Re: Gradle et al

--X6RB7Ex6yWMH9GOzj9MPkc9CW3ycUmHuO
Content-Type: multipart/mixed; boundary="VHsYD3O0iBtbLTDt3XhXPpJiFWrocunTO";
 protected-headers="v1"
From: Matthew Toseland <[email protected]>
To: [email protected]
Message-ID: <3b757786-9b63-f4a4-8f41-dc9e57f7c012-mtMkOSv53sdLEkozxzBd2w@public.gmane.org>
Subject: Re: Gradle et al
References: <c67d56b3-98b8-1f55-3dab-308a91b19892-mtMkOSv53sdLEkozxzBd2w@public.gmane.org>
 <1515618907.19118.3.camel-RdDMkVZAZeuJnvDnx1genB2eb7JE58TQ@public.gmane.org>
 <a0c12d2e-d92a-4fef-e0e7-48ae3145bc75-mtMkOSv53sdLEkozxzBd2w@public.gmane.org>
 <1515621072.19118.8.camel-RdDMkVZAZeuJnvDnx1genB2eb7JE58TQ@public.gmane.org>
In-Reply-To: <1515621072.19118.8.camel-RdDMkVZAZeuJnvDnx1genB2eb7JE58TQ@public.gmane.org>

--VHsYD3O0iBtbLTDt3XhXPpJiFWrocunTO
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Language: en-GB

On 10/01/18 21:51, Florent Daigniere wrote:
> On Wed, 2018-01-10 at 21:36 +0000, Matthew Toseland wrote:
>> On 10/01/18 21:15, Florent Daigniere wrote:
>>> On Wed, 2018-01-10 at 21:10 +0000, Matthew Toseland wrote:
>>>> So what is going on, and why?
>>>>
>>>>
>>> What's happening is that Arne is refusing to move forward... and
>>> keeps
>>> releasing off the old release tools and Ant.
>>>
>>> The rest of the team has been working on next (I've done most of the
>>> current gradle support, including deterministic builds, ... steve
>>> has
>>> been working on the release tools, ...)=20
>> So you are checking the hashes of the downloaded components?
>>
>> I thought Gradle was just an evolution of Maven, with all the problems=

>> that implies: Recursively pulling random JAR files, with very little
>> authentication, pay-for-only signature checking, and a guarantee that
>> everyone who uploaded those JARs hasn't paid for that feature. In
>> other
>> words, malware galore.
>>
>> If that's the world that Gradle takes Freenet into, then I can
>> entirely
>> understand why Arne would have a problem with it.
> We do check the hashes of downloaded components... and produce
> reproducible jars by default.
> https://github.com/freenet/fred/blob/next/build.gradle#L227
>
> Security is clearly not the concern here.

Annoying that it can't easily work over Freenet... but not a serious
concern, any HTTP(S) fetches can easily go via Tor etc.

What about the deployment side of the question?

I recall somebody arguing for getting rid of the installer and using
some third party packaging system instead? What is the status of that?


--VHsYD3O0iBtbLTDt3XhXPpJiFWrocunTO--

--X6RB7Ex6yWMH9GOzj9MPkc9CW3ycUmHuO
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEL+6nZPsebCYG+98xHO7XMXFdHncFAlpWj38ACgkQHO7XMXFd
HnfJbQ/+JcvgP6kYt1Rs3lbJvT7b95rG1l89beiKswKDGgKtCro8bXyLt/NXToED
tCLuPE1sCtI6ftTMohjA2iAi6p+12/leI0VU9tyahV+noicShGjPKaxq1yRacQiM
ze94zuym6ynhrsTIki9iEjKjyi+cbTVTl4lFtvGlfNKskYD/UGZTzA+IInQpq4OX
2gsjFXXvHYmeUMJATUKavpMUBE3k2wVE1Y193ys2mWATkf7gStseuZowJCyHVo6R
ekc0A8QRXjmzd2+PCRramMqgbCDsCBfdATBNEIyMG1qqEqWd8ZJZ9MvJMNja+/Gw
COyqHZV9kCgLzG4LbnMj8U27OQdBaHn77xPQBmjCYmMjBgDvRaZpyZEWbs1E/Q6Q
STvs4xHLRUy6klGJhkmEcmnKV3AXdxBGh/smMSub34WgADu/nn0G35zU5hSoRyv7
+5cpnMDpPkJ61QqCd0H8BCr/aaA6Ue4JPtXL+l4izNYQcRTDKr8UbeuFiT3XcG1o
6XlzS2mqlZ7mvNQBV8u8ib3FGS9cFfCUmqJGvVNFjLhoJVxW+57xTgOKOWL6kcy/
zT2A+8ELmxvRBOi+BmWyEff9KSggIbx81P3cbggj4esHD6l0kxdgKfdaAfBZuCCm
bBhrAn4uN7gpxiltHYha92vtfiVLwYN4i4mvrjRkRsRmCBgPAuM=
=qsmE
-----END PGP SIGNATURE-----

--X6RB7Ex6yWMH9GOzj9MPkc9CW3ycUmHuO--