with our source distro.
>>>>
>>>> I was just going to place them in a directory under the 'static'
>>>> directory of our website on people.apache.org.  At least this is what
>>>> is recommended by [1].  Any objections?
>>>>
>>>> Les
>>>>
>>>> [1] http://www.apache.org/dev/release-publishing.html#distribution
>>>>
>>>
>
> Craig L Russell
> Architect, Oracle
> http://db.apache.org/jdo
> 408 276-5638 mailto:Craig.Russell@oracle.com
> P.S. A good JDO? O, Gasp!
>
>

Re: Shiro artifact distribution

[Craig L Russell <cr...@oracle.com>]

Hi Les,

There is a cgi script that projects use to allow downloads from  
mirrors. Here's how JDO does it http://svn.apache.org/repos/asf/db/jdo/HowToReleaseJDO.html 
  in section "Site updates". You can adapt the script to Shiro's  
purposes easily enough. (JDO borrowed it from another project,  
probably ultimately from httpd).

Craig

On Aug 17, 2010, at 11:29 AM, Les Hazlewood wrote:

> Yes, it did slip - and don't worry, I didn't do anything :)
>
> I'll have to go back through the release threads - is there something
> that you used that automates copying the resources to that location?
> Also, just out of curiosity, why do we publish there instead of the
> mentioned location in the release-publishing.html page?
>
> In any event, I'll change the wiki links to point to these artifacts
> instead of the m2 repo.
>
> Thanks,
>
> Les
>
> On Tue, Aug 17, 2010 at 10:49 AM, Kalle Korhonen
> <ka...@gmail.com> wrote:
>> Hold your horses - I did that as well when I made the release. The
>> official incubator distribution area for our project is at
>> http://www.apache.org/dist/incubator/shiro/, see the files there. I'm
>> sure I mentioned this at the release time but perhaps slipped through
>> your eyes.
>>
>> Kalle
>>
>>
>> On Tue, Aug 17, 2010 at 10:35 AM, Les Hazlewood <lhazlewood@apache.org 
>> > wrote:
>>> Per the Incubator list, we need to ensure our source distribution
>>> comes from Apache's mirrored infrastructure.  Kalle, I noticed that
>>> you changed the links in the meantime to point to the m2 repo
>>> (thanks), but we're mandated to distribute from the ASF
>>> infrastructure.  The links to the .jars point to m2 as a  
>>> convenience,
>>> but since they're not a source distro, the ASF doesn't care about  
>>> them
>>> as much - we just can't do that with our source distro.
>>>
>>> I was just going to place them in a directory under the 'static'
>>> directory of our website on people.apache.org.  At least this is  
>>> what
>>> is recommended by [1].  Any objections?
>>>
>>> Les
>>>
>>> [1] http://www.apache.org/dev/release-publishing.html#distribution
>>>
>>

Craig L Russell
Architect, Oracle
http://db.apache.org/jdo
408 276-5638 mailto:Craig.Russell@oracle.com
P.S. A good JDO? O, Gasp!

Re: Shiro artifact distribution

[Les Hazlewood <lh...@apache.org>]

Ok, the links have been updated to point to the apache.org/dist
location.  They'll show up in a couple of hours after
people.apache.org syncs to the web server farm.

On Tue, Aug 17, 2010 at 11:29 AM, Les Hazlewood <lh...@apache.org> wrote:
> Yes, it did slip - and don't worry, I didn't do anything :)
>
> I'll have to go back through the release threads - is there something
> that you used that automates copying the resources to that location?
> Also, just out of curiosity, why do we publish there instead of the
> mentioned location in the release-publishing.html page?
>
> In any event, I'll change the wiki links to point to these artifacts
> instead of the m2 repo.
>
> Thanks,
>
> Les
>
> On Tue, Aug 17, 2010 at 10:49 AM, Kalle Korhonen
> <ka...@gmail.com> wrote:
>> Hold your horses - I did that as well when I made the release. The
>> official incubator distribution area for our project is at
>> http://www.apache.org/dist/incubator/shiro/, see the files there. I'm
>> sure I mentioned this at the release time but perhaps slipped through
>> your eyes.
>>
>> Kalle
>>
>>
>> On Tue, Aug 17, 2010 at 10:35 AM, Les Hazlewood <lh...@apache.org> wrote:
>>> Per the Incubator list, we need to ensure our source distribution
>>> comes from Apache's mirrored infrastructure.  Kalle, I noticed that
>>> you changed the links in the meantime to point to the m2 repo
>>> (thanks), but we're mandated to distribute from the ASF
>>> infrastructure.  The links to the .jars point to m2 as a convenience,
>>> but since they're not a source distro, the ASF doesn't care about them
>>> as much - we just can't do that with our source distro.
>>>
>>> I was just going to place them in a directory under the 'static'
>>> directory of our website on people.apache.org.  At least this is what
>>> is recommended by [1].  Any objections?
>>>
>>> Les
>>>
>>> [1] http://www.apache.org/dev/release-publishing.html#distribution
>>>
>>
>

Re: Shiro artifact distribution

[Craig L Russell <cr...@oracle.com>]

So,

The official and primary distribution of Shiro are the source bundles  
found at dist/shiro/...

