Claus Ibsen created CAMEL-26748:
-----------------------------------
Summary: camel-jbang - self-update and web installers: switch to a
nightly SNAPSHOT build of the Camel CLI
Key: CAMEL-26748
URL: https://issues.apache.org/jira/browse/CAMEL-26748
Project: Camel
Issue Type: Improvement
Components: camel-jbang
Reporter: Claus Ibsen
Assignee: Claus Ibsen
Fix For: 4.24.0
Today {{camel self-update}} and the web installers ({{install.sh}},
{{install.ps1}}) only install releases from Maven Central. To try the latest
development code, or a fix before its patch release, you have to build Camel
yourself or switch to a JBang install.
Apache already publishes a nightly {{camel-launcher}} build to the Apache
snapshot repository, including the same {{bin.tar.gz}}/{{bin.zip}} archives the
installers use, for main and for the maintenance branches (for example
4.24.0-SNAPSHOT, 4.22.3-SNAPSHOT, 4.18.6-SNAPSHOT).
h3. Proposed syntax
Reuse {{--version}}, next to the existing {{X.Y.Z}}, {{X.Y}} and {{LTS}}
selectors:
{code}
camel self-update --version 4.24.0-SNAPSHOT # newest nightly of 4.24, stays
on it
camel self-update --version SNAPSHOT # newest nightly of main, follows
main
camel self-update --version LTS # back to a release (or --version
4.23.0)
curl -fsSL https://camel.apache.org/install.sh | sh -s -- --version
4.22.3-SNAPSHOT
{code}
* {{X.Y.Z-SNAPSHOT}} is recorded as the pin and follows the nightlies of that
version. Once X.Y.Z is released, the update notice suggests the release
({{4.24.0}} sorts above {{4.24.0-SNAPSHOT}}).
* {{SNAPSHOT}} follows the newest nightly of main (the {{<latest>}} version of
the snapshot repository metadata).
* Leaving a snapshot pin with an explicit release {{--version}} is allowed
(today an explicit {{--version}} is refused on a selector pin).
* Nexus 2 serves Maven 2 metadata (no {{<snapshotVersions>}}) to clients it
does not take for Maven 3, such as the JDK HTTP client: resolve the build from
{{<snapshot><timestamp>}} and {{<buildNumber>}} then.
h3. Points to address
# *ASF release policy*: nightly builds are not Apache releases and must not be
promoted to the general public. Document the option in the launcher and
contributor docs (not on Getting Started), and print a warning such as
"development build, not an Apache release" when installing one.
# *Integrity*: a release is verified against a SHA-256 in a manifest on
camel.apache.org, a different origin than Maven Central. A nightly only has
{{.sha1}}/{{.md5}} next to it on repository.apache.org (no {{.sha256}}, no
signature). Verifying against it catches a broken download, not a tampered one.
Acceptable for an opt-in developer feature, but document the weaker guarantee.
# *A nightly replaces itself*: {{install.sh}} deletes {{versions/<version>}}
and moves the new copy in. For a release the content never changes, but a
nightly keeps its version with new content, so a running {{camel tui}} or
{{camel run}} would lose its jars. Install each nightly in its own directory
named after its timestamped version (e.g. {{4.24.0-20261108.143653-24}}).
# *Knowing which nightly runs*: the catalog version of a nightly is
{{4.24.0-SNAPSHOT}}, so "is there a newer nightly" needs the timestamped
version of the running build (from its install directory). {{camel version}}
shows it, with the UTC time it was built (the release jars carry a fixed
reproducible-build timestamp, so the file dates do not tell).
# *camel doctor* counts every directory under {{versions/}} as a separate
installation, so a release next to a nightly (or two nightlies) reports a
conflict. Only the active one, or one per version line, should count.
# *Update notice*: a new nightly lands every day, so a daily "new version
available" notice is noise. Skip it, or check weekly, for a snapshot pin.
# *Installers*: {{install.sh}}/{{install.ps1}} accept only {{X.Y.Z}}, {{X.Y}}
and {{LTS}}, and resolve versions from the camel.apache.org manifests. They
need a path that resolves the nightly from the snapshot repository metadata.
{{camel self-update}} downloads the installer from the website on every run, so
this only works once the website publishes the new scripts.
# *Pruning*: old nightly directories pile up (115 MB each); keep the newest few.
h3. Out of scope
Running the CLI from a local build of a Camel checkout. That needs a check on
every start, not a one-shot install, and belongs in a contributor script rather
than the released launcher.
_Claude Code on behalf of Claus Ibsen_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
