You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@echarts.apache.org by Justin Mclean <jm...@apache.org> on 2019/02/02 23:28:32 UTC
Re: ECharts incubator report
Hi,
I can see that nothing has been done about [1]. The PPMC cannot provide unapproved releases to the general public in this manner. [2] All releases must be approved by the PPMC and IPMC while in incubation. As the VP of the Apache Incubator I'm asking you to please remove this unapproved release and any others you have made public since starting graduation.
If you can come up with another solution that complies with the ASF release policy I'm willing to listen to it.
Thanks,
Justin
V.P. Incubator
1. https://www.npmjs.com/package/echarts
2. http://www.apache.org/legal/release-policy.html#release-approval
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@echarts.apache.org
For additional commands, e-mail: dev-help@echarts.apache.org
Re: ECharts incubator report
Posted by Ovilia <ov...@gmail.com>.
Thanks Clement.
Yes, I think we and Justin have reached such a consensus that we should use
npm tag for rc releases. What we are discussing about is what we should do
to the previous version 4.2.0-rc1, which was published without the rc tag
since we didn't know the method yet.
Zhang Wenli
http://zhangwenli.com
On Sun, Feb 3, 2019 at 7:52 AM Clement Ho <cl...@gitlab.com.invalid>
wrote:
> I just want to note that another popular apache project, cordova seems to
> publish nightly builds to npm (
> https://www.npmjs.com/package/cordova)
>
> But it does look like the ‘latest’ tag is always set to the approved
> release for public use. Perhaps echarts can mimic their exact model?
>
> Clement
>
> On Sun, Feb 3, 2019 at 7:28 AM Justin Mclean <jm...@apache.org> wrote:
>
> > Hi,
> >
> > I can see that nothing has been done about [1]. The PPMC cannot provide
> > unapproved releases to the general public in this manner. [2] All
> releases
> > must be approved by the PPMC and IPMC while in incubation. As the VP of
> the
> > Apache Incubator I'm asking you to please remove this unapproved release
> > and any others you have made public since starting graduation.
> >
> > If you can come up with another solution that complies with the ASF
> > release policy I'm willing to listen to it.
> >
> > Thanks,
> > Justin
> > V.P. Incubator
> >
> > 1. https://www.npmjs.com/package/echarts
> > 2. http://www.apache.org/legal/release-policy.html#release-approval
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@echarts.apache.org
> > For additional commands, e-mail: dev-help@echarts.apache.org
> >
> >
>
Re: ECharts incubator report
Posted by Ovilia <ov...@gmail.com>.
Using "rc" tag for release candidates seems to be a reasonable choice, in
which case developers need to explicitly use "npm install echarts@rc" to
use the rc version. I think Justin has no objection to this, right?
But our main controversy lies on what to do with v4.2.0-rc1, which has
already been published to "latest" and can be accessed by "npm install".
The reasons were stated clearly in previous emails.
We would like to get some advice from mentors that whether there could be
some way to prevent the mess caused by unpublishing an rc version without a
new correct version, and whether it is necessary for us to ask ASF board
about it.
Zhang Wenli
http://zhangwenli.com
On Sun, Feb 3, 2019 at 1:40 PM Dave Fisher <da...@comcast.net> wrote:
> Please do not use Cordova as an example of a conforming project.
>
> Let’s discuss how to properly use of npm and staying where snapshots
> require explicit user choice.
>
> Regards,
> Dave
>
> Sent from my iPhone
>
> > On Feb 2, 2019, at 3:52 PM, Clement Ho <cl...@gitlab.com.INVALID>
> wrote:
> >
> > I just want to note that another popular apache project, cordova seems to
> > publish nightly builds to npm (
> > https://www.npmjs.com/package/cordova)
> >
> > But it does look like the ‘latest’ tag is always set to the approved
> > release for public use. Perhaps echarts can mimic their exact model?
