On Wed, Jul 8, 2009 at 10:23 PM, Daniel Kulp <dk...@apache.org> wrote:
> On Wed July 8 2009 4:13:24 pm Benjamin Bentmann wrote: > > Paul Gier wrote: > > > One issue that will need to be resolved before we can sync, is how to > > > handle our rebuilt thirdparty jars. For example, if a jboss project > > > needs to patch some thirdparty jar, rebuild it, and upload it to our > > > repository > > > > AFAIK, somebody building a patched third-party artifact is supposed to > > not deploy this derived artifact with its original group id but with the > > group id of the patch creator. So if JBoss creates a patched version of > > say log4j, it would need to get deployed with org.jboss:log4j or > > similar. This should be allowed to get synced into central as it can be > > distinguished from the original log4j:log4j artifact of the project > owner. > > Except there THEN becomes the issue if someone depends on the normal log4j > artifact as well as some JBoss artifact that then transitively pulls in > org.jboss:log4j, they end up with two versions of log4j on the classpath > with > all kinds of non-fun things happening. > > Dan yes it was the case I had in mind Arnaud
