You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@cordova.apache.org by Steven Gill <st...@gmail.com> on 2014/08/08 20:11:54 UTC
[Discuss] 3.6.0 Release
How does everyone feel about me starting the release process next Tuesday,
August 12, 2014?
Will your platform be ready?
RE: [Discuss] 3.6.0 Release
Posted by "Parashuram Narasimhan (MS OPEN TECH)" <pa...@microsoft.com>.
Wanted to ping about the 3.6.0 thread. Are all the open issues taken care of? Is there something we can help on?
-----Original Message-----
From: Josh Soref [mailto:jsoref@blackberry.com]
Sent: Tuesday, August 19, 2014 1:11 PM
To: dev@cordova.apache.org
Subject: Re: [Discuss] 3.6.0 Release
Mark Koudritsky wrote:
>npm info cordova-blackberry10 --- 404
>npm info cordova-blackberry --- OK
>
>cli is looking for blackberry10 as npm name but it's blckberry.
>I think the altplatform: 'blackberry' in platforms.js can solve this.
Nope, that's for the internal directory name, not the external package name.
https://github.com/apache/cordova-lib/pull/75
Would address this, except that the 3.5 package doesn't include its dependencies… so the pull request includes code to handle that too.
Re: [Discuss] 3.6.0 Release
Posted by Josh Soref <js...@blackberry.com>.
Mark Koudritsky wrote:
>npm info cordova-blackberry10 --- 404
>npm info cordova-blackberry --- OK
>
>cli is looking for blackberry10 as npm name but it's blckberry.
>I think the altplatform: 'blackberry' in platforms.js can solve this.
Nope, that's for the internal directory name, not the external package
name.
https://github.com/apache/cordova-lib/pull/75
Would address this, except that the 3.5 package doesn't include its
dependencies…
so the pull request includes code to handle that too.
Re: [Discuss] 3.6.0 Release
Posted by Mark Koudritsky <ka...@google.com>.
npm info cordova-blackberry10 --- 404
npm info cordova-blackberry --- OK
cli is looking for blackberry10 as npm name but it's blckberry.
I think the altplatform: 'blackberry' in platforms.js can solve this.
Re: [Discuss] 3.6.0 Release
Posted by Steven Gill <st...@gmail.com>.
I did publish it before.
https://www.npmjs.org/package/cordova-blackberry
On Tuesday, August 19, 2014, Andrew Grieve <ag...@chromium.org> wrote:
> Seems bb10 was just never published to npm. Josh want to take a stab at
> this? Should be as simple checking out the tag and typing "npm publish"
>
>
> On Tue, Aug 19, 2014 at 12:15 PM, Josh Soref <jsoref@blackberry.com
> <javascript:;>> wrote:
>
> > Steven Gill wrote:
> > >How does everyone feel about me starting the release process next
> Tuesday,
> > >August 12, 2014?
> > >
> > >Will your platform be ready?
> >
> > My platform is definitely not ready, since apparently the npm by-default
> > stuff broke blackberry10.
> >
> > I don't have the keys for the registry, and Bryan is on vacation.
> >
> > https://issues.apache.org/jira/browse/CB-7336
> >
> >
>
Re: [Discuss] 3.6.0 Release
Posted by Andrew Grieve <ag...@chromium.org>.
Seems bb10 was just never published to npm. Josh want to take a stab at
this? Should be as simple checking out the tag and typing "npm publish"
On Tue, Aug 19, 2014 at 12:15 PM, Josh Soref <js...@blackberry.com> wrote:
> Steven Gill wrote:
> >How does everyone feel about me starting the release process next Tuesday,
> >August 12, 2014?
> >
> >Will your platform be ready?
>
> My platform is definitely not ready, since apparently the npm by-default
> stuff broke blackberry10.
>
> I don't have the keys for the registry, and Bryan is on vacation.
>
> https://issues.apache.org/jira/browse/CB-7336
>
>
Re: [Discuss] 3.6.0 Release
Posted by Josh Soref <js...@blackberry.com>.
Steven Gill wrote:
>How does everyone feel about me starting the release process next Tuesday,
>August 12, 2014?
>
>Will your platform be ready?
My platform is definitely not ready, since apparently the npm by-default
stuff broke blackberry10.
I don't have the keys for the registry, and Bryan is on vacation.
https://issues.apache.org/jira/browse/CB-7336
RE: [Discuss] 3.6.0 Release
Posted by Chuck Lantz <cl...@microsoft.com>.
A related topic as it pertains to CSP: If we are going down the CSP path, what are people's thoughts on the security risks associated with inline script ("unsafe-inline") use as a part of the default policy - particularly from content originating from outside of the Cordova app package? It's obviously a common practice, but XSS risk inside the app is higher with it enabled.
-Chuck
-----Original Message-----
From: iclelland@google.com [mailto:iclelland@google.com] On Behalf Of Ian Clelland
Sent: Tuesday, August 12, 2014 8:55 AM
To: dev@cordova.apache.org
Subject: Re: [Discuss] 3.6.0 Release
I love the idea of using CSP for this, especially because it handles things that our whitelist intercept code can't, like <video> tags and WebSockets.