> >
> > Clement
> >
> >> On Sun, Feb 3, 2019 at 7:28 AM Justin Mclean <jm...@apache.org>
> wrote:
> >>
> >> Hi,
> >>
> >> I can see that nothing has been done about [1]. The PPMC cannot provide
> >> unapproved releases to the general public in this manner. [2] All
> releases
> >> must be approved by the PPMC and IPMC while in incubation. As the VP of
> the
> >> Apache Incubator I'm asking you to please remove this unapproved release
> >> and any others you have made public since starting graduation.
> >>
> >> If you can come up with another solution that complies with the ASF
> >> release policy I'm willing to listen to it.
> >>
> >> Thanks,
> >> Justin
> >> V.P. Incubator
> >>
> >> 1. https://www.npmjs.com/package/echarts
> >> 2. http://www.apache.org/legal/release-policy.html#release-approval
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: dev-unsubscribe@echarts.apache.org
> >> For additional commands, e-mail: dev-help@echarts.apache.org
> >>
> >>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@echarts.apache.org
> For additional commands, e-mail: dev-help@echarts.apache.org
>
>
Re: ECharts incubator report
Posted by Dave Fisher <da...@comcast.net>.
Please do not use Cordova as an example of a conforming project.
Let’s discuss how to properly use of npm and staying where snapshots require explicit user choice.
Regards,
Dave
Sent from my iPhone
> On Feb 2, 2019, at 3:52 PM, Clement Ho <cl...@gitlab.com.INVALID> wrote:
>
> I just want to note that another popular apache project, cordova seems to
> publish nightly builds to npm (
> https://www.npmjs.com/package/cordova)
>
> But it does look like the ‘latest’ tag is always set to the approved
> release for public use. Perhaps echarts can mimic their exact model?
>
> Clement
>
>> On Sun, Feb 3, 2019 at 7:28 AM Justin Mclean <jm...@apache.org> wrote:
>>
>> Hi,
>>
>> I can see that nothing has been done about [1]. The PPMC cannot provide
>> unapproved releases to the general public in this manner. [2] All releases
>> must be approved by the PPMC and IPMC while in incubation. As the VP of the
>> Apache Incubator I'm asking you to please remove this unapproved release
>> and any others you have made public since starting graduation.
>>
>> If you can come up with another solution that complies with the ASF
>> release policy I'm willing to listen to it.
>>
>> Thanks,
>> Justin
>> V.P. Incubator
>>
>> 1. https://www.npmjs.com/package/echarts
>> 2. http://www.apache.org/legal/release-policy.html#release-approval
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@echarts.apache.org
>> For additional commands, e-mail: dev-help@echarts.apache.org
>>
>>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@echarts.apache.org
For additional commands, e-mail: dev-help@echarts.apache.org
Re: ECharts incubator report
Posted by Clement Ho <cl...@gitlab.com.INVALID>.
I just want to note that another popular apache project, cordova seems to
publish nightly builds to npm (
https://www.npmjs.com/package/cordova)
But it does look like the ‘latest’ tag is always set to the approved
release for public use. Perhaps echarts can mimic their exact model?
Clement
On Sun, Feb 3, 2019 at 7:28 AM Justin Mclean <jm...@apache.org> wrote:
> Hi,
>
> I can see that nothing has been done about [1]. The PPMC cannot provide
> unapproved releases to the general public in this manner. [2] All releases
> must be approved by the PPMC and IPMC while in incubation. As the VP of the
> Apache Incubator I'm asking you to please remove this unapproved release
> and any others you have made public since starting graduation.
>
> If you can come up with another solution that complies with the ASF
> release policy I'm willing to listen to it.
>
> Thanks,
> Justin
> V.P. Incubator
>
> 1. https://www.npmjs.com/package/echarts
> 2. http://www.apache.org/legal/release-policy.html#release-approval
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@echarts.apache.org
> For additional commands, e-mail: dev-help@echarts.apache.org
>
>
Re: ECharts incubator report
Posted by "Kevin A. McGrail" <km...@apache.org>.