Anything else is a secondary distribution, including "binary" releases  
also found at dist/shiro and m2 poms and jars.

Artifacts that are published at dist/shiro should be referenced via  
the "download from mirror" technique. Artifacts that are published in  
the m2 rsync repository can be downloaded simply by referencing them  
in a maven pom. There's no need to have another way to download the  
poms and jars.

Craig


On Aug 17, 2010, at 12:10 PM, Les Hazlewood wrote:

>> From my reading of the release documentation either is fine. As a TLP
>> I don't think we have a strict requirement to publish to /dist, it's
>> just an option. However, Clutch checks for the existence of release
>> artifacts at /dist so we better keep the duplicates there. Going
>> forward, I don't think we need to worry about cgi scripts for using
>> mirros either, central is already load-balanced (and proxied and
>> cached).
>
> We unfortunately can't use m2 central as our primary distribution
> source since that is not considered ASF infrastructure.  At least
> according to the publishing page:
>
> "The Apache infrastructure must be the primary source for all
> artifacts officially released by the ASF."
>
> I think it's ok at the moment to have the links for the binary .jars
> point to m2 central because they're not really official ASF releases -
> we do it as a convenience.  Although it would be a little nicer to
> have all of our artifacts hosted by the ASF: someone has to pay the
> download bandwidth costs, and it'd be better if the ASF (or one of
> it's agreed mirror partners) did that instead of us passing the bill
> transparently to Sonatype.  Just a thought...
>
> Cheers,
>
> Les

Craig L Russell
Architect, Oracle
http://db.apache.org/jdo
408 276-5638 mailto:Craig.Russell@oracle.com
P.S. A good JDO? O, Gasp!

Re: Shiro artifact distribution

[Kalle Korhonen <ka...@gmail.com>]

On Tue, Aug 17, 2010 at 12:10 PM, Les Hazlewood <lh...@apache.org> wrote:
>> From my reading of the release documentation either is fine. As a TLP
>> I don't think we have a strict requirement to publish to /dist, it's
>> just an option. However, Clutch checks for the existence of release
>> artifacts at /dist so we better keep the duplicates there. Going
>> forward, I don't think we need to worry about cgi scripts for using
>> mirros either, central is already load-balanced (and proxied and
>> cached).
> We unfortunately can't use m2 central as our primary distribution
> source since that is not considered ASF infrastructure.  At least
> according to the publishing page:
> "The Apache infrastructure must be the primary source for all
> artifacts officially released by the ASF."

Right, ok I see now why you had the links originally pointing at the
repository.apache.org. Pointing to /dist instead would solve that
problem.

> I think it's ok at the moment to have the links for the binary .jars
> point to m2 central because they're not really official ASF releases -
> we do it as a convenience.  Although it would be a little nicer to
> have all of our artifacts hosted by the ASF: someone has to pay the
> download bandwidth costs, and it'd be better if the ASF (or one of
> it's agreed mirror partners) did that instead of us passing the bill
> transparently to Sonatype.  Just a thought...

We can figure out how to best use and integrate publishing to the
/dist as a TLP later, but because we are a library project (as opposed
to an application such as Tomcat), I'm pretty certain that most people
will get the libs from Central even if we have them available
somewhere else. Sonatype has a vested interest in seeing Maven succeed
and if people get the jars directly from Central they are much leaner
(and will be cached) than the single source distro zip, so I doubt
Sonatype has that much of a problem with it.

Kalle

PS. Making the release with Maven was a pleasure. I can see how it
might have been tripping up and annoying lots of non-Maven-built
Apache projects before us and obviously it helped that I've done the
same several times over with different Maven projects but overall,
it's about as streamlined as it currently can be.

Re: Shiro artifact distribution

[Les Hazlewood <lh...@apache.org>]

> From my reading of the release documentation either is fine. As a TLP
> I don't think we have a strict requirement to publish to /dist, it's
> just an option. However, Clutch checks for the existence of release
> artifacts at /dist so we better keep the duplicates there. Going
> forward, I don't think we need to worry about cgi scripts for using
> mirros either, central is already load-balanced (and proxied and
> cached).

We unfortunately can't use m2 central as our primary distribution
source since that is not considered ASF infrastructure.  At least
according to the publishing page:

"The Apache infrastructure must be the primary source for all
artifacts officially released by the ASF."

I think it's ok at the moment to have the links for the binary .jars
point to m2 central because they're not really official ASF releases -
we do it as a convenience.  Although it would be a little nicer to
have all of our artifacts hosted by the ASF: someone has to pay the
download bandwidth costs, and it'd be better if the ASF (or one of
it's agreed mirror partners) did that instead of us passing the bill
transparently to Sonatype.  Just a thought...