The problem that I've found with it is that we can only enforce it for single-page apps. We can inject our own CSP headers into the application's start page very easily, but if the user can leave that page and load another, then the headers will no longer apply. The WebView interface won't let use add headers to subsequent pages, so it's up to the developer to include them in a <meta> tag instead. (and malicious attackers, of course,
won't)
For now, I would encourage devs to include that <meta> tag on *all* of the pages in their apps, but we can't do it automatically.
If it turns out that we can, then I'd be on board with including that in the 4.0 branch. It's a much better way to do it. Then we'd only need the second whitelist for launching intents, I think.
Ian
On Tue, Aug 12, 2014 at 11:48 AM, Parashuram Narasimhan (MS OPEN TECH) < panarasi@microsoft.com> wrote:
> Had a quick question on the whitelists. I remember that there was talk
> of using CSP to fix this issue. A CSP file may not be backward
> compatible, but could potentially just give us one list instead of 2
> whitelists. The CSP file may be like the following
>
> Content-Security-Policy:
> script-src 'self', foo.com, bar.com
> img-src cdn.com
> intent-src mail, sms
>
> Note the new intent-src directive, that is basically used to launch
> external programs. Do you think this could be something we can look
> at, for
> 4.0 ? I am not sure if our whitelist xml file maps to a W3C spec, but
> CSP seems more like a standard. This is breaking, and 4.0 may be the
> right time to do it ?
>
> -----Original Message-----
> From: iclelland@google.com [mailto:iclelland@google.com] On Behalf Of
> Ian Clelland
> Sent: Tuesday, August 12, 2014 8:30 AM
> To: dev@cordova.apache.org
> Subject: Re: [Discuss] 3.6.0 Release
>
> I've created CB-7291 for the whitelist issue, and I've ported the code
> from June to the new-style configuration architecture and committed it
> to a named CB-7291 branch on cordova-android.
>
> If anyone has any thoughts/opinions on the syntax or the proposal
> itself, or on what the defaults should be for new and upgrading
> applications, please chime in on the issue.
>
>
>
> On Mon, Aug 11, 2014 at 11:26 AM, Parashuram Narasimhan (MS OPEN TECH)
> < panarasi@microsoft.com> wrote:
>
> > I think we should also finalize on the platform switches so that we
> > all agree on a pattern (even if it is different across platforms).
> > This way, we can release 3.6.0 with a set of switches, and ensure
> > that it is backward compatible.
> >
> >
> > -----Original Message-----
> > From: iclelland@google.com [mailto:iclelland@google.com] On Behalf
> > Of Ian Clelland
> > Sent: Monday, August 11, 2014 8:00 AM
> > To: dev@cordova.apache.org
> > Subject: Re: [Discuss] 3.6.0 Release
> >
> > I'll see about committing that today; I've had to reorganize it
> > quite a bit after the Big Config Refactor.
> >
> > Joe, I'm pretty certain that your code is still in master, but
> > definitely add those tests to make sure, and to make sure we don't
> regress.
> >
> > Ian
> >
> >
> > On Mon, Aug 11, 2014 at 10:52 AM, Marcel Kinard <cm...@gmail.com>
> > wrote:
> >
> > > I agree with Joe.
> > >
> > > On Aug 11, 2014, at 10:02 AM, Joe Bowser <bo...@gmail.com> wrote:
> > >
> > > > Let's not release until the new whitelist is figured out. That
> > > > feature
> > > is
> > > > too important.
> > >
> >
>
Re: [Discuss] 3.6.0 Release
Posted by Maxim Ermilov <ma...@canonical.com>.
Could you review/merge following changes before release?
https://github.com/apache/cordova-ubuntu/pull/8
https://github.com/apache/cordova-lib/pull/73
---Maxim
RE: [Discuss] 3.6.0 Release
Posted by "Parashuram Narasimhan (MS OPEN TECH)" <pa...@microsoft.com>.
The command line switches have been finalized for 3.6.0. Once that is merged, we should be good to release 3.6.0 from windows perspective.
-----Original Message-----
From: iclelland@google.com [mailto:iclelland@google.com] On Behalf Of Ian Clelland
Sent: Tuesday, August 12, 2014 1:00 PM
To: dev@cordova.apache.org
Subject: Re: [Discuss] 3.6.0 Release
I think that A) is likely the feasible solution for 3.6.0.
B) seems like a 4.0-scope project (but an interesting one; I hadn't considered it working in that direction) We'd probably spend a while debating the particulars -- I don't know if changing the CSP syntax is a good idea, or if we'd want an X-Navigation-Policy header of our own to play with -- but I think that a drastic change of direction like that would require a major version update if it's in core.
The other alternative I see (which goes back to the thread that Andrew
linked) is to pull 1, 2, and 3 out of the core, and have plugins for all of it.
What changes would we need to make to the plugin architecture to make that happen?
On Tue, Aug 12, 2014 at 3:16 PM, Andrew Grieve <ag...@chromium.org> wrote:
> A malicious XSS that navigates the page would probably opt to not
> include cordova.js :P.
>
> So - I see there being three kinds of things to have whitelists for:
> 1) Top-level navigations,
> 2) intents (on supported platforms)
> 3) resources / CSP-related requests.
>
> According to CSP docs here:
>
> https://developer.mozilla.org/en-US/docs/Web/Security/CSP/CSP_policy_d
> irectives
> You cannot use CSP to control 1).
