Re: RFR: 8264010: Add Gradle dependency verification [v5]

2021-05-03 Thread Johan Vos
On Thu, 29 Apr 2021 23:52:30 GMT, John Neffenger wrote: >> This pull request adds dependency verification to the Gradle builds of >> JavaFX on Linux, macOS, and Windows. It is the third of three changes that >> close the gaps in the JavaFX build security: >> >> * [JDK-8262236][1]: Configure

Re: RFR: 8264010: Add Gradle dependency verification [v5]

2021-05-01 Thread Johan Vos
On Thu, 29 Apr 2021 23:52:30 GMT, John Neffenger wrote: >> This pull request adds dependency verification to the Gradle builds of >> JavaFX on Linux, macOS, and Windows. It is the third of three changes that >> close the gaps in the JavaFX build security: >> >> * [JDK-8262236][1]: Configure

Re: RFR: 8264010: Add Gradle dependency verification [v5]

2021-04-30 Thread Kevin Rushforth
On Thu, 29 Apr 2021 23:52:30 GMT, John Neffenger wrote: >> This pull request adds dependency verification to the Gradle builds of >> JavaFX on Linux, macOS, and Windows. It is the third of three changes that >> close the gaps in the JavaFX build security: >> >> * [JDK-8262236][1]: Configure

Re: RFR: 8264010: Add Gradle dependency verification [v5]

2021-04-30 Thread Kevin Rushforth
On Thu, 29 Apr 2021 23:52:30 GMT, John Neffenger wrote: >> This pull request adds dependency verification to the Gradle builds of >> JavaFX on Linux, macOS, and Windows. It is the third of three changes that >> close the gaps in the JavaFX build security: >> >> * [JDK-8262236][1]: Configure

Re: RFR: 8264010: Add Gradle dependency verification [v5]

2021-04-30 Thread Kevin Rushforth
On Thu, 29 Apr 2021 23:52:30 GMT, John Neffenger wrote: >> This pull request adds dependency verification to the Gradle builds of >> JavaFX on Linux, macOS, and Windows. It is the third of three changes that >> close the gaps in the JavaFX build security: >> >> * [JDK-8262236][1]: Configure

Re: RFR: 8264010: Add Gradle dependency verification [v5]

2021-04-29 Thread John Neffenger
> This pull request adds dependency verification to the Gradle builds of JavaFX > on Linux, macOS, and Windows. It is the third of three changes that close the > gaps in the JavaFX build security: > > * [JDK-8262236][1]: Configure Gradle checksum verification > * [JDK-8263204][2]: Add Gradle

Re: RFR: 8264010: Add Gradle dependency verification [v4]

2021-04-29 Thread Kevin Rushforth
On Sat, 17 Apr 2021 23:17:04 GMT, John Neffenger wrote: >> This pull request adds dependency verification to the Gradle builds of >> JavaFX on Linux, macOS, and Windows. It is the third of three changes that >> close the gaps in the JavaFX build security: >> >> * [JDK-8262236][1]: Configure

Re: RFR: 8264010: Add Gradle dependency verification [v4]

2021-04-29 Thread John Neffenger
On Tue, 27 Apr 2021 21:19:26 GMT, Kevin Rushforth wrote: > Here are the two additional internal downloads for the new versions of the > gcc-10.3 and vs2019-16.9.3 download Thanks, Kevin. I'll assume those replace the older versions shown in the excerpt below, and I'll remove them. Let me know

Re: RFR: 8264010: Add Gradle dependency verification [v4]

2021-04-27 Thread Kevin Rushforth
On Sat, 17 Apr 2021 23:17:04 GMT, John Neffenger wrote: >> This pull request adds dependency verification to the Gradle builds of >> JavaFX on Linux, macOS, and Windows. It is the third of three changes that >> close the gaps in the JavaFX build security: >> >> * [JDK-8262236][1]: Configure

Re: RFR: 8264010: Add Gradle dependency verification [v4]

2021-04-27 Thread Kevin Rushforth
On Sat, 17 Apr 2021 23:21:27 GMT, John Neffenger wrote: >> John Neffenger has updated the pull request incrementally with one >> additional commit since the last revision: >> >> Add dependencies for internal builds at Oracle > > Thanks, Kevin. I added your list to the file and ran just the

Re: RFR: 8264010: Add Gradle dependency verification [v4]

2021-04-19 Thread Kevin Rushforth
On Sat, 17 Apr 2021 23:17:04 GMT, John Neffenger wrote: >> This pull request adds dependency verification to the Gradle builds of >> JavaFX on Linux, macOS, and Windows. It is the third of three changes that >> close the gaps in the JavaFX build security: >> >> * [JDK-8262236][1]: Configure

Re: RFR: 8264010: Add Gradle dependency verification [v4]

2021-04-17 Thread John Neffenger
On Sat, 17 Apr 2021 23:17:04 GMT, John Neffenger wrote: >> This pull request adds dependency verification to the Gradle builds of >> JavaFX on Linux, macOS, and Windows. It is the third of three changes that >> close the gaps in the JavaFX build security: >> >> * [JDK-8262236][1]: Configure

Re: RFR: 8264010: Add Gradle dependency verification [v4]

2021-04-17 Thread John Neffenger
> This pull request adds dependency verification to the Gradle builds of JavaFX > on Linux, macOS, and Windows. It is the third of three changes that close the > gaps in the JavaFX build security: > > * [JDK-8262236][1]: Configure Gradle checksum verification > * [JDK-8263204][2]: Add Gradle

Re: RFR: 8264010: Add Gradle dependency verification [v3]

2021-04-17 Thread Kevin Rushforth
On Wed, 14 Apr 2021 04:32:29 GMT, John Neffenger wrote: >> This pull request adds dependency verification to the Gradle builds of >> JavaFX on Linux, macOS, and Windows. It is the third of three changes that >> close the gaps in the JavaFX build security: >> >> * [JDK-8262236][1]: Configure

Re: RFR: 8264010: Add Gradle dependency verification [v3]

2021-04-13 Thread John Neffenger
On Wed, 14 Apr 2021 04:32:29 GMT, John Neffenger wrote: >> This pull request adds dependency verification to the Gradle builds of >> JavaFX on Linux, macOS, and Windows. It is the third of three changes that >> close the gaps in the JavaFX build security: >> >> * [JDK-8262236][1]: Configure

Re: RFR: 8264010: Add Gradle dependency verification [v3]

2021-04-13 Thread John Neffenger
> This pull request adds dependency verification to the Gradle builds of JavaFX > on Linux, macOS, and Windows. It is the third of three changes that close the > gaps in the JavaFX build security: > > * [JDK-8262236][1]: Configure Gradle checksum verification > * [JDK-8263204][2]: Add Gradle

Re: RFR: 8264010: Add Gradle dependency verification [v2]

2021-04-12 Thread Kevin Rushforth
On Wed, 24 Mar 2021 19:45:55 GMT, John Neffenger wrote: >> This pull request adds dependency verification to the Gradle builds of >> JavaFX on Linux, macOS, and Windows. It is the third of three changes that >> close the gaps in the JavaFX build security: >> >> * [JDK-8262236][1]: Configure

Re: RFR: 8264010: Add Gradle dependency verification [v2]

2021-04-12 Thread John Neffenger
On Wed, 24 Mar 2021 19:45:55 GMT, John Neffenger wrote: >> This pull request adds dependency verification to the Gradle builds of >> JavaFX on Linux, macOS, and Windows. It is the third of three changes that >> close the gaps in the JavaFX build security: >> >> * [JDK-8262236][1]: Configure

Re: RFR: 8264010: Add Gradle dependency verification

2021-04-01 Thread Kevin Rushforth
On Thu, 1 Apr 2021 23:23:37 GMT, Kevin Rushforth wrote: >> We have a few in-flight or imminent updates that will impact this PR. There >> is a tight deadline on one of them (an ICU data file dependency), so I'd >> prefer to wait on integrating this until after they are done. >> >> It's still

Re: RFR: 8264010: Add Gradle dependency verification

2021-04-01 Thread Kevin Rushforth
On Wed, 31 Mar 2021 14:09:40 GMT, Kevin Rushforth wrote: >>> Are all of them actually needed? >> >> Just to follow up on that question, all of them are in fact downloaded >> during the build, at least. I removed the Gradle directory `$HOME/.gradle` >> and ran the build as follows. Then I

Re: RFR: 8264010: Add Gradle dependency verification

2021-03-31 Thread Kevin Rushforth
On Thu, 25 Mar 2021 18:53:41 GMT, John Neffenger wrote: >> Thanks, Kevin. I added a README file and updated the Lucene instructions, as >> you suggested. I'm open to any other suggestions on the wording or >> formatting, no matter how minor. >> >>> Some of the files listed are not used

Re: RFR: 8264010: Add Gradle dependency verification

2021-03-25 Thread John Neffenger
On Wed, 24 Mar 2021 19:50:11 GMT, John Neffenger wrote: > Are all of them actually needed? Just to follow up on that question, all of them are in fact downloaded during the build, at least. I removed the Gradle directory `$HOME/.gradle` and ran the build as follows. Then I compared the list

Re: RFR: 8264010: Add Gradle dependency verification

2021-03-24 Thread Kevin Rushforth
On Wed, 24 Mar 2021 21:06:08 GMT, John Neffenger wrote: >> Thanks for providing / updating the instructions. >> >> My internal test build failed right off the bat, since we have a >> supplemental closed gradle file that augments the build and downloads >> additional build tools for our

Re: RFR: 8264010: Add Gradle dependency verification

2021-03-24 Thread John Neffenger
On Wed, 24 Mar 2021 19:55:20 GMT, Kevin Rushforth wrote: > I don't yet know to handle this ... Would any of the following options work? 1. If you're using your own supplemental closed Gradle build file, create your own supplemental closed Gradle verification file, too. Before the internal

Re: RFR: 8264010: Add Gradle dependency verification

2021-03-24 Thread Kevin Rushforth
On Wed, 24 Mar 2021 19:50:11 GMT, John Neffenger wrote: >> This seems like a good idea to do. I have a couple overall questions before >> reviewing / testing. >> >> 1. Can you add some sort of README file that describes the how to update the >> checksums? Also, the instructions in >>

Re: RFR: 8264010: Add Gradle dependency verification

2021-03-24 Thread John Neffenger
On Tue, 23 Mar 2021 12:07:48 GMT, Kevin Rushforth wrote: >> This pull request adds dependency verification to the Gradle builds of >> JavaFX on Linux, macOS, and Windows. It is the third of three changes that >> close the gaps in the JavaFX build security: >> >> * [JDK-8262236][1]: Configure

Re: RFR: 8264010: Add Gradle dependency verification [v2]

2021-03-24 Thread John Neffenger
> This pull request adds dependency verification to the Gradle builds of JavaFX > on Linux, macOS, and Windows. It is the third of three changes that close the > gaps in the JavaFX build security: > > * [JDK-8262236][1]: Configure Gradle checksum verification > * [JDK-8263204][2]: Add Gradle

Re: RFR: 8264010: Add Gradle dependency verification

2021-03-23 Thread Kevin Rushforth
On Tue, 23 Mar 2021 05:32:04 GMT, John Neffenger wrote: > This pull request adds dependency verification to the Gradle builds of JavaFX > on Linux, macOS, and Windows. It is the third of three changes that close the > gaps in the JavaFX build security: > > * [JDK-8262236][1]: Configure Gradle

RFR: 8264010: Add Gradle dependency verification

2021-03-22 Thread John Neffenger
This pull request adds dependency verification to the Gradle builds of JavaFX on Linux, macOS, and Windows. It is the third of three changes that close the gaps in the JavaFX build security: * [JDK-8262236][1]: Configure Gradle checksum verification * [JDK-8263204][2]: Add Gradle Wrapper