RE: Royale 0.9.9 on npm is broken

sh-policy-january-2020.html> From: Yishay Weiss<mailto:yishayj...@hotmail.com> Sent: Sunday, May 29, 2022 10:18 AM To: dev@royale.apache.org<mailto:dev@royale.apache.org>; OmPrakash Muppirala<mailto:bigosma...@gmail.com> Subject: RE: Royale 0.9.9 on npm is broken I wante

RE: Royale 0.9.9 on npm is broken

I wanted to unpublish so I can upload again but got this C:\dev\royale_dist\dist>npm unpublish @apache-royale/royale-js@0.9.9 This operation requires a one-time password. Enter OTP: 352851 npm ERR! code E405 npm ERR! 405 Method Not Allowed - PUT https://registry.npmjs.org/@apache-royale%2froy

RE: Royale 0.9.9 on npm is broken

g<mailto:dev@royale.apache.org> Subject: RE: Royale 0.9.9 on npm is broken I probably missed something when manually uploading it. There is a thread around the time of the release how 2FA has messed up our script. From: Josh Tynjala<mailto:joshtynj...@apache.org> Sent: Tuesday, May 24,

RE: Royale 0.9.9 on npm is broken

> Subject: Royale 0.9.9 on npm is broken I just tried installing both @apache-royale/royale-js and @apache-royale/royale-js-swf from npm, and they seem to be missing pretty much everything. I think it's just the npm glue parts. For reference, here are the file size differences between 0.9.8 and 0.

Royale 0.9.9 on npm is broken

I just tried installing both @apache-royale/royale-js and @apache-royale/royale-js-swf from npm, and they seem to be missing pretty much everything. I think it's just the npm glue parts. For reference, here are the file size differences between 0.9.8 and 0.9.9: royale-js 0.9.8 is 158 MB royale

RE: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT

Updated and working well so far. Thank you Greg. -Original Message- From: Greg Dove Sent: Monday, April 18, 2022 8:31 PM To: Apache Royale Development Subject: Re: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT I pushed some updates for events a couple of hours back

Re: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT

l 18, 2022 1:26 PM > To: Apache Royale Development > Subject: Re: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT > > Sorry Brian, the only delay has been my available time. I am focusing > today on catching up on Royale work, after a local 4-day public holiday &g

RE: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT

You are welcome, and thank you; a vacation sure does sound nice! -Original Message- From: Greg Dove Sent: Monday, April 18, 2022 1:26 PM To: Apache Royale Development Subject: Re: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT Sorry Brian, the only delay has been my

Re: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT

way I can assist you with these changes? Can you provide an > example of what needs to be updated? > > > Brian > > -Original Message- > From: Greg Dove > Sent: Monday, April 11, 2022 11:19 PM > To: Apache Royale Development > Subject: Re: [EXTERNAL] Re: Problem

RE: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT

Hi Greg, Is there a way I can assist you with these changes? Can you provide an example of what needs to be updated? Brian -Original Message- From: Greg Dove Sent: Monday, April 11, 2022 11:19 PM To: Apache Royale Development Subject: Re: [EXTERNAL] Re: Problem with Release 0.9.9

RE: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT

Not a problem. I mostly just wanted others to be aware that release may be unusable for some. Thank you! -Original Message- From: Greg Dove Sent: Monday, April 11, 2022 11:19 PM To: Apache Royale Development Subject: Re: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT

Re: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT

; -Original Message- >> From: Greg Dove >> Sent: Thursday, April 7, 2022 12:00 PM >> To: Apache Royale Development >> Subject: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT >> >> Brian, I have an idea what it might be. There was a change

Re: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT

tead of the actual type declared. > > -Original Message- > From: Greg Dove > Sent: Thursday, April 7, 2022 12:00 PM > To: Apache Royale Development > Subject: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT > > Brian, I have an idea what it might be. Th

RE: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT

of the actual type declared. -Original Message- From: Greg Dove Sent: Thursday, April 7, 2022 12:00 PM To: Apache Royale Development Subject: [EXTERNAL] Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT Brian, I have an idea what it might be. There was a change for event redispatching to align

Re: Problem with Release 0.9.9 and 0.9.10-SNAPSHOT

llo all, > > It appears that something slipped through right before the 0.9.9 release > that breaks MX RemoteObjects/Consumers. > > I've attempted rolling through and reverting various recent commits to try > to narrow down the problem, but have yet to be able to find one related. &

