Dark clouds over Spring

Rod Johnson writes:

Source code will be published in the source repository. After 3 months SpringSource will continue make maintenance releases as needed to support our customers. There will be no tags in the repository corresponding to those releases.

Rod says in a clarification that the new policy “only affects those who are unwilling to go near source code”. But that is wrong.

The big change is that there will be no more bugfix releases available in binary form after three months AND there will be no tags in CVS. So there is no way to get bugfixes in a secure and maintainable fashion, unless you pay for it.

Here is a scenario from Daniel Fernández:

1. Spring 2.0 is released in Oct 3rd, 2006.

2. I find a bug in 2.0.2 (Jan 8th, 2007) which is important for me, and I report it.

3. Someone at SpringSource (or outside, it doesn’t matter) fixes it for 2.0.3 (Mar 9th, 2007).

4. As 2.0.3 was released more than 3 months after 2.0, I cannot have binaries for it.

5. Of course, I can checkout the source repository trunk, compile, and build but… I don’t have a tag, and I don’t have SpringSource’s “assessment” to know whether all parts will fit together, so I should consider this trunk unstable. This means, of course, that it will not go into my production systems. No bug fix for me.

6. Spring 2.5 is released on Nov 19th, 2007. More than 10 months after the last, buggy version I had the right to have (2.0.2).

You might be able to diff around in the CVS tree, but it will take ages to get to the fixes you need. And there will be no QA, other than the one you do for yourself.

A big change. I’m going to a Spring seminar on Wednesday. I hope there will be time to discuss this.