Yes, Mikael told us that the question of what should be the signing level for Che project must be discussed with the PMC;
As initial step, we propose to sign only our own JARs and rely on IP Checks and CQ for the third-part ones.
Stévan
Stevan:
Is this question for the pmc? Usually the role of the pmc is to only +1 or -1 a specific cq or release plan. I do not see how the pmc is structured to answer a question that has shades of gray and a range of potential answers.
I would expect the ip team at eclipse to tell the pmc the expectations. -Tyler On Tue, Mar 15, 2016 at 3:53 AM -0700, "Stevan Le Meur" <stevan.lemeur@xxxxxxxxx> wrote:
Dear PMC,
We had a discussion this morning with Mikael about the signing procedure we should follow for Che.
As you know Che is a bit different from other Eclipse projects, in the sense that we have bundle archives with a lot of JARs:
(1)- most of the JARs are ours and those JARs, should definitely be signed;
(2)- we are bundling other JARs from third-part, such as Tomcat for example, those have already valid IP Check and proper CQs.
The question we have is how far we should go in the process of signing the JARs that we have into our bundled archives?
Should we sign the third-part JARs (2) or only our own JARs (1) will be enough?
Thanks in advance,
Stévan
_______________________________________________
ecd-pmc mailing list
ecd-pmc@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://dev.eclipse.org/mailman/listinfo/ecd-pmc
_______________________________________________ ecd-pmc mailing list ecd-pmc@xxxxxxxxxxxTo change your delivery options, retrieve your password, or unsubscribe from this list, visit https://dev.eclipse.org/mailman/listinfo/ecd-pmc
|