Problem with Release 0.9.9 and 0.9.10-SNAPSHOT

Hello all, It appears that something slipped through right before the 0.9.9 release that breaks MX RemoteObjects/Consumers. I've attempted rolling through and reverting various recent commits to try to narrow down the problem, but have yet to be able to find one related. To provide context

[ANNOUNCE] Apache Royale 0.9.9 released

The Apache Royale community is pleased to announce the release of Apache Royale 0.9.9. The Apache Royale project is the next generation of the Apache Flex SDK. It lets developers use MXML and ActionScript 3 to generate HTML/JS/CSS applications which can run natively in browsers. The cross

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4

I believe I have corrected all the anomalies that Greg commented on for the TDJ. Hiedra -Mensaje original- De: Maria Jose Esteve Enviado el: miércoles, 30 de marzo de 2022 1:13 Para: dev@royale.apache.org Asunto: RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4

t see them correct, please tell me) Hiedra -Mensaje original- De: Greg Dove mailto:greg.d...@gmail.com>> Enviado el: domingo, 27 de marzo de 2022 0:58 Para: Apache Royale Development mailto:dev@royale.apache.org>> Asunto: Re: [DISCUSS] Discuss Release Apache Royale 0.9.

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4

In regards to playerglobal, version 32.0 is still available from this page, if we still want to point out where users can download the official Adobe version. https://www.adobe.com/support/flashplayer/debug_downloads.html -- Josh Tynjala Bowler Hat LLC On Sat, Mar 26,

RE: [DRAFT][ANNOUNCE] Apache Royale 0.9.9 released

Asunto: RE: [DRAFT][ANNOUNCE] Apache Royale 0.9.9 released TBH I’m not sure what this entails. It would of course be good if we the site showed the correct latest version. Hopefully somebody else has a better answer. Thanks for volunteering. From: Maria Jose Esteve<mailto:mjest...@iest.com>

RE: [DRAFT][ANNOUNCE] Apache Royale 0.9.9 released

o: dev@royale.apache.org<mailto:dev@royale.apache.org> Subject: RE: [DRAFT][ANNOUNCE] Apache Royale 0.9.9 released Yishay, we will have to modify the Royale website and update the links, right? This can be done by me if no one else has it assigned. It must be done in the same branch as TDJ right? (royale

RE: [DRAFT][ANNOUNCE] Apache Royale 0.9.9 released

version 0.9.8 and Carlos commented that it seemed that the steps he had taken were correct, maybe I'm missing something) Hiedra -Mensaje original- De: Yishay Weiss Enviado el: martes, 29 de marzo de 2022 12:34 Para: dev@royale.apache.org Asunto: RE: [DRAFT][ANNOUNCE] Apache Royale 0.9.9

RE: [DRAFT][ANNOUNCE] Apache Royale 0.9.9 released

If there is no feedback on the this draft I’ll send the official announcement in 48 hours. Thanks. From: Yishay Weiss<mailto:yishayj...@hotmail.com> Sent: Tuesday, March 29, 2022 1:27 PM To: dev@royale.apache.org<mailto:dev@royale.apache.org> Subject: [DRAFT][ANNOUNCE] Apache

[DRAFT][ANNOUNCE] Apache Royale 0.9.9 released

The Apache Royale community is pleased to announce the release of Apache Royale 0.9.9. The Apache Royale project is the next generation of the Apache Flex SDK. It lets developers use MXML and ActionScript 3 to generate HTML/JS/CSS applications which can run natively in browsers. The cross

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4

e that. I’ll announce > the vote results. > > > From: Yishay Weiss<mailto:yishayj...@hotmail.com> > Sent: Tuesday, March 29, 2022 9:37 AM > To: dev@royale.apache.org<mailto:dev@royale.apache.org> > Subject: RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4 >

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4

@royale.apache.org Asunto: RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4 Hi Maria, First, it would not be a bother. The more people involved, even if it takes some training, the easier it is on the rest. I have already announced the vote, but as I have said previously I think we should aim to have

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4

. Thanks From: Maria Jose Esteve<mailto:mjest...@iest.com> Sent: Tuesday, March 29, 2022 10:20 AM To: dev@royale.apache.org<mailto:dev@royale.apache.org> Subject: RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4 I Yishay. I had not said anything because I have never done it and I d

