Jukka Zitting wrote:
>
> The vote ends with the following 15 +1, 12 -1, and one 0 binding votes.
>
> This is a slight majority (of binding votes) for accepting the
> proposed change, but given the clear lack of consensus and the
> concerns voiced about that, I unfortunately need to conclude that this
> issue should be tabled until better consensus is reached.
Nonsense. That's as if to say [VOTE] was actually supposed to be [POLL].
A decision, however frustrating, has been reached. I suspect some would
prefer the choice against their preference just be implemented, over having
this thread persist ad infinitum.
This is a contentious issue. Mostly, because the change - from pseudo
incubator release artifacts in a non-release location - into proper
releases available from www.a.o/dist/incubator/ - was never reflected
in other relevant policies. In hindsight, it's clear they were.
RAT and other methodologies helped us validate the legal aspects of
the ASF releases to the point that this is not uncomfortable anymore.
> The main impression I got from the related discussion is that the main
> concern is not that much the security or transparency of the Maven
> repository but rather the status of incubating releases in general.
Of which we have two; released, or not released, and that's a product
of oversight and a [VOTE]. There are no magical in-betweens. There
are other artifacts, of course. Snapshots are not released. Nightly
builds are not released. Source packages are our official releases.
Binaries are also released when built from release source packages.
> Are incubating releases official releases of the ASF?
Yes. Otherwise they must be removed from ASF servers. There's no
middle ground.
> Does the ASF
> "endorse" these releases, and what does that endorsement mean?
yes...
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
> How strong disclaimers are needed and what level of explicit
> acknowledgement from users is required?
how much more explicit do you want? Well, we've added that a disclaimer
in the package (not a click-through requirement) that this is an incubating
artifact, and each has a naming convention of {podling}-incubating.
Most folks main complaint is that incubator makes things more complicated
than they are or need to be. Why help to persist that modus operandi, or
subvert the decision of the list?
I liked the way you put the question; it's not up to incubator project to
set the rules for Maven. If the maven PMC decides that these incubator
releases don't belong in the primary repository, that's their call. But
this vote makes clear that the incubator has nothing to say about an
artifact's distribution once the release vote is finalized.
Please remember the earliest examples, where IBM distributed the very
earliest Geronimo incubating releases through other channels, as was
their right do so. Let's call this decision on "Allow extra release
distribution channels" approved 15:12, let people who want to use
the Maven channel take this thread up with Maven folks, and let this
thread die at last.
Bill
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
