Re: Gradle et al

--FiRMSM1IDlp2OcwZQKO3KlcJq7x0OFGwn
Content-Type: multipart/mixed; boundary="Zuiq365GjLvIMYgslpw6oubX59JuiCN2L";
 protected-headers="v1"
From: Matthew Toseland <[email protected]>
To: [email protected]
Message-ID: <a0c12d2e-d92a-4fef-e0e7-48ae3145bc75-mtMkOSv53sdLEkozxzBd2w@public.gmane.org>
Subject: Re: Gradle et al
References: <c67d56b3-98b8-1f55-3dab-308a91b19892-mtMkOSv53sdLEkozxzBd2w@public.gmane.org>
 <1515618907.19118.3.camel-RdDMkVZAZeuJnvDnx1genB2eb7JE58TQ@public.gmane.org>
In-Reply-To: <1515618907.19118.3.camel-RdDMkVZAZeuJnvDnx1genB2eb7JE58TQ@public.gmane.org>

--Zuiq365GjLvIMYgslpw6oubX59JuiCN2L
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Language: en-GB

On 10/01/18 21:15, Florent Daigniere wrote:
> On Wed, 2018-01-10 at 21:10 +0000, Matthew Toseland wrote:
>> Could somebody summarise what the plans are, and what the reasons
>> behind
>> them are for:
>>
>> 1. Gradle,
>>
>> 2. Deployment/updating of JARs etc.
>>
>> I get the impression that this has been a major factor preventing
>> forward progress for over a year.
>>
>> This is particularly depressing given that more than five years ago I
>> implemented good auto-update support in fred, including the ability to=

>> update different files separately, add new jars and so on, all from
>> the
>> simple file dependencies.properties. It would be very easy to generate=

>> the last-resort update scripts from that, provided we can provide a
>> URL
>> to get each component from. Any third-party deployment system will
>> likely not work with Freenet, and even if it does, it won't work
>> reliably with Freenet when nearly anything except the transport layer
>> breaks (unlike the current system).
>>
>> If the goal is to split up freenet-ext.jar that's great, but again
>> that
>> is fundamentally very straightforward and does not require rewriting
>> all
>> the installers and depending on polling a third party web server.
>>
>> So what is going on, and why?
>>
>>
> What's happening is that Arne is refusing to move forward... and keeps
> releasing off the old release tools and Ant.
>
> The rest of the team has been working on next (I've done most of the
> current gradle support, including deterministic builds, ... steve has
> been working on the release tools, ...)=20

So you are checking the hashes of the downloaded components?

I thought Gradle was just an evolution of Maven, with all the problems
that implies: Recursively pulling random JAR files, with very little
authentication, pay-for-only signature checking, and a guarantee that
everyone who uploaded those JARs hasn't paid for that feature. In other
words, malware galore.

If that's the world that Gradle takes Freenet into, then I can entirely
understand why Arne would have a problem with it.
> On a personal level, I've given up. I'm not enjoying contributing as
> much as I used to (mostly because I waste my time argueing with Xor and=

> Arne)... so nothing is moving forward. Have a look to the diff of the
> last few released builds; it's depressing.
>
> Florent


--Zuiq365GjLvIMYgslpw6oubX59JuiCN2L--

--FiRMSM1IDlp2OcwZQKO3KlcJq7x0OFGwn
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEL+6nZPsebCYG+98xHO7XMXFdHncFAlpWh3cACgkQHO7XMXFd
Hne3DQ//bg/9G/AVlTzrLCJmfb5Oz/0AC7cHv2aMB37K0izAI8XPYGrOVmUC6Jrz
QujJEA1xhHFz57Wjb3Uy5S016WMKG0nZtivbKzCIq0RC3UUpMxQDx+dU6uFgIPgu
NW+FKGJZpyZrJXXF0KmYNyF9VNBSxsdFjBbEudJ5apM0Kx9jDS170u/5pYSybvTN
cqXrm+tsbPd9HFhM2DcKZsj8PV3BOlgzqzk8NRfyyTt7bmoUh3k6yNvYkpO9jn7/
2i/UZ9yLwUW+qdeJTIEfd2eiD9qu9AFFPug5tufLKx9RCz5xCgvIUIZXXMi78jUF
oCEji8g0cWk6AZcziBjoujMNAy3zaZpuu1ozH8SDNnzzx5HoexI02ZxnJpE4NZhN
HLx4j6iUL9u9tBPbnzhlInJuu2jyyKjsT1pXGBcIgwSSOmeEWKIumA+3eRgvFiaf
MMfxUgtodCmtx8bL3YivKzFRUDOv5BBBY+wnn5iN4R1SuswvijWGym5M4/F3hqP2
NV9QcA5Vm6wi1Ol4nyOG3iqOUEqCcTNC4yytcbVKszSUzbmp7paLeTckwG0vkrM4
JTD5XNi/ncbdNJrXf7+pvDQ3eOcIvTsuXby/dNQXktw19cG8b+JTZ6Ok4uvZ7Ahw
/ADr/jmUFjIm1lvy6BYedyR9rRGdG4Vw9qqgrwavf4RigLlXwAU=
=gAds
-----END PGP SIGNATURE-----

--FiRMSM1IDlp2OcwZQKO3KlcJq7x0OFGwn--