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4

Ok, next time...  Hiedra -Mensaje original- De: Yishay Weiss Enviado el: martes, 29 de marzo de 2022 8:49 Para: dev@royale.apache.org Asunto: RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4 Sorry, I was confused about the rules (I should have read the email I sent). It looks

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4

Asunto: RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4 Thank you Greg, Piotr, and Josh. We need one vote more to get this released. Any volunteers (especially new ones who have not done this yet)? We can guide you through it if the instructions are not clear. From: Greg Dove<mailto:gre

[RESULT] Release Apache Royale 0.9.9

Total binding votes: 3 +1s Total non-binding votes: 0 Vote passes with THREE +1 votes. Thanks to all those who took the time to review this release.

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4

he.org<mailto:dev@royale.apache.org> Subject: RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4 Thank you Greg, Piotr, and Josh. We need one vote more to get this released. Any volunteers (especially new ones who have not done this yet)? We can guide you through it if the instructions are not cl

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4

:58 AM To: Apache Royale Development<mailto:dev@royale.apache.org> Subject: Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4 Just a couple of notes from me: Future improvements in README - playerglobal I think the section on playerglobal should b

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4

Just a couple of notes from me: Future improvements in README - playerglobal I think the section on playerglobal should be re-written or removed. The links to the original Adobe download appear to be no longer working (for download). And I assume now

Re: [VOTE] Release Apache Royale 0.9.9 RC4

+1 Package https://dist.apache.org/repos/dist/dev/royale/0.9.9/rc4/apache-royale-0.9.9-src.zip Java 1.8 OS: Windows 10 amd64 10.0 Source kit signatures match: y Source kit builds: y README is ok: y RELEASE_NOTES is ok: y NOTICE is ok: y LICENSE is ok: y No unapproved licenses or archives: y

Re: [VOTE] Release Apache Royale 0.9.9 RC4

+1 Package https://dist.apache.org/repos/dist/dev/royale/0.9.9/rc4/apache-royale-0.9.9-src.tar.gz Java 9 OS: Mac OS X x86_64 10.16 Source kit signatures match: y Source kit builds: y README is ok: y RELEASE_NOTES is ok: y NOTICE is ok: y LICENSE is ok: y No unapproved licenses

Re: [VOTE] Release Apache Royale 0.9.9 RC4

+1 Package https://dist.apache.org/repos/dist/dev/royale/0.9.9/rc4/apache-royale-0.9.9-src.tar.gz Java 17 OS: Mac OS X aarch64 12.1 Source kit signatures match: y Source kit builds: y README is ok: y RELEASE_NOTES is ok: y NOTICE is ok: y LICENSE is ok: y No unapproved licenses or archives: y

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC4

Hmmm... In RC4, I have now reproduced the ASDoc build issue that I mentioned previously, both with -Duse-flash=true and without it. Even without AIR_HOME being specified in the case of the JS-only build. However, it doesn't seem to reproduce every time. I guess that I just got unlucky when I was

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3

, 2022 6:18 PM To: dev@royale.apache.org<mailto:dev@royale.apache.org>; Josh Tynjala<mailto:joshtynj...@bowlerhat.dev> Subject: Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3 IMO, the release does not have to be bug free. If the Maven and Ant build scripts can build

[DISCUSS] Discuss Release Apache Royale 0.9.9 RC4

This is the discussion thread. Thanks, Yishay Weiss

[VOTE] Release Apache Royale 0.9.9 RC4

Hi, This is the vote for the 0.9.9 release of Apache Royale. The release candidate can be found here; https://dist.apache.org/repos/dist/dev/royale/0.9.9/rc4/ Before voting please review the section,'What are the ASF requirements on approving a release?', at: http://www.apache.org/dev

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3

mailto:dev@royale.apache.org> Subject: RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3 The examples are run as part of the step 11, but mvn only. The ant examples are only built after release approval. For some reason MenuExample was working in mvn but not in ant. That’s why

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3

il.com> Sent: Thursday, March 17, 2022 9:12 AM To: Josh Tynjala<mailto:joshtynj...@bowlerhat.dev>; dev@royale.apache.org<mailto:dev@royale.apache.org> Subject: RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3 The examples are run as part of the step 11, but mvn only. The ant exa

