Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove the promoted releases repo and functionality #415

Closed
tobias opened this issue Nov 15, 2015 · 2 comments
Closed

Remove the promoted releases repo and functionality #415

tobias opened this issue Nov 15, 2015 · 2 comments

Comments

@tobias
Copy link
Member

tobias commented Nov 15, 2015

Possibly drop it, as very few people use it, and it leads to confusion about what promotion means.

@tobias
Copy link
Member Author

tobias commented Nov 19, 2015

Or, investigate using the promoted feature as an avenue for pushing artifacts in to maven central. That would mean additional requirements for the release (signed -source and -javadoc jars, for one), and would require jumping through the hoops to become an org that can sync to central. http://central.sonatype.org/pages/producers.html#large-organizationsforges-repository-sync

@tobias tobias changed the title Consider dropping the promoted releases repo and functionality Reevaluate the promoted releases repo and functionality Nov 19, 2015
@tobias
Copy link
Member Author

tobias commented Dec 30, 2015

After giving this some more thought, I think we should do away with
the releases repo entirely. The goal was to provide a repo that:

  1. was immutable
  2. had signed artifacts
  3. required metadata for each artifact (url, license info, description, scm info)
  4. didn't allow snapshots

Since the releases repo was created, the "classic" repo has become
immutable (barring deletion requests, which affected the releases repo
as well).

For requiring signed artifacts, the promotion process verifies that
the project artifacts are signed, but does not verify any transitive
dependencies. A better approach would be to use tools like
lein deps :verify to check the signature status, since that will walk
the full dependency tree. I don't think boot supports this yet, but it
seems like it could be added as an option to the show task.

For the metadata, I think it might be useful to provide a report div
to the show page that had a checklist of these items. Or at least
display the license, as I believe the rest of the data is available on
the page.

For snapshots, since we don't require all transitive deps to be in the
releases repo, users will most likely need additional repos (which
would most likely be the classic repo), so we can't guarantee there
are no snapshots in the tree. If a user is really concerned about
them, they should be checking their dep tree anyway.

tobias added a commit that referenced this issue Dec 30, 2015
This is the first step in disabling promotion permanently. see #415
tobias added a commit that referenced this issue Jan 17, 2016
@tobias tobias changed the title Reevaluate the promoted releases repo and functionality Remove the promoted releases repo and functionality Jan 17, 2016
@tobias tobias closed this as completed Jan 17, 2016
tobias added a commit to technomancy/leiningen that referenced this issue Jan 23, 2016
The clojars section is out of date - clojars no longer has promotion to a releases repo, so no longer needs to store the user's public key. See clojars/clojars-web#415.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant