Dims, I have to disagree. The releases that we allow incubating
projects
to make, with three +1s and a majority approval, are full Apache
releases.
They have been officially approved by the foundation and we are 100%
responsible for their content. That's okay, because they also tend to
receive far more detailed inspection and thus are better quality and
more
conforming to our policies then our pre-incubator TLPs.
There is no reason for a separate repository. It certainly isn't
relevant
to a podling's desire to become a TLP -- that is more than adequately
compensated by the freedom from slow IPMC approvals and ability to host
their own website without the butt-ugly egg icon and disclaimers. A
separate repo does not help protect "users" from incubator code, since
users don't set the Maven configs that define which repos to use and
which modules are dependencies. At best, what it does is add an
irrelevant incubator layer on top of all Maven repo requests that masks
the "normal" repo path from developers, introduces another way to inject
insecure code, and wastes our bandwidth sending 404 responses to
automated build requests.
In contrast, if real incubator releases are allowed to be placed in the
normal Maven locations, then the incubating config does not mask the
normal Maven path, there is no need to send *all* repo requests to
incubator first, the project documentation for Maven doesn't have to
be a special-case, and releases are still subject to the same quality
controls as all Apache releases.
Regardless, the user never makes a decision regarding incubator code
in the Maven repo. The user is either going to pull the incubator
release directly and then build it using Maven with the provided pom,
or some other project is going to make a decision to add the artifact
(with incubator in its name) as a dependency. The Maven repo path is
irrelevant to the user's decisions -- it just changes the background
bit traffic and the load on our servers. In short, the policy is
just plain stupid (speaking as a C developer who builds a few
projects via Maven only a couple times a year).
Yes, it would be nice if Maven was more secure, properly checked
signatures, and properly delegated namespaces so that third-parties
would be unable to add artifacts within other org's trees. None of
those issues are specific to incubator.
....Roy
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