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3

erhat.dev>; dev@royale.apache.org > <mailto:dev@royale.apache.org> > Subject: RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3 > > The examples are run as part of the step 11, but mvn only. The ant > examples are only built after release approval. For some reason Me

[CANCEL] [VOTE] Release Apache Royale 0.9.9 RC3

Josh found an issue with MenuExample From: apacheroyal...@gmail.com<mailto:apacheroyal...@gmail.com> Sent: Monday, March 14, 2022 8:35 AM To: dev@royale.apache.org<mailto:dev@royale.apache.org> Subject: [VOTE] Release Apache Royale 0.9.9 RC3 Hi, This is the vote for the 0.9.9 relea

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3

CUSS] Discuss Release Apache Royale 0.9.9 RC3 The examples are run as part of the step 11, but mvn only. The ant examples are only built after release approval. For some reason MenuExample was working in mvn but not in ant. That’s why the release steps did not fail prior to approval script. For an

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3

; [2] [INFO] [INFO] ---< org.apache.royale.examples:MenuExample >--- [INFO] [INFO] Building Apache Royale: Examples: Royale: MenuExample 0.9.9 [195/265] [INFO] [INFO] [ swf ]- [INFO] [INFO]

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3

following. Was the problem AIR_HOME or what your latest commit > fixed? Do we need another RC? > > From: Josh Tynjala<mailto:joshtynj...@bowlerhat.dev> > Sent: Tuesday, March 15, 2022 10:01 PM > To: dev@royale.apache.org<mailto:dev@royale.apache.org> > Subject: Re: [DISCU

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3

lease Apache Royale 0.9.9 RC3 I discovered that I had an AIR_HOME environment variable set elsewhere, and that was causing the ASDoc build failure. In the approval script, I can now reach MenuExample with both use-flash and without. I pushed a commit to develop that fixes the MenuExample build iss

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3

ample correctly when I use > -Duse-flash=true. > > json: > ROYALE_COMPILER_HOME: > /Users/joshtynjala/Desktop/ApacheRoyale/apache-royale-0.9.9-src/royale-asjs/js > 16.6482905 seconds > java.lang.NullPointerException: Cannot invoke > "org.apache.royale.compiler.tr

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3

, 2022 7:40 PM To: dev@royale.apache.org<mailto:dev@royale.apache.org> Subject: Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3 Does the release process include testing whether the approval script works or not? Maybe we should make that part of the steps before the [VOTE] and [DISCUSS]

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3

Does the release process include testing whether the approval script works or not? Maybe we should make that part of the steps before the [VOTE] and [DISCUSS] threads get sent to the mailing list. -- Josh Tynjala Bowler Hat LLC On Sun, Mar 13, 2022 at 11:35 PM wrote: >

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3

/ApacheRoyale/apache-royale-0.9.9-src/royale-asjs/js 16.6482905 seconds java.lang.NullPointerException: Cannot invoke "org.apache.royale.compiler.tree.as.IASNode.getSourcePath()" because "node" is null org.apache.royale.compiler.internal.codegen.as.ASBlockWalker.walk(AS

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC3

I just belatedly cancelled RC2 vote, but RC3 vote is still on. From: apacheroyal...@gmail.com<mailto:apacheroyal...@gmail.com> Sent: Monday, March 14, 2022 8:35 AM To: dev@royale.apache.org<mailto:dev@royale.apache.org> Subject: [DISCUSS] Discuss Release Apache Roya

[CANCEL] [VOTE] Release Apache Royale 0.9.9 RC2

We had to remove ExternJSJS.swc from RC2. From: apacheroyal...@gmail.com<mailto:apacheroyal...@gmail.com> Sent: Tuesday, March 8, 2022 10:28 AM To: dev@royale.apache.org<mailto:dev@royale.apache.org> Subject: [VOTE] Release Apache Royale 0.9.9 RC2 Hi, This is the vote for the 0

[DISCUSS] Discuss Release Apache Royale 0.9.9 RC3

This is the discussion thread. Thanks, Yishay Weiss

[VOTE] Release Apache Royale 0.9.9 RC3

Hi, This is the vote for the 0.9.9 release of Apache Royale. The release candidate can be found here; https://dist.apache.org/repos/dist/dev/royale/0.9.9/rc3/ Before voting please review the section,'What are the ASF requirements on approving a release?', at: http://www.apache.org/dev

