Re: [compress] How to implement zip-bomb protection with Java 10

2018-04-08 Thread Andreas Beeker
Just a short update on this - I've provided a patch for POI to use commons compress [1] So now we can focus on how the zip bomb handling can be provided by commons compress, i.e. as you already have mentioned with "InputStream will be a FooInputStream", some kind of interface which the InputStrea

[SANDBOX] upgrade openpgp to current bouncycastle

2018-08-31 Thread Andreas Beeker
Hi, POI is using openpgp for its release process and I'd like to update it to the current bouncycastle version, i.e. I've done it already locally, but I'd prefer if the Apache repo [1] could be updated too. How could we achieve this? (provide a patch file / D-I-Y ;) / ...) Best wishes, Andi

[openpgp] OpenPGP update?

2018-12-31 Thread Andreas Beeker
Hi *, I'd like to get a new release/snapshot of OpenGPG [1], which we/I use for releasing the POI artifacts. Currently I need to install it into my local repo before releasing - it would be easier, if it would be available on the snapshot repo [2]. Who may I nag about committing the patch? Be

Re: [openpgp] OpenPGP update?

2019-01-19 Thread Andreas Beeker
Hi Gilles, sorry for not responding immediately, but I had to sort out something on my other projects first. The Commons PMC has voted write-access to all Apache committers. [It does not necessarily work right away; please test.] I've tried to commit, but to no avail - see the log below [1].

Re: [openpgp] OpenPGP update?

2019-01-21 Thread Andreas Beeker
You have to use https: in order to have write access. http: is read-only. Thank you sebb for pointing this out. It's working now and I've created a Jenkins job to keep the snapshot repo uptodate: https://builds.apache.org/view/P/view/POI/job/POI-Commons-OpenPGP/ I didn't find a Jenkins subfol