Le 08/10/14 14:21, Shawn McKinney a écrit : > On 10/08/2014 05:38 AM, Emmanuel Lécharny wrote: >> Typically, here are the info I'll need : >> - the code base URL, with a MD5/SHA checksum, at the very date of the >> donation (ie, if we have some modification after this date, then they >> should be retained and injected into teh code base when moved to The ASF >> repository. All in all, it's a matter of building a zip and sign it, and >> move it to a place we can download it (can be teh latest release, for >> instance) > > What date are we considering the donation date - today? Assuming it > is that, I will download latest snapshot from each of the four repos > (core, commander, enmasse, realm), sign, and then upload to one of our > file servers.
Well, the date is not important. What is important is that the zip you sign will be the one we will take the date from. What I meant was that you can't say "teh code is donated on april first" and provide a zip with source dating from may &stj, with many changes since 01/04. In other words, produce the zip, and we use the production date. > > On 10/08/2014 05:38 AM, Emmanuel Lécharny wrote: >> - a Corporate CLA (from Joshua tree and Symas) as to be fulfilled and >> sent to The ASF > > Yes, I will arrange this. Cool. > > On 10/08/2014 05:38 AM, Emmanuel Lécharny wrote: >> The list of all the people having worked on the code base, with their >> consent > > Again yes, no problem. Cool. > > > On 10/08/2014 05:38 AM, Emmanuel Lécharny wrote: >> The list of dependencies with their licence have to be checked to be >> sure they are compatible (ie, " Apache, BSD, Artistic, MIT/X, MIT/W3C, >> MPL 1.1, or something with essentially the same terms"). > > So here I am assuming the dependencies in the pom.xml are not > adequate. Rather we need to list the resolved dependencies, i.e. > located in the /lib folder, for each project. I will take care of > this too. Not sure if the dependencis are not adequate, we just have to be sure that all the dependencies have a compatible license. And of course, the dependencies they themselves depend on...