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

onfigured, I think I remember). I hope I didn't forget anything. Thx. Hiedra -Mensaje original- De: Yishay Weiss Enviado el: miércoles, 9 de marzo de 2022 16:33 Para: dev@royale.apache.org Asunto: RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2 No need to apolo

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

o: dev@royale.apache.org<mailto:dev@royale.apache.org> Subject: RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2 Yes. At the time, I created a branch but I don't remember why Alina uploaded her copy. I'm going to try to remove it. I hope to do it correctly because I remember that we &q

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

ay, March 9, 2022 5:07 PM To: Apache Royale Development<mailto:dev@royale.apache.org> Subject: Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2 I searched using yish...@apache.org and I still get nothing. Dunno... > On Mar 9, 2022, at 4:53 PM, Yishay Weiss wrote: > > It’s pu

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

t? Hiedra -Mensaje original- De: Yishay Weiss Enviado el: miércoles, 9 de marzo de 2022 15:52 Para: dev@royale.apache.org Asunto: RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2 Probably. Maria, maybe you should remove the project and put it in a branch until it is configured proper

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

harbs.li...@gmail.com> > Sent: Wednesday, March 9, 2022 3:54 PM > To: Apache Royale Development<mailto:dev@royale.apache.org> > Subject: Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2 > > I imported your key manually, and that worked, but you really should publish

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

USS] Discuss Release Apache Royale 0.9.9 RC2 I imported your key manually, and that worked, but you really should publish it. Manual imports shouldn’t be necessary. > On Mar 9, 2022, at 3:33 PM, Yishay Weiss wrote: > > If you look here [1], then you need to import the last one (one aft

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

lease Apache Royale 0.9.9 RC2 Does this warrant another RC? (My gut says yes.) > On Mar 9, 2022, at 4:23 PM, Maria Jose Esteve wrote: > > Maybe it is because the ExternJS project is half-configured. I have replied > in the other thread. > > Hiedra > > -Mensaje ori

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

t; Enviado el: miércoles, 9 de marzo de 2022 14:59 > Para: Apache Royale Development > Asunto: Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2 > > Any clues why this file shows up? > > B > /Users/harbs/Desktop/release_test/apache-royale-0.9.9-bin-js-swf/royale

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

Maybe it is because the ExternJS project is half-configured. I have replied in the other thread. Hiedra -Mensaje original- De: Harbs Enviado el: miércoles, 9 de marzo de 2022 14:59 Para: Apache Royale Development Asunto: Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2 Any

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

Try yish...@apache.org From: Harbs Sent: Wednesday, March 9, 2022 3:49:22 PM To: dev@royale.apache.org Subject: Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2 gpg2 --keyserver https://pgp.mit.edu/ --search-keys yishayj...@hotmail.com > On Mar 9, 2

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

Any clues why this file shows up? B /Users/harbs/Desktop/release_test/apache-royale-0.9.9-bin-js-swf/royale-asjs/frameworks/js/libs/ExternsJSJS.swc AFAIK, there’s shouldn’t be binaries in the release artifacts. > On Mar 8, 2022, at 10:28 AM, apacheroyal...@gmail.com wr

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

.apache.org> > Subject: RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2 > > My mistake, it was created on 2021-04-02, so I couldn’t have been published > on April 13, 2020. > > How did you determine that it was the most current published key? > > > > From

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

current published key? > > > > From: Harbs<mailto:harbs.li...@gmail.com> > Sent: Wednesday, March 9, 2022 3:07 PM > To: dev@royale.apache.org<mailto:dev@royale.apache.org> > Subject: Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2 > > Well, I don’t

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

arch 9, 2022 3:18 PM To: dev@royale.apache.org<mailto:dev@royale.apache.org> Subject: RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2 My mistake, it was created on 2021-04-02, so I couldn’t have been published on April 13, 2020. How did you determine that it was the most current p

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

ailto:dev@royale.apache.org> Subject: Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2 Well, I don’t know why the gpg check is failing for me. I’ll wait until someone else checks the release. If it works for others, I’ll assume it’s a problem locally for me and see if I can fix it... > On Mar 9, 2