As a mentor, I've been following this. There is a legal concern here so
it is best if we get on the right track as soon as possible.
I understand removing things from npm is a PITA. But retagging is easy.
The biggest issue seems to be retagging the rc1. Can you get an rc2 or
ideally a proper release voted on and up on npm ASAP and then tag rc1 as
deprecated?
Is there concern about using the deprecated tag?
Even if rc2 is just a more formally voted release with a version change,
getting it up there and tagged with rc seems to be a good fix.
I would recommend not going to the board. That will just be discussed
and likely kicked back for more discussion causing you months of delay.
Regards,
KAM
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@echarts.apache.org
For additional commands, e-mail: dev-help@echarts.apache.org
Re: ECharts incubator report
Posted by Ovilia <ov...@gmail.com>.
Thanks Justin.
I think we should probably ask the ASF board about this.
In the meantime, could our mentors give some advice and opinions on this?
Zhang Wenli
http://zhangwenli.com
On Sun, Feb 3, 2019 at 12:32 PM Justin Mclean <jm...@apache.org> wrote:
> Hi,
>
> I sorry but what npm recommends is nothing to do with ASF release policy.
>
> > On the other hand, if a version is deprecated, it will give a warning to
> tell
> > the developers to update, which, in our case, is somewhat strange since
> we
> > don't have a newer correct version.
>
> Yes that is unfortunate but you need to follow ASF release policy. If you
> want an exception to this then you need to ask the ASF board.
>
> > So, the safest and best-for-all solution seems to be, releasing a correct
> > version with the permission of PPMC ASAP, which we are working on
> > currently. And after that, mark the 4.2.0-rc1 to be deprecated.
>
> I don't think that is the best course of action but discuss with your
> mentors and see what they say.
>
> > I think this way also benefits Apache's branding in saving a large number
> > of developers' confusion and complaints.
> > Could @Justin please help judge if this works with Apache?
>
> By putting out unapproved released you put the legal protections that the
> ASF have in place for your project and the ASF itself at risk. It's
> probably not a large risk but it's there all the same. Please read [1] so
> you understand why the ASF has a release policy and why we don't allow
> unapproved releases.
>
> Thanks,
> Justin
>
> 1. http://www.apache.org/legal/release-policy.html#why
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@echarts.apache.org
> For additional commands, e-mail: dev-help@echarts.apache.org
>
>
Re: ECharts incubator report
Posted by Clement Ho <cl...@gitlab.com.INVALID>.
In my prior experience working with unpublishing npm packages, the npm
support team will only let you deprecate packages when you are within a
certain download volume - which I think echarts would fit in that category.
At GitLab (where I work), we had to deprecate vs unpublishing and we had a
lower weekly download count than echarts.
On Sun, Feb 3, 2019 at 12:32 PM Justin Mclean <jm...@apache.org> wrote:
> Hi,
>
> I sorry but what npm recommends is nothing to do with ASF release policy.
>
> > On the other hand, if a version is deprecated, it will give a warning to
> tell
> > the developers to update, which, in our case, is somewhat strange since
> we
> > don't have a newer correct version.
>
> Yes that is unfortunate but you need to follow ASF release policy. If you
> want an exception to this then you need to ask the ASF board.
>
> > So, the safest and best-for-all solution seems to be, releasing a correct
> > version with the permission of PPMC ASAP, which we are working on
> > currently. And after that, mark the 4.2.0-rc1 to be deprecated.
>
> I don't think that is the best course of action but discuss with your
> mentors and see what they say.
>
> > I think this way also benefits Apache's branding in saving a large number
> > of developers' confusion and complaints.
> > Could @Justin please help judge if this works with Apache?
>
> By putting out unapproved released you put the legal protections that the
> ASF have in place for your project and the ASF itself at risk. It's
> probably not a large risk but it's there all the same. Please read [1] so
> you understand why the ASF has a release policy and why we don't allow
> unapproved releases.