>
> Right now the whitelist tries to cover 1) and 3), but I think from
> this
> thread: http://markmail.org/thread/hbr5tlopbbl4pnl3
> That we agreed to change it to cover only 1), Although this
> conversation will likely be more all-encompassing.
>
> Options for specifying 1), 2), 3):
> A) Keep all three separate, with 1) and 2) in config.xml, and 3) in a
> <meta> added by the user
> B) Augment the CSP syntax with support for 1) and 2) (as Parashuram
> suggested), and have cordova.js extract 1) and 2) out of the <meta>,
> which is added by the user. Make the whitelists empty until cordova.js
> does the extraction.
> C) Have them all specified in config.xml, and have Cordova somehow
> enforce
> 3) on page load.
>
> Another factor: What is put in config.xml is open to be modified by
> plugins (for better or for worse). Might be useful, but I'm not sure
> of a concrete use-case (maybe Camera plugin would need this?)
>
> As Ian pointed out, C) isn't really feasible on Android in all cases,
> but I'm torn between A) and B).
>
>
>
> On Tue, Aug 12, 2014 at 11:59 AM, Michal Mocny <mm...@chromium.org>
> wrote:
>
> > Any page navigations have to include cordova.js, right? What about
> > injecting the meta tag before deviceready?
> >
> >
> > On Tue, Aug 12, 2014 at 11:54 AM, Ian Clelland
> > <ic...@chromium.org>
> > wrote:
> >
> > > I love the idea of using CSP for this, especially because it
> > > handles
> > things
> > > that our whitelist intercept code can't, like <video> tags and
> > WebSockets.
> > >
> > > The problem that I've found with it is that we can only enforce it
> > > for single-page apps. We can inject our own CSP headers into the
> > application's
> > > start page very easily, but if the user can leave that page and
> > > load another, then the headers will no longer apply. The WebView
> > > interface
> > won't
> > > let use add headers to subsequent pages, so it's up to the
> > > developer to include them in a <meta> tag instead. (and malicious
> > > attackers, of
> > course,
> > > won't)
> > >
> > > For now, I would encourage devs to include that <meta> tag on
> > > *all* of
> > the
> > > pages in their apps, but we can't do it automatically.
> > >
> > > If it turns out that we can, then I'd be on board with including
> > > that
> in
> > > the 4.0 branch. It's a much better way to do it. Then we'd only
> > > need
> the
> > > second whitelist for launching intents, I think.
> > >
> > > Ian
> > >
> > >
> > > On Tue, Aug 12, 2014 at 11:48 AM, Parashuram Narasimhan (MS OPEN
> > > TECH)
> <
> > > panarasi@microsoft.com> wrote:
> > >
> > > > Had a quick question on the whitelists. I remember that there
> > > > was
> talk
> > of
> > > > using CSP to fix this issue. A CSP file may not be backward
> compatible,
> > > but
> > > > could potentially just give us one list instead of 2 whitelists.
> > > > The
> > CSP
> > > > file may be like the following
> > > >
> > > > Content-Security-Policy:
> > > > script-src 'self', foo.com, bar.com
> > > > img-src cdn.com
> > > > intent-src mail, sms
> > > >
> > > > Note the new intent-src directive, that is basically used to
> > > > launch external programs. Do you think this could be something
> > > > we can look
> at,
> > > for
> > > > 4.0 ? I am not sure if our whitelist xml file maps to a W3C
> > > > spec, but
> > CSP
> > > > seems more like a standard. This is breaking, and 4.0 may be the
> right
> > > time
> > > > to do it ?
> > > >
> > > > -----Original Message-----
> > > > From: iclelland@google.com [mailto:iclelland@google.com] On
> > > > Behalf
> Of
> > > Ian
> > > > Clelland
> > > > Sent: Tuesday, August 12, 2014 8:30 AM
> > > > To: dev@cordova.apache.org
> > > > Subject: Re: [Discuss] 3.6.0 Release
> > > >
> > > > I've created CB-7291 for the whitelist issue, and I've ported
> > > > the
> code
> > > > from June to the new-style configuration architecture and
> > > > committed
> it
> > > to a
> > > > named CB-7291 branch on cordova-android.
> > > >
> > > > If anyone has any thoughts/opinions on the syntax or the
> > > > proposal
> > itself,
> > > > or on what the defaults should be for new and upgrading
> > > > applications, please chime in on the issue.
> > > >
> > > >
> > > >
> > > > On Mon, Aug 11, 2014 at 11:26 AM, Parashuram Narasimhan (MS OPEN
> TECH)
> > <
> > > > panarasi@microsoft.com> wrote:
> > > >
> > > > > I think we should also finalize on the platform switches so
> > > > > that we all agree on a pattern (even if it is different across platforms).
> > > > > This way, we can release 3.6.0 with a set of switches, and
> > > > > ensure
> > that
> > > > > it is backward compatible.
> > > > >
> > > > >
> > > > > -----Original Message-----
> > > > > From: iclelland@google.com [mailto:iclelland@google.com] On
> > > > > Behalf
> > Of
> > > > > Ian Clelland
> > > > > Sent: Monday, August 11, 2014 8:00 AM
> > > > > To: dev@cordova.apache.org
> > > > > Subject: Re: [Discuss] 3.6.0 Release
> > > > >
> > > > > I'll see about committing that today; I've had to reorganize
> > > > > it
> quite
> > > > > a bit after the Big Config Refactor.