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

gt; From: Harbs<mailto:harbs.li...@gmail.com <mailto:harbs.li...@gmail.com>> > Sent: Wednesday, March 9, 2022 12:48 PM > To: Apache Royale Development<mailto:dev@royale.apache.org > <mailto:dev@royale.apache.org>> > Subject: Re: [DISCUSS] Discuss Release Apache Royal

RE: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

No, that’s the one From: Harbs<mailto:harbs.li...@gmail.com> Sent: Wednesday, March 9, 2022 12:48 PM To: Apache Royale Development<mailto:dev@royale.apache.org> Subject: Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2 I seem to have your key from April 13, 2020. That seems to

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

I seem to have your key from April 13, 2020. That seems to be the most current published key. Did you use a newer one? > On Mar 9, 2022, at 12:43 PM, Harbs wrote: > > I got an error here: > > check-sigs: > > gpg_check: > gpg: Signature made Tue Mar 8 08:59:15 2022 IST > gpg:

Re: [DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

I got an error here: check-sigs: gpg_check: gpg: Signature made Tue Mar 8 08:59:15 2022 IST gpg:using RSA key F4CE36E979325A6221706DB0E86EF353F54FE093 gpg: key E86EF353F54FE093: new key but contains no user ID - skipped gpg: Total number processed: 1 gpg: w/o user IDs:

[VOTE] Release Apache Royale 0.9.9 RC2

Hi, This is the vote for the 0.9.9 release of Apache Royale. The release candidate can be found here; https://dist.apache.org/repos/dist/dev/royale/0.9.9/rc2/ Before voting please review the section,'What are the ASF requirements on approving a release?', at: http://www.apache.org/dev

[DISCUSS] Discuss Release Apache Royale 0.9.9 RC2

This is the discussion thread. Thanks, Yishay Weiss

RE: 0.9.9

Sounds good. Let’s wait for Feb. From: Greg Dove<mailto:greg.d...@gmail.com> Sent: Monday, January 17, 2022 5:20 AM To: Apache Royale Development<mailto:dev@royale.apache.org> Subject: Re: 0.9.9 Just a note that I do expect to add fixes to some aspects of XML/XMLlist this week

Re: 0.9.9

Oh? Not sure why I thought that was the case. If your interpretation is correct, valueOf should probably be removed completely. If there’s no valueOf defined, Javascript will use toString. > On Jan 17, 2022, at 10:43 PM, Greg Dove wrote: > > Does not equal 10 (Number) - it equals 19

Re: 0.9.9

> What needs fixing? One of the things is var list:XMLList = xml + xmlList; or var list:XMLList = xmllist1 + xmlList2; I hope to have a fix for this within the next 12 hours or so. There are also some potential issues with valueOf() I think, that I need to look into. This: var xml:XML =

Re: 0.9.9

What needs fixing? > On Jan 17, 2022, at 5:20 AM, Greg Dove wrote: > > Just a note that I do expect to add fixes to some aspects of XML/XMLlist > this week

Re: 0.9.9

Just a note that I do expect to add fixes to some aspects of XML/XMLlist this week, and to add improvements to emulation classes. Actually I expect we will probably have a number of improvements to emulation classes this month. If there is not a pressing need to release 0.9.9, I'd suggest

Re: 0.9.9

No objections here. Going back up the thread, I would be happy to help with the publicity/marketing efforts around 1.0. If 0.9.9 comes out next week, what is the target period for 1.0? <https://www.avast.com/sig-email?utm_medium=email_source=link_campaign=sig-email_content=webmail> Viru

RE: 0.9.9

Hi All, It looks like nobody objects to the next version being 1.0. I will start releasing 0.9.9 next week. Any objections to that? Yishay From: Yishay Weiss<mailto:yishayj...@hotmail.com> Sent: Tuesday, December 7, 2021 5:47 PM To: dev@royale.apache.org<mailto:dev@royale.apache.org

Re: Sanitizing HTML (was Re: 0.9.9)

OK. For a script tag. But for anything else it should be safe. (I think?) Either way, I don’t know of any reason to be setting innerText instead of textContent, so we should standardize on that either way. Harbs > On Dec 13, 2021, at 1:12 AM, Edward Stangler wrote: > > > innerText still

Re: Sanitizing HTML (was Re: 0.9.9)

innerText still allows markup, and it's not totally safe (compared to textContent) with unsanitized strings: https://stackoverflow.com/questions/52707031/does-innertext-prevent-xss On 12/12/2021 4:18 AM, Harbs wrote: > Yes. > > Why do you include innerText? AFAIK innerText is safe.

