Re: Gradle et al

--=-HJtjOQ1PtEDYZtmjJxmS
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, 2018-01-10 at 21:36 +0000, Matthew Toseland wrote:
> On 10/01/18 21:15, Florent Daigniere wrote:
> > On Wed, 2018-01-10 at 21:10 +0000, Matthew Toseland wrote:
> > > So what is going on, and why?
> > >=20
> > >=20
> >=20
> > What's happening is that Arne is refusing to move forward... and
> > keeps
> > releasing off the old release tools and Ant.
> >=20
> > The rest of the team has been working on next (I've done most of the
> > current gradle support, including deterministic builds, ... steve
> > has
> > been working on the release tools, ...)=20
>=20
> So you are checking the hashes of the downloaded components?
>=20
> I thought Gradle was just an evolution of Maven, with all the problems
> that implies: Recursively pulling random JAR files, with very little
> authentication, pay-for-only signature checking, and a guarantee that
> everyone who uploaded those JARs hasn't paid for that feature. In
> other
> words, malware galore.
>=20
> If that's the world that Gradle takes Freenet into, then I can
> entirely
> understand why Arne would have a problem with it.
> >=20

We do check the hashes of downloaded components... and produce
reproducible jars by default.
https://github.com/freenet/fred/blob/next/build.gradle#L227

Security is clearly not the concern here.

Florent
--=-HJtjOQ1PtEDYZtmjJxmS
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----

iQEzBAABCAAdFiEE27dzODvDSclSA+2R6sXr8HqpwqMFAlpWitAACgkQ6sXr8Hqp
wqOMnAf/X6OZ8Ingr8op9/1qwxURpv7PIlsWAsrTf8qCF+nhlMvc9F3L/rlSSVjr
IfbYlkw6cjeU0X3S7+FfW6m2wowNhEG+HyZ+h61WddD554Ej7U6h+pIEQGV+oFDz
DJl5eehOB1Q69n/rrHjindDY+uDJddGi6gCs3W6aTJOV6s5XXOfV9/vSP5UcVT7Z
Ar6Eig6bBsTZTSdteF+njJxqJTbBPjnE4RJPkyiGKlvvSsXPFcAe5JfAXg5Ue4zH
fY2BlKBPiVRCt/WKF6c/DfSHi41dGiMEp5KI4ZbMWiYbDqPVtw6qNdWIKBYJGJnA
8GQrat4JC8hMgjzn3s1C/NynEJD0Kg==
=UwBO
-----END PGP SIGNATURE-----

--=-HJtjOQ1PtEDYZtmjJxmS--