> > > > >
> > > > > Joe, I'm pretty certain that your code is still in master, but
> > > > > definitely add those tests to make sure, and to make sure we
> > > > > don't
> > > > regress.
> > > > >
> > > > > Ian
> > > > >
> > > > >
> > > > > On Mon, Aug 11, 2014 at 10:52 AM, Marcel Kinard <
> cmarcelk@gmail.com>
> > > > > wrote:
> > > > >
> > > > > > I agree with Joe.
> > > > > >
> > > > > > On Aug 11, 2014, at 10:02 AM, Joe Bowser <bo...@gmail.com>
> > wrote:
> > > > > >
> > > > > > > Let's not release until the new whitelist is figured out.
> > > > > > > That feature
> > > > > > is
> > > > > > > too important.
> > > > > >
> > > > >
> > > >
> > >
> >
>
Re: [Discuss] 3.6.0 Release
Posted by Ian Clelland <ic...@chromium.org>.
I think that A) is likely the feasible solution for 3.6.0.
B) seems like a 4.0-scope project (but an interesting one; I hadn't
considered it working in that direction)
We'd probably spend a while debating the particulars -- I don't know if
changing the CSP syntax is a good idea, or if we'd want an
X-Navigation-Policy header of our own to play with -- but I think that a
drastic change of direction like that would require a major version update
if it's in core.
The other alternative I see (which goes back to the thread that Andrew
linked) is to pull 1, 2, and 3 out of the core, and have plugins for all of
it.
What changes would we need to make to the plugin architecture to make that
happen?
On Tue, Aug 12, 2014 at 3:16 PM, Andrew Grieve <ag...@chromium.org> wrote:
> A malicious XSS that navigates the page would probably opt to not include
> cordova.js :P.
>
> So - I see there being three kinds of things to have whitelists for:
> 1) Top-level navigations,
> 2) intents (on supported platforms)
> 3) resources / CSP-related requests.
>
> According to CSP docs here:
>
> https://developer.mozilla.org/en-US/docs/Web/Security/CSP/CSP_policy_directives
> You cannot use CSP to control 1).
>
> Right now the whitelist tries to cover 1) and 3), but I think from this
> thread: http://markmail.org/thread/hbr5tlopbbl4pnl3
> That we agreed to change it to cover only 1), Although this conversation
> will likely be more all-encompassing.
>
> Options for specifying 1), 2), 3):
> A) Keep all three separate, with 1) and 2) in config.xml, and 3) in a
> <meta> added by the user
> B) Augment the CSP syntax with support for 1) and 2) (as Parashuram
> suggested), and have cordova.js extract 1) and 2) out of the <meta>, which
> is added by the user. Make the whitelists empty until cordova.js does the
> extraction.
> C) Have them all specified in config.xml, and have Cordova somehow enforce
> 3) on page load.
>
> Another factor: What is put in config.xml is open to be modified by plugins
> (for better or for worse). Might be useful, but I'm not sure of a concrete
> use-case (maybe Camera plugin would need this?)
>
> As Ian pointed out, C) isn't really feasible on Android in all cases, but
> I'm torn between A) and B).
>
>
>
> On Tue, Aug 12, 2014 at 11:59 AM, Michal Mocny <mm...@chromium.org>
> wrote:
>
> > Any page navigations have to include cordova.js, right? What about
> > injecting the meta tag before deviceready?
> >
> >
> > On Tue, Aug 12, 2014 at 11:54 AM, Ian Clelland <ic...@chromium.org>
> > wrote:
> >
> > > I love the idea of using CSP for this, especially because it handles
> > things
> > > that our whitelist intercept code can't, like <video> tags and
> > WebSockets.
> > >
> > > The problem that I've found with it is that we can only enforce it for
> > > single-page apps. We can inject our own CSP headers into the
> > application's
> > > start page very easily, but if the user can leave that page and load
> > > another, then the headers will no longer apply. The WebView interface
> > won't
> > > let use add headers to subsequent pages, so it's up to the developer to
> > > include them in a <meta> tag instead. (and malicious attackers, of
> > course,
> > > won't)
> > >
> > > For now, I would encourage devs to include that <meta> tag on *all* of
> > the
> > > pages in their apps, but we can't do it automatically.
> > >
> > > If it turns out that we can, then I'd be on board with including that
> in
> > > the 4.0 branch. It's a much better way to do it. Then we'd only need
> the
> > > second whitelist for launching intents, I think.
> > >
> > > Ian
> > >
> > >
> > > On Tue, Aug 12, 2014 at 11:48 AM, Parashuram Narasimhan (MS OPEN TECH)
> <
> > > panarasi@microsoft.com> wrote:
> > >
> > > > Had a quick question on the whitelists. I remember that there was
> talk
> > of
> > > > using CSP to fix this issue. A CSP file may not be backward
> compatible,
> > > but
> > > > could potentially just give us one list instead of 2 whitelists. The
> > CSP
> > > > file may be like the following
> > > >
> > > > Content-Security-Policy:
> > > > script-src 'self', foo.com, bar.com
> > > > img-src cdn.com
> > > > intent-src mail, sms
> > > >
> > > > Note the new intent-src directive, that is basically used to launch
> > > > external programs. Do you think this could be something we can look
> at,
> > > for
> > > > 4.0 ? I am not sure if our whitelist xml file maps to a W3C spec, but
> > CSP
> > > > seems more like a standard. This is breaking, and 4.0 may be the
> right
> > > time
> > > > to do it ?
