Skip to main content

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [rt-pmc] Vert.x 2.1.0 release

well, last time I heard it talked about someone, I forget who and maybe it was on a CBI call, expressed concern that they had no way of knowing if the jars on maven central or metadata associated with them could be changed over time

the fact is that maven central is the defacto standard location for artifacts, and not just for maven but for a wide array of other build systems, the repo at eclipse is not useful when your intended goal is to release to maven central for the reasons that Joakim mentioned and for folks interested in a durable repository that doesn't change than orbit is not useful either, at least for artifacts that have not yet made it into an official release repository (non-release repositories end up disappearing which is an issue for folks that want a reproducible build from a 4 year old scm tag).

anyway, the issue has been talked about in depth and to death imo...someone needs to put funding behind solving the issue and that is outside of the scope of the RT group, for now we can only do the best we can in honoring and adhering to the policies of the eclipse foundation, a lot of progress has been made over the last few years...we were finally able to push out the jetty-maven-plugin from eclipse for Jetty 9 which was a big step (thanks in big part to the aether and m2eclipse projects running point on the CQ's).  so it is not a bleak picture at all, just a lengthy one.

cheers,
jesse

--
jesse mcconnell
jesse.mcconnell@xxxxxxxxx


On Wed, Mar 12, 2014 at 12:51 PM, Mike Milinkovich <mike.milinkovich@xxxxxxxxxxx> wrote:
On 12/03/2014 1:44 PM, Jesse McConnell wrote:
Eclipse IP has expressed concern historically about the integrity of the maven central repository.

I actually do not think that is an accurate statement. At least not if you take the sentence in isolation.

As far as I know, Eclipse does not have any concerns with the integrity of Maven Central. The issue is that there is no assurance that the jars pulled from Maven Central are the ones which were reviewed and approved by the IP team. There are also many projects at Eclipse which are relying on jar files which are a subset of the ones which are hosted on Maven Central. Those two issues combined are the reason we point project builds to repo.eclipse.org and Orbit.

I hope that helps.

_______________________________________________
rt-pmc mailing list
rt-pmc@xxxxxxxxxxx
https://dev.eclipse.org/mailman/listinfo/rt-pmc



Back to the top