{"action":"created","issue":{"url":"https://api.github.com/repos/clojars/clojars-web/issues/415","labels_url":"https://api.github.com/repos/clojars/clojars-web/issues/415/labels{/name}","comments_url":"https://api.github.com/repos/clojars/clojars-web/issues/415/comments","events_url":"https://api.github.com/repos/clojars/clojars-web/issues/415/events","html_url":"https://github.com/clojars/clojars-web/issues/415","id":116966274,"number":415,"title":"Reevaluate the promoted releases repo and functionality","user":{"login":"tobias","id":2631,"avatar_url":"https://avatars.githubusercontent.com/u/2631?v=3","gravatar_id":"","url":"https://api.github.com/users/tobias","html_url":"https://github.com/tobias","followers_url":"https://api.github.com/users/tobias/followers","following_url":"https://api.github.com/users/tobias/following{/other_user}","gists_url":"https://api.github.com/users/tobias/gists{/gist_id}","starred_url":"https://api.github.com/users/tobias/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tobias/subscriptions","organizations_url":"https://api.github.com/users/tobias/orgs","repos_url":"https://api.github.com/users/tobias/repos","events_url":"https://api.github.com/users/tobias/events{/privacy}","received_events_url":"https://api.github.com/users/tobias/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-11-15T01:48:48Z","updated_at":"2015-12-30T03:49:23Z","closed_at":null,"body":"Possibly drop it, as very few people use it, and it leads to confusion about what promotion means."},"comment":{"url":"https://api.github.com/repos/clojars/clojars-web/issues/comments/167932198","html_url":"https://github.com/clojars/clojars-web/issues/415#issuecomment-167932198","issue_url":"https://api.github.com/repos/clojars/clojars-web/issues/415","id":167932198,"user":{"login":"tobias","id":2631,"avatar_url":"https://avatars.githubusercontent.com/u/2631?v=3","gravatar_id":"","url":"https://api.github.com/users/tobias","html_url":"https://github.com/tobias","followers_url":"https://api.github.com/users/tobias/followers","following_url":"https://api.github.com/users/tobias/following{/other_user}","gists_url":"https://api.github.com/users/tobias/gists{/gist_id}","starred_url":"https://api.github.com/users/tobias/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tobias/subscriptions","organizations_url":"https://api.github.com/users/tobias/orgs","repos_url":"https://api.github.com/users/tobias/repos","events_url":"https://api.github.com/users/tobias/events{/privacy}","received_events_url":"https://api.github.com/users/tobias/received_events","type":"User","site_admin":false},"created_at":"2015-12-30T03:49:23Z","updated_at":"2015-12-30T03:49:23Z","body":"After giving this some more thought, I think we should do away with\r\nthe releases repo entirely. The goal was to provide a repo that:\r\n\r\n1) was immutable\r\n2) had signed artifacts\r\n3) required metadata for each artifact (url, license info, description, scm info)\r\n4) didn't allow snapshots\r\n\r\nSince the releases repo was created, the \"classic\" repo has become\r\nimmutable (barring deletion requests, which affected the releases repo\r\nas well).\r\n\r\nFor requiring signed artifacts, the promotion process verifies that\r\nthe project artifacts are signed, but does not verify any transitive\r\ndependencies. A better approach would be to use tools like `lein deps\r\n:verify` to check the signature status, since that will walk the full\r\ndependency tree. I don't think boot supports this yet, but it seems\r\nlike it could be added as an option to the `show` task.\r\n\r\nFor the metadata, I think it might be useful to provide a report div\r\nto the show page that had a checklist of these items. Or at least\r\ndisplay the license, as I believe the rest of the data is available on\r\nthe page.\r\n\r\nFor snapshots, since we don't require all transitive deps to be in the\r\nreleases repo, users will most likely need additional repos (which\r\nwould most likely be the classic repo), so we can't guarantee there\r\nare no snapshots in the tree. If a user is really concerned about\r\nthem, they should be checking their dep tree anyway.\r\n\r\n"}}