> > > >
> > > > -----Original Message-----
> > > > From: iclelland@google.com [mailto:iclelland@google.com] On Behalf
> Of
> > > Ian
> > > > Clelland
> > > > Sent: Tuesday, August 12, 2014 8:30 AM
> > > > To: dev@cordova.apache.org
> > > > Subject: Re: [Discuss] 3.6.0 Release
> > > >
> > > > I've created CB-7291 for the whitelist issue, and I've ported the
> code
> > > > from June to the new-style configuration architecture and committed
> it
> > > to a
> > > > named CB-7291 branch on cordova-android.
> > > >
> > > > If anyone has any thoughts/opinions on the syntax or the proposal
> > itself,
> > > > or on what the defaults should be for new and upgrading applications,
> > > > please chime in on the issue.
> > > >
> > > >
> > > >
> > > > On Mon, Aug 11, 2014 at 11:26 AM, Parashuram Narasimhan (MS OPEN
> TECH)
> > <
> > > > panarasi@microsoft.com> wrote:
> > > >
> > > > > I think we should also finalize on the platform switches so that we
> > > > > all agree on a pattern (even if it is different across platforms).
> > > > > This way, we can release 3.6.0 with a set of switches, and ensure
> > that
> > > > > it is backward compatible.
> > > > >
> > > > >
> > > > > -----Original Message-----
> > > > > From: iclelland@google.com [mailto:iclelland@google.com] On Behalf
> > Of
> > > > > Ian Clelland
> > > > > Sent: Monday, August 11, 2014 8:00 AM
> > > > > To: dev@cordova.apache.org
> > > > > Subject: Re: [Discuss] 3.6.0 Release
> > > > >
> > > > > I'll see about committing that today; I've had to reorganize it
> quite
> > > > > a bit after the Big Config Refactor.
> > > > >
> > > > > Joe, I'm pretty certain that your code is still in master, but
> > > > > definitely add those tests to make sure, and to make sure we don't
> > > > regress.
> > > > >
> > > > > Ian
> > > > >
> > > > >
> > > > > On Mon, Aug 11, 2014 at 10:52 AM, Marcel Kinard <
> cmarcelk@gmail.com>
> > > > > wrote:
> > > > >
> > > > > > I agree with Joe.
> > > > > >
> > > > > > On Aug 11, 2014, at 10:02 AM, Joe Bowser <bo...@gmail.com>
> > wrote:
> > > > > >
> > > > > > > Let's not release until the new whitelist is figured out. That
> > > > > > > feature
> > > > > > is
> > > > > > > too important.
> > > > > >
> > > > >
> > > >
> > >
> >
>
Re: [Discuss] 3.6.0 Release
Posted by Andrew Grieve <ag...@chromium.org>.
A malicious XSS that navigates the page would probably opt to not include
cordova.js :P.
So - I see there being three kinds of things to have whitelists for:
1) Top-level navigations,
2) intents (on supported platforms)
3) resources / CSP-related requests.
According to CSP docs here:
https://developer.mozilla.org/en-US/docs/Web/Security/CSP/CSP_policy_directives
You cannot use CSP to control 1).
Right now the whitelist tries to cover 1) and 3), but I think from this
thread: http://markmail.org/thread/hbr5tlopbbl4pnl3
That we agreed to change it to cover only 1), Although this conversation
will likely be more all-encompassing.
Options for specifying 1), 2), 3):
A) Keep all three separate, with 1) and 2) in config.xml, and 3) in a
<meta> added by the user
B) Augment the CSP syntax with support for 1) and 2) (as Parashuram
suggested), and have cordova.js extract 1) and 2) out of the <meta>, which
is added by the user. Make the whitelists empty until cordova.js does the
extraction.
C) Have them all specified in config.xml, and have Cordova somehow enforce
3) on page load.
Another factor: What is put in config.xml is open to be modified by plugins
(for better or for worse). Might be useful, but I'm not sure of a concrete
use-case (maybe Camera plugin would need this?)
As Ian pointed out, C) isn't really feasible on Android in all cases, but
I'm torn between A) and B).
On Tue, Aug 12, 2014 at 11:59 AM, Michal Mocny <mm...@chromium.org> wrote:
> Any page navigations have to include cordova.js, right? What about
> injecting the meta tag before deviceready?
>
>
> On Tue, Aug 12, 2014 at 11:54 AM, Ian Clelland <ic...@chromium.org>
> wrote:
>
> > I love the idea of using CSP for this, especially because it handles
> things
> > that our whitelist intercept code can't, like <video> tags and
> WebSockets.
> >
> > The problem that I've found with it is that we can only enforce it for
> > single-page apps. We can inject our own CSP headers into the
> application's
> > start page very easily, but if the user can leave that page and load
> > another, then the headers will no longer apply. The WebView interface
> won't
> > let use add headers to subsequent pages, so it's up to the developer to
> > include them in a <meta> tag instead. (and malicious attackers, of
> course,
> > won't)
> >
> > For now, I would encourage devs to include that <meta> tag on *all* of
> the
> > pages in their apps, but we can't do it automatically.
