incubator-general mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Rob Vesse <>
Subject Re: [DISCUSS] Communicating intent around non-release, downstream integration binary artifacts
Date Thu, 25 Jun 2015 09:45:01 GMT
On 24/06/2015 18:02, "Markus Weimer" <> wrote:

>> Personally I think the policy should be clarified such that nightly
>> MUST only live on ASF infrastructure (whether that be the Nexus
>> repo, committer web space etc).  As soon as you start putting them on
>> external services like DockerHub then they are potentially widely
>> to the general public.
>This is very tricky for projects outside the Java ecosystem. For .NET,
>NuGet is the established way to get packages, and the ASF doesn't
>provide a NuGet repository in the same way it does provide Maven

Sontatype Nexus Professional 2 onwards (which the ASF runs) supports NuGet
repositories so if ASF projects wanted to use that capability to
distribute pre-release builds then they should start a discussion with

>NuGet is just one example, each of the major language ecosystems now
>offers at least one (binary) artifact and dependency management
>approach. Following through on the above would mean either an incredible
>workload for the ASF to support it all, the exclusion of whole languages
>from ASF projects or treating some as second class citizens because
>their nightly builds wouldn't be testable. Neither of those strike me as
>great results.

Good points, ultimately I think I did not express what I meant precisely

Nightly builds generated by a project e.g. by a projects nightly build job
on Jenkins MUST live on ASF Infrastructure

If there is sufficient mass of projects needing a specific kind of
repository service available that isn't currently then there is nothing
stopping those projects from starting the appropriate discussions with
Infra as to whether such a service could be provided

OTOH individuals are free to do whatever they want without their ASF hats
on and publish their own personal nightly builds wherever and however they
want provided that they appropriately distinguish them from ASF actions
and releases.  However if individuals start publishing stuff to popular
public central repository services then clearly there is a danger of
confusion as to the source of the package(s).


>To unsubscribe, e-mail:
>For additional commands, e-mail:

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message