Right usage of maven coordinates from Apache projects

[Christian Mueller <cm...@apache.org>]

Hello list!

Assume Apache Foo is publishing its artifacts to Maven central with the
coordinates
org.apache.foo:foo-core:1.0.0

Assume there is a company Bar who builds his product based on Apache Foo.
Do we allow Bar to publish its modified Apache Foo artifacts with the name
org.apache.foo:foo-core:1.0.0-bar-001
?

Make it a difference whether the artifacts are "only" published to a freely
accessible Maven repository maintained by Bar (and not to Maven central)?

Excuse me, if this is not the appropriate mailing list for such kind of
question and please forward me to the right one.

Thanks in advance,
Christian

Re: Right usage of maven coordinates from Apache projects

[Steve Loughran <st...@apache.org>]

On 5 August 2013 00:38, Mark Thomas <ma...@apache.org> wrote:

> On 04/08/2013 23:42, Christian Mueller wrote:
> > Hello list!
> >
> > Assume Apache Foo is publishing its artifacts to Maven central with the
> > coordinates
> > org.apache.foo:foo-core:1.0.0
> >
> > Assume there is a company Bar who builds his product based on Apache
> > Foo. Do we allow Bar to publish its modified Apache Foo artifacts with
> > the name
> > org.apache.foo:foo-core:1.0.0-bar-001
> > ?
>
> No. org.apache.* is for the ASF only. Anyone else publishing into the
> org.apache namespace would confuse end-users about the source of the
> software.
>

Except the source trees we provide come with Maven pom files that
explicitly generate artifacts and the metadata, and come with staging
support that can push it to your local  Apache Archiva server

And as the formal releases of an ASF project are only the source -not those
binaries- publishing the artifacts may nominally be a duty of the people
building it, rather than the ASF.

Why would you want to do that? To get downstream projects (inc ASF ones) to
pick up your artifacts simply by changing the repo and version  numbers,
instead of going through the entire dependency tree changing artifact names.


> > Make it a difference whether the artifacts are "only" published to a
> > freely accessible Maven repository maintained by Bar (and not to Maven
> > central)?
>
> No.
>
>
I'd be more relaxed here and say "internal only -but do use a different
version number to to make clear it is your build, as maven gets very
unhappy if there are conflicting versions".

I think there are some bits of a public SVN repo that contain versions of
Hadoop that I built up with some minor changes, like stripping out
log4j.properties

(pause, yes:)
http://smartfrog.svn.sourceforge.net/viewvc/smartfrog/trunk/core/antbuild/repository/

these are structured in a way that ivy can work with directly. So: are they
(a) a case where  someone  published ASF artifacts that they shouldn't
have, or (b) a case where someone exercised their right to do their own
forks of ASF code, then stuck it into a public Apache Subversion repo so
that anyone downstream doing a build of that OSS project got the
dependencies that it was built against.

Re: Right usage of maven coordinates from Apache projects

[Mark Thomas <ma...@apache.org>]

On 04/08/2013 23:42, Christian Mueller wrote:
> Hello list!
> 
> Assume Apache Foo is publishing its artifacts to Maven central with the
> coordinates
> org.apache.foo:foo-core:1.0.0
> 
> Assume there is a company Bar who builds his product based on Apache
> Foo. Do we allow Bar to publish its modified Apache Foo artifacts with
> the name
> org.apache.foo:foo-core:1.0.0-bar-001
> ?

No. org.apache.* is for the ASF only. Anyone else publishing into the
org.apache namespace would confuse end-users about the source of the
software.

> Make it a difference whether the artifacts are "only" published to a
> freely accessible Maven repository maintained by Bar (and not to Maven
> central)?

No.

> Excuse me, if this is not the appropriate mailing list for such kind of
> question and please forward me to the right one.

This belongs on (the private) trademarks@.a.o (I've moved it to that list)

I'm assuming that there is a specific issue here. If that is the case,
please make sure the details are made available to the private
trademarks@a.o list

Mark


---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org