> >
> > If it turns out that we can, then I'd be on board with including that in
> > the 4.0 branch. It's a much better way to do it. Then we'd only need the
> > second whitelist for launching intents, I think.
> >
> > Ian
> >
> >
> > On Tue, Aug 12, 2014 at 11:48 AM, Parashuram Narasimhan (MS OPEN TECH) <
> > panarasi@microsoft.com> wrote:
> >
> > > Had a quick question on the whitelists. I remember that there was talk
> of
> > > using CSP to fix this issue. A CSP file may not be backward compatible,
> > but
> > > could potentially just give us one list instead of 2 whitelists. The
> CSP
> > > file may be like the following
> > >
> > > Content-Security-Policy:
> > > script-src 'self', foo.com, bar.com
> > > img-src cdn.com
> > > intent-src mail, sms
> > >
> > > Note the new intent-src directive, that is basically used to launch
> > > external programs. Do you think this could be something we can look at,
> > for
> > > 4.0 ? I am not sure if our whitelist xml file maps to a W3C spec, but
> CSP
> > > seems more like a standard. This is breaking, and 4.0 may be the right
> > time
> > > to do it ?
> > >
> > > -----Original Message-----
> > > From: iclelland@google.com [mailto:iclelland@google.com] On Behalf Of
> > Ian
> > > Clelland
> > > Sent: Tuesday, August 12, 2014 8:30 AM
> > > To: dev@cordova.apache.org
> > > Subject: Re: [Discuss] 3.6.0 Release
> > >
> > > I've created CB-7291 for the whitelist issue, and I've ported the code
> > > from June to the new-style configuration architecture and committed it
> > to a
> > > named CB-7291 branch on cordova-android.
> > >
> > > If anyone has any thoughts/opinions on the syntax or the proposal
> itself,
> > > or on what the defaults should be for new and upgrading applications,
> > > please chime in on the issue.
> > >
> > >
> > >
> > > On Mon, Aug 11, 2014 at 11:26 AM, Parashuram Narasimhan (MS OPEN TECH)
> <
> > > panarasi@microsoft.com> wrote:
> > >
> > > > I think we should also finalize on the platform switches so that we
> > > > all agree on a pattern (even if it is different across platforms).
> > > > This way, we can release 3.6.0 with a set of switches, and ensure
> that
> > > > it is backward compatible.
> > > >
> > > >
> > > > -----Original Message-----
> > > > From: iclelland@google.com [mailto:iclelland@google.com] On Behalf
> Of
> > > > Ian Clelland
> > > > Sent: Monday, August 11, 2014 8:00 AM
> > > > To: dev@cordova.apache.org
> > > > Subject: Re: [Discuss] 3.6.0 Release
> > > >
> > > > I'll see about committing that today; I've had to reorganize it quite
> > > > a bit after the Big Config Refactor.
> > > >
> > > > Joe, I'm pretty certain that your code is still in master, but
> > > > definitely add those tests to make sure, and to make sure we don't
> > > regress.
> > > >
> > > > Ian
> > > >
> > > >
> > > > On Mon, Aug 11, 2014 at 10:52 AM, Marcel Kinard <cm...@gmail.com>
> > > > wrote:
> > > >
> > > > > I agree with Joe.
> > > > >
> > > > > On Aug 11, 2014, at 10:02 AM, Joe Bowser <bo...@gmail.com>
> wrote:
> > > > >
> > > > > > Let's not release until the new whitelist is figured out. That
> > > > > > feature
> > > > > is
> > > > > > too important.
> > > > >
> > > >
> > >
> >
>
Re: [Discuss] 3.6.0 Release
Posted by Michal Mocny <mm...@chromium.org>.
Any page navigations have to include cordova.js, right? What about
injecting the meta tag before deviceready?
On Tue, Aug 12, 2014 at 11:54 AM, Ian Clelland <ic...@chromium.org>
wrote:
> I love the idea of using CSP for this, especially because it handles things
> that our whitelist intercept code can't, like <video> tags and WebSockets.
>
> The problem that I've found with it is that we can only enforce it for
> single-page apps. We can inject our own CSP headers into the application's
> start page very easily, but if the user can leave that page and load
> another, then the headers will no longer apply. The WebView interface won't
> let use add headers to subsequent pages, so it's up to the developer to
> include them in a <meta> tag instead. (and malicious attackers, of course,
> won't)
>
> For now, I would encourage devs to include that <meta> tag on *all* of the
> pages in their apps, but we can't do it automatically.
>
> If it turns out that we can, then I'd be on board with including that in
> the 4.0 branch. It's a much better way to do it. Then we'd only need the
> second whitelist for launching intents, I think.
>
> Ian
>
>
> On Tue, Aug 12, 2014 at 11:48 AM, Parashuram Narasimhan (MS OPEN TECH) <
> panarasi@microsoft.com> wrote:
>
> > Had a quick question on the whitelists. I remember that there was talk of
> > using CSP to fix this issue. A CSP file may not be backward compatible,
> but
> > could potentially just give us one list instead of 2 whitelists. The CSP
> > file may be like the following
> >
> > Content-Security-Policy:
> > script-src 'self', foo.com, bar.com
> > img-src cdn.com
> > intent-src mail, sms
> >
> > Note the new intent-src directive, that is basically used to launch
> > external programs. Do you think this could be something we can look at,
> for
> > 4.0 ? I am not sure if our whitelist xml file maps to a W3C spec, but CSP
> > seems more like a standard. This is breaking, and 4.0 may be the right
> time
> > to do it ?
