[LEGAL-323] Clarify if binary artifacts are part of a release

• Type: Question
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Assignee: Chris A. Mattmann
• Reporter: Andrew Wang
• Created: 31/Jul/17 23:11
• Updated: 23/Jun/20 07:53
• Resolved: 09/Aug/17 17:05

Description

Hi,

Reading the release policy and particularly http://www.apache.org/legal/release-policy.html#compiled-packages I'm still confused as to whether binary artifacts are considered part of a release.

The Apache Software Foundation produces open source software. All releases are in the form of the source materials needed to make changes to the software being released.

As a convenience to users that might not have the appropriate tools to build a compiled version of the source, binary/bytecode packages MAY be distributed alongside official Apache releases.

This seems to imply that only the source is the official release. Binary artifacts are not part of the release, and are just distributed on the side.

Reading the rest of this page though, it's pretty clear that binary artifacts still need to adhere to the requirements for release artifacts, e.g. licensing and distribution location.

What does this mean in practical terms? If we build a tarball with jars and native libraries in it, is it part of our official release? What about jars uploaded to Maven Central? When the PMC votes on a release, are we voting on just the source tarball, or also these additional binary artifacts?

Thanks,
Andrew

Issue Links

• relates to: LEGAL-437 Optional GPL dependencies in Docker images
• relates to: LEGAL-270 Official Docker Image support in ASF project
• relates to: LEGAL-427 Released artifacts with code stored outside the Apache repositories
• relates to: LEGAL-488 Bundling GPL+CPE (OpenJDK) into convenience binaries.
• relates to: LEGAL-489 Distributing javac (GPLv2+CPE) with Apache NetBeans convenience binaries
• relates to: LEGAL-503 Licenses for Beam distributed containers