You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@flex.apache.org by Christofer Dutz <ch...@c-ware.de> on 2015/10/06 11:37:55 UTC

Starting to clean-up things

Ok ... so for today I first tried to find out the maven artifact corrdinates of the stuff we need in the flex-sdk.


Also, as all of the projects that needed patching seem to be Apache projects, I subscribed to their dev-lists and asked for directions on how to get our fixes into the official projects.


For Xalan this seems to be pretty easy ... for velocity and batik this will be a little difficult as I have to find out what Adobe thought to do differently ... unfortunately they "fixed" things by forking the packages (introducing a "fork" part into the package). Will have to manually extract and undo the package renaming and compare that to the original code. Hopefully as a result I will be able to fix up a patch, that I can submit.


Ideally there could be releases of Xalan, Velocity and Batik containing the fixes we rely on.


After that the next step would be to adjust the flex-sdk to work with the new versions and completely remove the patch stuff. This would definitely make things a lot easier.


Also I thing we could remove a lot of the licensing stuff from the build as in the meanwhile most of the projects (xml-apis, xml-apis-ext, batik, ...) have been donated to Apache, hereby no longer needing any special attention.


Chris

Re: Starting to clean-up things

Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,

>> Also I thing we could remove a lot of the licensing stuff from the build
>> as in the meanwhile most of the projects (xml-apis, xml-apis-ext, batik,
>> ...) have been donated to Apache, hereby no longer needing any special
>> attention.
> 
> IIRC, that isn’t the case, but I’d want to hear Justin’s thoughts on this.

The LICENSE / NOTICE  needs to reflect the version of the software used.

But probably it's more important from a security and bug fix point of
view to try and use the latest software if at all possible.

Thanks,
Justin

Re: Starting to clean-up things

Posted by Alex Harui <ah...@adobe.com>.

On 10/6/15, 2:37 AM, "Christofer Dutz" <ch...@c-ware.de> wrote:
>
>For Xalan this seems to be pretty easy ... for velocity and batik this
>will be a little difficult as I have to find out what Adobe thought to do
>differently ... unfortunately they "fixed" things by forking the packages
>(introducing a "fork" part into the package). Will have to manually
>extract and undo the package renaming and compare that to the original
>code. Hopefully as a result I will be able to fix up a patch, that I can
>submit.

I could be wrong, but I’m pretty sure that Adobe added non-compliant CSS
capabilities.  AIUI, in CSS, non-standard property names are supposed to
be prefixed with “-“ but Adobe just chose to add new properties without
the prefix.  Things like “borderThickness” instead of “borderWidth” come
to mind.  So I’ve never pushed towards applying these changes back to
Batik.  I didn’t think their community would want it.

That said, I think the forks are complete source files instead of just
patches.  It might be worth the trouble to figure out the actually
patch/diff so it is clearer what was added and then the build could just
apply that patch to a source release of Batik, but I’d be tempted to give
it a different package name so folks realize it is non-compliant.

You might find the same to be true for the Xalan and Velocity changes.
Their mainstream sources may not want what Adobe did.  Not sure.

>
>Also I thing we could remove a lot of the licensing stuff from the build
>as in the meanwhile most of the projects (xml-apis, xml-apis-ext, batik,
>...) have been donated to Apache, hereby no longer needing any special
>attention.

IIRC, that isn’t the case, but I’d want to hear Justin’s thoughts on this.
 AIUI, we currently use old versions of these dependencies which are not
under AL2.0 (some are earlier versions of AL) so the LICENSE and NOTICE
are correct.  Now if you take on upgrading Flex to uses the latest
versions of these dependencies that are under AL2.0, that would simplify L
& N, but is it worth it?  If you’ve got the time, no objection from me.

-Alex