> >
> > -----Original Message-----
> > From: iclelland@google.com [mailto:iclelland@google.com] On Behalf Of
> Ian
> > Clelland
> > Sent: Tuesday, August 12, 2014 8:30 AM
> > To: dev@cordova.apache.org
> > Subject: Re: [Discuss] 3.6.0 Release
> >
> > I've created CB-7291 for the whitelist issue, and I've ported the code
> > from June to the new-style configuration architecture and committed it
> to a
> > named CB-7291 branch on cordova-android.
> >
> > If anyone has any thoughts/opinions on the syntax or the proposal itself,
> > or on what the defaults should be for new and upgrading applications,
> > please chime in on the issue.
> >
> >
> >
> > On Mon, Aug 11, 2014 at 11:26 AM, Parashuram Narasimhan (MS OPEN TECH) <
> > panarasi@microsoft.com> wrote:
> >
> > > I think we should also finalize on the platform switches so that we
> > > all agree on a pattern (even if it is different across platforms).
> > > This way, we can release 3.6.0 with a set of switches, and ensure that
> > > it is backward compatible.
> > >
> > >
> > > -----Original Message-----
> > > From: iclelland@google.com [mailto:iclelland@google.com] On Behalf Of
> > > Ian Clelland
> > > Sent: Monday, August 11, 2014 8:00 AM
> > > To: dev@cordova.apache.org
> > > Subject: Re: [Discuss] 3.6.0 Release
> > >
> > > I'll see about committing that today; I've had to reorganize it quite
> > > a bit after the Big Config Refactor.
> > >
> > > Joe, I'm pretty certain that your code is still in master, but
> > > definitely add those tests to make sure, and to make sure we don't
> > regress.
> > >
> > > Ian
> > >
> > >
> > > On Mon, Aug 11, 2014 at 10:52 AM, Marcel Kinard <cm...@gmail.com>
> > > wrote:
> > >
> > > > I agree with Joe.
> > > >
> > > > On Aug 11, 2014, at 10:02 AM, Joe Bowser <bo...@gmail.com> wrote:
> > > >
> > > > > Let's not release until the new whitelist is figured out. That
> > > > > feature
> > > > is
> > > > > too important.
> > > >
> > >
> >
>
Re: [Discuss] 3.6.0 Release
Posted by Ian Clelland <ic...@chromium.org>.
I love the idea of using CSP for this, especially because it handles things
that our whitelist intercept code can't, like <video> tags and WebSockets.
The problem that I've found with it is that we can only enforce it for
single-page apps. We can inject our own CSP headers into the application's
start page very easily, but if the user can leave that page and load
another, then the headers will no longer apply. The WebView interface won't
let use add headers to subsequent pages, so it's up to the developer to
include them in a <meta> tag instead. (and malicious attackers, of course,
won't)
For now, I would encourage devs to include that <meta> tag on *all* of the
pages in their apps, but we can't do it automatically.
If it turns out that we can, then I'd be on board with including that in
the 4.0 branch. It's a much better way to do it. Then we'd only need the
second whitelist for launching intents, I think.
Ian
On Tue, Aug 12, 2014 at 11:48 AM, Parashuram Narasimhan (MS OPEN TECH) <
panarasi@microsoft.com> wrote:
> Had a quick question on the whitelists. I remember that there was talk of
> using CSP to fix this issue. A CSP file may not be backward compatible, but
> could potentially just give us one list instead of 2 whitelists. The CSP
> file may be like the following
>
> Content-Security-Policy:
> script-src 'self', foo.com, bar.com
> img-src cdn.com
> intent-src mail, sms
>
> Note the new intent-src directive, that is basically used to launch
> external programs. Do you think this could be something we can look at, for
> 4.0 ? I am not sure if our whitelist xml file maps to a W3C spec, but CSP
> seems more like a standard. This is breaking, and 4.0 may be the right time
> to do it ?
>
> -----Original Message-----
> From: iclelland@google.com [mailto:iclelland@google.com] On Behalf Of Ian
> Clelland
> Sent: Tuesday, August 12, 2014 8:30 AM
> To: dev@cordova.apache.org
> Subject: Re: [Discuss] 3.6.0 Release
>
> I've created CB-7291 for the whitelist issue, and I've ported the code
> from June to the new-style configuration architecture and committed it to a
> named CB-7291 branch on cordova-android.
>
> If anyone has any thoughts/opinions on the syntax or the proposal itself,
> or on what the defaults should be for new and upgrading applications,
> please chime in on the issue.
>
>
>
> On Mon, Aug 11, 2014 at 11:26 AM, Parashuram Narasimhan (MS OPEN TECH) <
> panarasi@microsoft.com> wrote:
>
> > I think we should also finalize on the platform switches so that we
> > all agree on a pattern (even if it is different across platforms).
> > This way, we can release 3.6.0 with a set of switches, and ensure that
> > it is backward compatible.