Re: Sanitizing HTML (was Re: 0.9.9)

Styling, yes. Spans within the label? Not so sure. We could just sanitize the HTML automatically, but I’m not sure how much overhead that has. We could possibly take a middle approach: Check if the label has a “<“ character. If yes, sanitize. If not, don’t. Although I wouldn’t be surprised if

Re: Sanitizing HTML (was Re: 0.9.9)

I would think that styling text in buttons would be pretty common across the Flex universe. Does there need to be documentation about this threat and our steps to secure Royale from it? On Sun, Dec 12, 2021 at 9:44 AM Harbs wrote: > At the expense of performance? How common was setting styled

Re: Sanitizing HTML (was Re: 0.9.9)

At the expense of performance? How common was setting styled text in buttons? I could go either way on this. > On Dec 12, 2021, at 2:57 PM, Yishay Weiss wrote: > > Haven’t been following this closely enough to understand the overhead > involved, but if it’s not big then retaining backwards

RE: Sanitizing HTML (was Re: 0.9.9)

ber 12, 2021 2:12 PM To: dev@royale.apache.org<mailto:dev@royale.apache.org> Subject: Re: Sanitizing HTML (was Re: 0.9.9) > On Dec 12, 2021, at 11:30 AM, Harbs wrote: > > Spark ButtonBase I just spent some time looking at this. It seems like Spark supported styling the button lab

Re: Sanitizing HTML (was Re: 0.9.9)

> On Dec 12, 2021, at 11:30 AM, Harbs wrote: > > Spark ButtonBase I just spent some time looking at this. It seems like Spark supported styling the button labels which is probably why innerHTML is used. https://stackoverflow.com/questions/15295129/flex-part-of-spark-button-bold-label

Re: Sanitizing HTML (was Re: 0.9.9)

Yes. Why do you include innerText? AFAIK innerText is safe. (Although textContent usually makes more sense.) > On Dec 12, 2021, at 12:02 PM, Edward Stangler wrote: > > > OK, that make sense. > > If you use innerHTML / innerText inside Royale, then you need to sanitize. > > (And whatever

Re: Sanitizing HTML (was Re: 0.9.9)

OK, that make sense. If you use innerHTML / innerText inside Royale, then you need to sanitize. (And whatever equivalent for "src" / "url" and other such areas.) On 12/12/2021 3:32 AM, Harbs wrote: >> If I set a string variable (i.e. title of a movie) to an unsafe value, >> and then some

Re: Sanitizing HTML (was Re: 0.9.9)

I just fixed ImageAndTextButton. Feel free to use that fix as a template for how to avoid innerHTML... That leaves four classes to look at. I did notice that ImageAndTextButton uses an “image” property to set the src of the image. I think we should standardize on src or url for any values that

Re: Sanitizing HTML (was Re: 0.9.9)

> If I set a string variable (i.e. title of a movie) to an unsafe value, > and then some class in Royale--written by someone else--uses that value > within some HTML that they then assign to an innerHTML, how am I protected? I’m saying we should have a policy that it will not be written as

Re: Sanitizing HTML (was Re: 0.9.9)

I guess I'm confused. If I set a string variable (i.e. title of a movie) to an unsafe value, and then some class in Royale--written by someone else--uses that value within some HTML that they then assign to an innerHTML, how am I protected? That is, I set a string variable not knowing that it

Re: Sanitizing HTML (was Re: 0.9.9)

> If I need to prove (to the best of my ability) that my app is protected > against XSS with regards to innerHTML / innerText, how am I supposed to > do this? I think we should have a guarantee that the framework will not insert unsanitized HTML without the knowledge of the developer. That was

Re: Sanitizing HTML (was Re: 0.9.9)

If I need to prove (to the best of my ability) that my app is protected against XSS with regards to innerHTML / innerText, how am I supposed to do this? There are three possible protectors (normally): a. The browser. The browsers will not able to do this automatically, even with proposed

Re: Sanitizing HTML (was Re: 0.9.9)

AIUI, the suggestion is to default to sanitizing before writing to innerHTML so that someone who does let someone type in "anything" and shoves it into a Label's htmlText won't have their app used to run various exploits. If a volunteer can propose a design that defaults to sanitizing and can

  1   2   >