build: align release setup and Apache notices #5

2026-09-30T15:52:04Z

KofTwentyTwo commented

2026-09-30 15:52:04 +00:00

(Migrated from github.com)

Pin the QQQ orb to0.6.8 to keep Maven settings out of setup/deploy logs, align first-party declarations with Apache-2.0, and package each consuming project's exact LICENSE/NOTICE through shared Maven archive resources. Nested consumers can identify their repository root explicitly. Preserve attribution, existing resources, dependency/version pins and immutable published artifacts. Refs QRun-IO/qqq-all#10, QRun-IO/qqq#923 and QRun-IO/qqq#944.

Independent reviews passed for CI, licensing and packaging changes. Earlier parent Maven verify/effective-POM checks passed; the parent is POM-only. New packaging verification built all eight QBits against the changed parent in an isolated cache:36applicable main/source/test/Javadoc archives contain exact own notices and retain existing payloads. Baseline archives fail; negative controls reject invalid notices. This private-cache substitution verifies inheritance, not a new public parent version. Consumers must adopt a newly published successor through the release chain before public correction is claimed. The archive guard is manual and documented. Exact-head hosted checks and required eligible GitHub review remain before merge.

Pin the QQQ orb to0.6.8 to keep Maven settings out of setup/deploy logs, align first-party declarations with Apache-2.0, and package each consuming project's exact LICENSE/NOTICE through shared Maven archive resources. Nested consumers can identify their repository root explicitly. Preserve attribution, existing resources, dependency/version pins and immutable published artifacts. Refs QRun-IO/qqq-all#10, QRun-IO/qqq#923 and QRun-IO/qqq#944. Independent reviews passed for CI, licensing and packaging changes. Earlier parent Maven verify/effective-POM checks passed; the parent is POM-only. New packaging verification built all eight QBits against the changed parent in an isolated cache:36applicable main/source/test/Javadoc archives contain exact own notices and retain existing payloads. Baseline archives fail; negative controls reject invalid notices. This private-cache substitution verifies inheritance, not a new public parent version. Consumers must adopt a newly published successor through the release chain before public correction is claimed. The archive guard is manual and documented. Exact-head hosted checks and required eligible GitHub review remain before merge.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-bom#5