Caucho has fixed several Hessian bugs over the years but only released them as part of Resin.
The 3.x naming refers to when Hessian was bundled separately from Resin. Someone, I'm not sure if it was Caucho or not, was pulling Hessian out of the Resin source and putting it on Maven central and following the Resin versioning. It's here: http://repo1.maven.org/maven2/com/caucho/hessian/ If you're still using the 3.x versions, It's likely any bugs you have encountered that are very old will be fixed in the 4.0.38 version that's currently the latest in the Maven repo. I see Caucho is up to Resin 4.0.48 now, but the Resin changelog (http://bugs.caucho.com/changelog_page.php) does not show any Hessian bugs fixed since 4.0.38. You may want to review the latest Hessian source code and start from there if you really want to start your own separate fork: svn://svn.caucho.com/home/svn/svnroot/resin/trunk/modules/hessian/src/com/caucho/hessian. Paul -----Original Message----- From: hessian-interest-boun...@caucho.com [mailto:hessian-interest-boun...@caucho.com] On Behalf Of Aristedes Maniatis Sent: Tuesday, March 29, 2016 4:54 AM To: Discussion of the Hessian protocol Subject: Re: [Hessian-interest] supported forks? Excellent. Nice to meet you Christian. And perhaps if we got this off the ground, we'd find others who might step forward. Assuming the Caucho developers aren't interested in taking this on themselves, we have several issues to look at: 1. Renaming the project (since Hessian name belongs to Caucho) 2. Changing the maven co-ordinates to avoid conflict 3. Integrating various bug fixes (like your 27 and our simpler BigDecimal patch) 4. Reviewing all licensing to ensure we don't introduce any problems I'm not overly fussed between Apache and Eclipse as a custodian, but if it came over to Apache then it would only happen if the PMC (project management committee) of Apache Cayenne decided that was appropriate. I'm on that PMC and also a member of the Apache Foundation, but I'm only one of several people who need to consider the implications. Let's give this a few more days to see if Caucho respond, and to see if there is other interest. In the meantime I'm also evaluating whether we want to migrate our own systems to protocol-buffers. There are pluses and minuses to that approach. Although Hessian has been always solid (except where it has bugs :-) I'm not sure it has ever had a robust code review for things like the Java serialisation security issues that happened last year. I feel more confident about protocol-buffers having had that review. However protocol buffers has a very different approach to annotating the serialisable attributes. Hopefully I'll have a better understanding of the options out there later this week. Cheers Ari On 29/03/2016 7:37pm, Christian Campo wrote: > Hi Aristedes, > > I also run two frameworks which heavily depend on Hessian to work. One > is a commercial framework and the other is a open source framework > „Eclipse Riena“ where we distribute Hessian as part off. However we > only distribute the unmodified version of Hessian 3.2. Project is here > http://www.eclipse.org/riena, Git Repo is here > http://git.eclipse.org/c/riena/org.eclipse.riena.git > > In our commercial framework we use Hessian 3.0.2. fixed around 27 > problems (the .jar is called Hessian-3.0.2-patched-027.jar :-) ) > > I am using Hessian now for 12 years and we have a pretty stable > version that we have no issues with. However I would be interested in > a joint open source effort and would like to support it (with > resources). And sure I would love to consolidate the two different > versions and supply all the fixes that we have built. > > I have a little background in the Eclipse Foundation ecosystem (as PL > of Eclipse Riena and member of the architecture council). > > However Hessian seems to be a very smallish component and maintenance > only. So we can also try to put it on Github and work there. I highly > recommend that we need to to get the license thing right. So currently > Hessian is Apache licensed and we need to make sure that every code > contribution is also supplied under Apache License. > > If you would like to get under the hood of an foundation I could help > with the Eclipse Foundation. While they prefer the EPL, I am sure we > could also do APL. The advantage is that they get the legal stuff done for > you. > (among many other things) > > Cheers > christian > > Am 28.03.16, 01:14 schrieb "hessian-interest-boun...@caucho.com on > behalf of Aristedes Maniatis" unter > <hessian-interest-boun...@caucho.com on behalf of a...@ish.com.au>: > >> I depend on Hessian as a key part of Cayenne ROP, but I'm concerned >> about the future of this project. I've commented before about the >> poor health of Hessian, but the question is now what to do with it, >> with bugs like BigDecimal languishing for years. >> >> Assuming there are other users out there on this list, is there any >> enthusiasm for forking this project to try and maintain it and keep >> it alive? I know this has been tried before, without much long term success. >> >> Would it make a difference if we took the code over to Apache to >> maintain it there? Do the Caucho developers have any preference for >> what happens next? >> >> I have some developer resources I could put toward a cleanup and >> review of outstanding bugs. But if I am forced to maintain my own >> private fork, that's not optimal. >> >> Cheers >> >> Ari >> >> -- >> --------------------------> >> Aristedes Maniatis >> CEO, ish >> https://www.ish.com.au >> GPG fingerprint CBFB 84B4 738D 4E87 5E5C 5EFA EF6A 7D2E 3E49 102A >> > > ------------------------------------------------------------- > compeople AG > Untermainanlage 8 > 60329 Frankfurt/Main > fon: +49 (0) 69 / 27 22 18 0 > fax: +49 (0) 69 / 27 22 18 22 > web: www.compeople.de > > Vorstand: Jürgen Wiesmaier > Aufsichtsratsvorsitzender: Christian Glanz > > Sitz der Gesellschaft: Frankfurt/Main > Handelsregister Frankfurt HRB 56759 > USt-IdNr. DE207665352 > ------------------------------------------------------------- > _______________________________________________ > hessian-interest mailing list > hessian-interest@caucho.com > http://maillist.caucho.com/mailman/listinfo/hessian-interest > -- --------------------------> Aristedes Maniatis CEO, ish https://www.ish.com.au GPG fingerprint CBFB 84B4 738D 4E87 5E5C 5EFA EF6A 7D2E 3E49 102A _______________________________________________ hessian-interest mailing list hessian-interest@caucho.com http://maillist.caucho.com/mailman/listinfo/hessian-interest
