January 12 Dev Call Agenda

[Chad La Joie]

Various reasons:

1. Not everything we need is reliably maintained in Maven central and we
are not going to take on the responsibility of making sure other
projects artifacts are properly maintained there.

2. Maven Central has no policies regarding who may upload artifacts for
a project.  I could, for example, go in an upload a hacked version of
some app that fed all its data to me.

3. Maven Central does not require signatures on artifacts nor check them
if they exist.

If the proposition is re-framed as follows it should become clear how
stupid the requirement is for everything to be in one central point.

All software on your computer must come from one single download site.
That site is not run by anyone associated with the software hosted on
that site.  The site allows anyone to upload anything and does not
perform any vetting on uploaded material.

Are you going to download and run any of that software?

Honestly, every time I think about this, I come closer and closer to
making it so that the Shib projects *only* pull from our repository and
never use Maven Central.

On 1/12/12 1:14 PM, Tom Zeller wrote:
> Just curious, why ? Not all dependencies are maven central-able ?
> 
> I imagine someone else will ask if not already, again.
> 
> On Thu, Jan 12, 2012 at 12:06 PM, Chad La Joie <lajoie at shibboleth.net> wrote:
>> We will not be, no.
>>
>> On 1/12/12 1:05 PM, Tom Zeller wrote:
>>>> + Release Processes (Everyone)
>>>
>>> Did anyone decide if someone will be publishing to maven central ?
>>>
>>> Some institutions required grouper to be published to maven central,
>>> because they would not add external repositories to their poms, I
>>> guess, but grouper uses an external repository for shibboleth, so I am
>>> not sure how folks are getting along.
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net