Cheers,

Les

Re: Shiro artifact distribution

[Kalle Korhonen <ka...@gmail.com>]

On Tue, Aug 17, 2010 at 11:29 AM, Les Hazlewood <lh...@apache.org> wrote:
> Yes, it did slip - and don't worry, I didn't do anything :)
> I'll have to go back through the release threads - is there something
> that you used that automates copying the resources to that location?

No, I just manually copied them over.

> Also, just out of curiosity, why do we publish there instead of the
> mentioned location in the release-publishing.html page?

Hmm... that's the exact dist location. As of now, we are a sub-project
of the incubator so we publish under Incubator's dist location like
all of the other Incubator projects, and as a Maven-based project we
also publish to repository.apache.org as well (which is synched to
Central).

> In any event, I'll change the wiki links to point to these artifacts
> instead of the m2 repo.

>From my reading of the release documentation either is fine. As a TLP
I don't think we have a strict requirement to publish to /dist, it's
just an option. However, Clutch checks for the existence of release
artifacts at /dist so we better keep the duplicates there. Going
forward, I don't think we need to worry about cgi scripts for using
mirros either, central is already load-balanced (and proxied and
cached).

Kalle


> On Tue, Aug 17, 2010 at 10:49 AM, Kalle Korhonen
> <ka...@gmail.com> wrote:
>> Hold your horses - I did that as well when I made the release. The
>> official incubator distribution area for our project is at
>> http://www.apache.org/dist/incubator/shiro/, see the files there. I'm
>> sure I mentioned this at the release time but perhaps slipped through
>> your eyes.
>>
>> Kalle
>>
>>
>> On Tue, Aug 17, 2010 at 10:35 AM, Les Hazlewood <lh...@apache.org> wrote:
>>> Per the Incubator list, we need to ensure our source distribution
>>> comes from Apache's mirrored infrastructure.  Kalle, I noticed that
>>> you changed the links in the meantime to point to the m2 repo
>>> (thanks), but we're mandated to distribute from the ASF
>>> infrastructure.  The links to the .jars point to m2 as a convenience,
>>> but since they're not a source distro, the ASF doesn't care about them
>>> as much - we just can't do that with our source distro.
>>>
>>> I was just going to place them in a directory under the 'static'
>>> directory of our website on people.apache.org.  At least this is what
>>> is recommended by [1].  Any objections?
>>>
>>> Les
>>>
>>> [1] http://www.apache.org/dev/release-publishing.html#distribution
>>>
>>
>

Re: Shiro artifact distribution

[Les Hazlewood <lh...@apache.org>]

Yes, it did slip - and don't worry, I didn't do anything :)

I'll have to go back through the release threads - is there something
that you used that automates copying the resources to that location?
Also, just out of curiosity, why do we publish there instead of the
mentioned location in the release-publishing.html page?

In any event, I'll change the wiki links to point to these artifacts
instead of the m2 repo.

Thanks,

Les

On Tue, Aug 17, 2010 at 10:49 AM, Kalle Korhonen
<ka...@gmail.com> wrote:
> Hold your horses - I did that as well when I made the release. The
> official incubator distribution area for our project is at
> http://www.apache.org/dist/incubator/shiro/, see the files there. I'm
> sure I mentioned this at the release time but perhaps slipped through
> your eyes.
>
> Kalle
>
>
> On Tue, Aug 17, 2010 at 10:35 AM, Les Hazlewood <lh...@apache.org> wrote:
>> Per the Incubator list, we need to ensure our source distribution
>> comes from Apache's mirrored infrastructure.  Kalle, I noticed that
>> you changed the links in the meantime to point to the m2 repo
>> (thanks), but we're mandated to distribute from the ASF
>> infrastructure.  The links to the .jars point to m2 as a convenience,
>> but since they're not a source distro, the ASF doesn't care about them
>> as much - we just can't do that with our source distro.
>>
>> I was just going to place them in a directory under the 'static'
>> directory of our website on people.apache.org.  At least this is what
>> is recommended by [1].  Any objections?
>>
>> Les
>>
>> [1] http://www.apache.org/dev/release-publishing.html#distribution
>>
>

Re: Shiro artifact distribution

[Kalle Korhonen <ka...@gmail.com>]

Hold your horses - I did that as well when I made the release. The
official incubator distribution area for our project is at
http://www.apache.org/dist/incubator/shiro/, see the files there. I'm
sure I mentioned this at the release time but perhaps slipped through
your eyes.

Kalle


On Tue, Aug 17, 2010 at 10:35 AM, Les Hazlewood <lh...@apache.org> wrote:
> Per the Incubator list, we need to ensure our source distribution
> comes from Apache's mirrored infrastructure.  Kalle, I noticed that
> you changed the links in the meantime to point to the m2 repo
> (thanks), but we're mandated to distribute from the ASF
> infrastructure.  The links to the .jars point to m2 as a convenience,
> but since they're not a source distro, the ASF doesn't care about them
> as much - we just can't do that with our source distro.
>
> I was just going to place them in a directory under the 'static'
> directory of our website on people.apache.org.  At least this is what
> is recommended by [1].  Any objections?
>
> Les
>
> [1] http://www.apache.org/dev/release-publishing.html#distribution
>