>
> Thanks,
> Justin
>
> 1. http://www.apache.org/legal/release-policy.html#why
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@echarts.apache.org
> For additional commands, e-mail: dev-help@echarts.apache.org
>
>
Re: ECharts incubator report
Posted by Justin Mclean <jm...@apache.org>.
Hi,
I sorry but what npm recommends is nothing to do with ASF release policy.
> On the other hand, if a version is deprecated, it will give a warning to tell
> the developers to update, which, in our case, is somewhat strange since we
> don't have a newer correct version.
Yes that is unfortunate but you need to follow ASF release policy. If you want an exception to this then you need to ask the ASF board.
> So, the safest and best-for-all solution seems to be, releasing a correct
> version with the permission of PPMC ASAP, which we are working on
> currently. And after that, mark the 4.2.0-rc1 to be deprecated.
I don't think that is the best course of action but discuss with your mentors and see what they say.
> I think this way also benefits Apache's branding in saving a large number
> of developers' confusion and complaints.
> Could @Justin please help judge if this works with Apache?
By putting out unapproved released you put the legal protections that the ASF have in place for your project and the ASF itself at risk. It's probably not a large risk but it's there all the same. Please read [1] so you understand why the ASF has a release policy and why we don't allow unapproved releases.
Thanks,
Justin
1. http://www.apache.org/legal/release-policy.html#why
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@echarts.apache.org
For additional commands, e-mail: dev-help@echarts.apache.org
Re: ECharts incubator report
Posted by Ovilia <ov...@gmail.com>.
Hi Justin,
We are willing to deal with the latest released rc version problem.
As we can see from npm documentation [1], unpublishing is "generally
considered bad behavior to remove versions of a library that others are
depending on". And in our case, it is even more dangerous since ECharts has
more than 70,000 downloads, and we haven't provided a correct version after
that.
It's recommended to mark the previous rc version to be deprecated rather
than unpublish it [1][2]. And please note that
> With the default registry (registry.npmjs.org), unpublish is only allowed
> with versions published in the last 72 hours. If you are trying to
> unpublish a version published longer ago than that, contact
> support@npmjs.com. [1]
When a version is unpublished, if some projects have something like
`"echarts": "^4.2.0-rc1"` in their package.json, it will cause an error in
`npm install` step and bring confusion to a great number of developers. On
the other hand, if a version is deprecated, it will give a warning to tell
the developers to update, which, in our case, is somewhat strange since we
don't have a newer correct version.
So, the safest and best-for-all solution seems to be, releasing a correct
version with the permission of PPMC ASAP, which we are working on
currently. And after that, mark the 4.2.0-rc1 to be deprecated.
And we promise that all rc releases under npm in the future should go with
"rc" tag to prevent it from being "latest", and the default install way
"npm install" will use the latest version permitted by PPMC.
I think this way also benefits Apache's branding in saving a large number
of developers' confusion and complaints.
Could @Justin please help judge if this works with Apache?
BTW, we are going to have Chinese New Year from tomorrow till next week, so
slow email response is expected. Sorry for the inconvenience, and wish you
a happy new year!
[1] https://docs.npmjs.com/cli/unpublish
[2] https://docs.npmjs.com/cli/deprecate
Zhang Wenli
http://zhangwenli.com
On Sun, Feb 3, 2019 at 7:28 AM Justin Mclean <jm...@apache.org> wrote:
> Hi,
>
> I can see that nothing has been done about [1]. The PPMC cannot provide
> unapproved releases to the general public in this manner. [2] All releases
> must be approved by the PPMC and IPMC while in incubation. As the VP of the
> Apache Incubator I'm asking you to please remove this unapproved release
> and any others you have made public since starting graduation.
>
> If you can come up with another solution that complies with the ASF
> release policy I'm willing to listen to it.
>
> Thanks,
> Justin
> V.P. Incubator
>
> 1. https://www.npmjs.com/package/echarts
> 2. http://www.apache.org/legal/release-policy.html#release-approval
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@echarts.apache.org
> For additional commands, e-mail: dev-help@echarts.apache.org
>
>