On Thu, Nov 2, 2017 at 10:15 AM, Bertrand Delacretaz <[email protected] > wrote:
> Hi, > > On Thu, Nov 2, 2017 at 9:39 AM, Lars Bruun-Hansen > <[email protected]> wrote: > > ....it seems that for our release process to be > > approved, we must limit the location from where we fetch 3rd party libs > to > > the following... > > I don't think that's a hard requirement, but grabbing binaries from > non-standard places is not a good thing in general and might raise > questions from release reviewers. > > However, IIUC the NetBeans build strongly checks the digests of all > binaries that it uses, which makes it less of a problem. > > Downloading binaries from locations which have an uncertain future > (like hg.netbeans.org/binaries IIUC) means people might be unable to > build NetBeans in the future, and that's not good, just from a > practical and sustainability standpoint - so might be frowned upon as > well, but less so for a first incubating release. > While I agree the dependency on /binaries is not ideal, it is AFAIK possible change the location when building to some other location, or fill the local cache manually. Still troublesome, but better IMO to try to release and find out about other problematic things we don't know about yet. I'd say we have dependencies of several kinds: -non-problematic (OK license, are on maven), e.g. Apache Felix, JNA -not really problematic, but will take time, e.g. launchers(*) -somewhat problematic (not on maven, etc.), like Jemmy (the version that NB is marked as CDDLGPLv2CPE as far as I can tell, is not on maven, new versions are GPLv2CPE AFAIK) -more problematic, like libs.javafx (compile-time only) -very problematic (libs.javacapi, libs.javaimpl) Specifically for the launchers, the situation is like this: on Windows, NetBeans (platform, platform applications and IDE) need an exe launcher. Currently, AFAIK, the (standard Java) build is not requiring any C tool chain, and produced build are mostly platform independent. I.e. even a Linux build will produce a binary useable on Windows (with the exe launchers). I believe it would be very good to keep these properties. Currently, the build is downloading the original CDDL+GPLv2CPE launchers from /binaries. My understanding is that the following approach would provide a solution (but is likely to take some time): -make a standalone release of (just) the launchers (sources) -build convenience binaries from them and upload them somewhere (ideally maven) -the platform/IDE build would download and use these convenience binaries (We would need to do the same for a few more native binaries, like the profiler libraries.) Jan > -Bertrand >
