You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ant.apache.org by "raboof (via GitHub)" <gi...@apache.org> on 2026/07/09 16:05:20 UTC
[PR] fix: make module attribute string encoding deterministic [ant-ivy]
raboof opened a new pull request, #127:
URL: https://github.com/apache/ant-ivy/pull/127
This value makes it into the `pom.xml`'s `extraDependencyAttributes` property at least for SBT, and it'd be good to have this be deterministic: aside from general hygiene, generating them bit-by-bit reproducibly helps validating no malware was sneaked into the artifacts. This is also called 'Reproducible Builds' (https://reproducible-builds.org/)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: [PR] fix: make module attribute string encoding deterministic [ant-ivy]
Posted by "bodewig (via GitHub)" <gi...@apache.org>.
bodewig commented on PR #127:
URL: https://github.com/apache/ant-ivy/pull/127#issuecomment-4934043499
thank you
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: [PR] fix: make module attribute string encoding deterministic [ant-ivy]
Posted by "bodewig (via GitHub)" <gi...@apache.org>.
bodewig commented on PR #127:
URL: https://github.com/apache/ant-ivy/pull/127#issuecomment-4928931838
https://github.com/sbt/librarymanagement/blob/2b23ada9ab5ae2615823d44c82a18cd325e567e6/ivy/src/main/scala/sbt/internal/librarymanagement/mavenint/PomExtraDependencyAttributes.scala#L127 likely is the connection I was missing.
Regardless of whether we merge the PR or not, you will need to ensure the SBT folks pick it up as well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: [PR] fix: make module attribute string encoding deterministic [ant-ivy]
Posted by "raboof (via GitHub)" <gi...@apache.org>.
raboof commented on PR #127:
URL: https://github.com/apache/ant-ivy/pull/127#issuecomment-4929541707
Jep, that's the place
I'm aware I'll have to propose it to sbt/ivy separately, but it seemed neatest to first submit it here 'upstream' before 'backporting' it to their fork
On July 9, 2026 9:47:59 PM GMT+02:00, Stefan Bodewig ***@***.***> wrote:
>bodewig left a comment (apache/ant-ivy#127)
>
>https://github.com/sbt/librarymanagement/blob/2b23ada9ab5ae2615823d44c82a18cd325e567e6/ivy/src/main/scala/sbt/internal/librarymanagement/mavenint/PomExtraDependencyAttributes.scala#L127 likely is the connection I was missing.
>
>Regardless of whether we merge the PR or not, you will need to ensure the SBT folks pick it up as well.
>
>--
>Reply to this email directly or view it on GitHub:
>https://github.com/apache/ant-ivy/pull/127#issuecomment-4928931838
>You are receiving this because you authored the thread.
>
>Message ID: ***@***.***>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: [PR] fix: make module attribute string encoding deterministic [ant-ivy]
Posted by "raboof (via GitHub)" <gi...@apache.org>.
raboof commented on PR #127:
URL: https://github.com/apache/ant-ivy/pull/127#issuecomment-4932637799
Yes - thanks for the fast review!
On 10 July 2026 07:52:56 CEST, Stefan Bodewig ***@***.***> wrote:
>bodewig left a comment (apache/ant-ivy#127)
>
>We mention people who have contributed in the release notes. Is this fine with you and is "Arnout Engelen" the name I shall use?
>
>--
>Reply to this email directly or view it on GitHub:
>https://github.com/apache/ant-ivy/pull/127#issuecomment-4932411855
>You are receiving this because you authored the thread.
>
>Message ID: ***@***.***>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: [PR] fix: make module attribute string encoding deterministic [ant-ivy]
Posted by "bodewig (via GitHub)" <gi...@apache.org>.
bodewig commented on PR #127:
URL: https://github.com/apache/ant-ivy/pull/127#issuecomment-4928826597
I'm really not opposed to making things more deterministic, although Ivy and Ant itself probably have a long way to go to make reproducible builds easier.
But I currently fail to make the connection between the code you changed and `extraDependencyAttributes`. Grepping for the string in Ivy's code base doesn't find anything.
Please note the SBT fork of Ivy is based on a pretty old version of Ivy.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: [PR] fix: make module attribute string encoding deterministic [ant-ivy]
Posted by "bodewig (via GitHub)" <gi...@apache.org>.
bodewig merged PR #127:
URL: https://github.com/apache/ant-ivy/pull/127
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: [PR] fix: make module attribute string encoding deterministic [ant-ivy]
Posted by "bodewig (via GitHub)" <gi...@apache.org>.
bodewig commented on PR #127:
URL: https://github.com/apache/ant-ivy/pull/127#issuecomment-4983229959
@raboof if you talk to the SBT Ivy people. you may want them to pick up 8644f1b12e17ec1d5d013d7ef84cc830ff5a6bf5 as well because of CVE-2026-26032
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: [PR] fix: make module attribute string encoding deterministic [ant-ivy]
Posted by "bodewig (via GitHub)" <gi...@apache.org>.
bodewig commented on PR #127:
URL: https://github.com/apache/ant-ivy/pull/127#issuecomment-4932411855
We mention people who have contributed in the release notes. Is this fine with you and is "Arnout Engelen" the name I shall use?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org