> >
> >
> > -----Original Message-----
> > From: iclelland@google.com [mailto:iclelland@google.com] On Behalf Of
> > Ian Clelland
> > Sent: Monday, August 11, 2014 8:00 AM
> > To: dev@cordova.apache.org
> > Subject: Re: [Discuss] 3.6.0 Release
> >
> > I'll see about committing that today; I've had to reorganize it quite
> > a bit after the Big Config Refactor.
> >
> > Joe, I'm pretty certain that your code is still in master, but
> > definitely add those tests to make sure, and to make sure we don't
> regress.
> >
> > Ian
> >
> >
> > On Mon, Aug 11, 2014 at 10:52 AM, Marcel Kinard <cm...@gmail.com>
> > wrote:
> >
> > > I agree with Joe.
> > >
> > > On Aug 11, 2014, at 10:02 AM, Joe Bowser <bo...@gmail.com> wrote:
> > >
> > > > Let's not release until the new whitelist is figured out. That
> > > > feature
> > > is
> > > > too important.
> > >
> >
>
RE: [Discuss] 3.6.0 Release
Posted by "Parashuram Narasimhan (MS OPEN TECH)" <pa...@microsoft.com>.
Had a quick question on the whitelists. I remember that there was talk of using CSP to fix this issue. A CSP file may not be backward compatible, but could potentially just give us one list instead of 2 whitelists. The CSP file may be like the following
Content-Security-Policy:
script-src 'self', foo.com, bar.com
img-src cdn.com
intent-src mail, sms
Note the new intent-src directive, that is basically used to launch external programs. Do you think this could be something we can look at, for 4.0 ? I am not sure if our whitelist xml file maps to a W3C spec, but CSP seems more like a standard. This is breaking, and 4.0 may be the right time to do it ?
-----Original Message-----
From: iclelland@google.com [mailto:iclelland@google.com] On Behalf Of Ian Clelland
Sent: Tuesday, August 12, 2014 8:30 AM
To: dev@cordova.apache.org
Subject: Re: [Discuss] 3.6.0 Release
I've created CB-7291 for the whitelist issue, and I've ported the code from June to the new-style configuration architecture and committed it to a named CB-7291 branch on cordova-android.
If anyone has any thoughts/opinions on the syntax or the proposal itself, or on what the defaults should be for new and upgrading applications, please chime in on the issue.
On Mon, Aug 11, 2014 at 11:26 AM, Parashuram Narasimhan (MS OPEN TECH) < panarasi@microsoft.com> wrote:
> I think we should also finalize on the platform switches so that we
> all agree on a pattern (even if it is different across platforms).
> This way, we can release 3.6.0 with a set of switches, and ensure that
> it is backward compatible.
>
>
> -----Original Message-----
> From: iclelland@google.com [mailto:iclelland@google.com] On Behalf Of
> Ian Clelland
> Sent: Monday, August 11, 2014 8:00 AM
> To: dev@cordova.apache.org
> Subject: Re: [Discuss] 3.6.0 Release
>
> I'll see about committing that today; I've had to reorganize it quite
> a bit after the Big Config Refactor.
>
> Joe, I'm pretty certain that your code is still in master, but
> definitely add those tests to make sure, and to make sure we don't regress.
>
> Ian
>
>
> On Mon, Aug 11, 2014 at 10:52 AM, Marcel Kinard <cm...@gmail.com>
> wrote:
>
> > I agree with Joe.
> >
> > On Aug 11, 2014, at 10:02 AM, Joe Bowser <bo...@gmail.com> wrote:
> >
> > > Let's not release until the new whitelist is figured out. That
> > > feature
> > is
> > > too important.
> >
>
Re: [Discuss] 3.6.0 Release
Posted by Ian Clelland <ic...@chromium.org>.
I've created CB-7291 for the whitelist issue, and I've ported the code from
June to the new-style configuration architecture and committed it to a
named CB-7291 branch on cordova-android.
If anyone has any thoughts/opinions on the syntax or the proposal itself,
or on what the defaults should be for new and upgrading applications,
please chime in on the issue.
On Mon, Aug 11, 2014 at 11:26 AM, Parashuram Narasimhan (MS OPEN TECH) <
panarasi@microsoft.com> wrote:
> I think we should also finalize on the platform switches so that we all
> agree on a pattern (even if it is different across platforms). This way, we
> can release 3.6.0 with a set of switches, and ensure that it is backward
> compatible.
>
>
> -----Original Message-----
> From: iclelland@google.com [mailto:iclelland@google.com] On Behalf Of Ian
> Clelland
> Sent: Monday, August 11, 2014 8:00 AM
> To: dev@cordova.apache.org
> Subject: Re: [Discuss] 3.6.0 Release
>
> I'll see about committing that today; I've had to reorganize it quite a
> bit after the Big Config Refactor.
>
> Joe, I'm pretty certain that your code is still in master, but definitely
> add those tests to make sure, and to make sure we don't regress.
>
> Ian
>
>
> On Mon, Aug 11, 2014 at 10:52 AM, Marcel Kinard <cm...@gmail.com>
> wrote:
>
> > I agree with Joe.
> >
> > On Aug 11, 2014, at 10:02 AM, Joe Bowser <bo...@gmail.com> wrote:
> >
> > > Let's not release until the new whitelist is figured out. That
> > > feature
> > is
> > > too important.
> >
>
RE: [Discuss] 3.6.0 Release
Posted by "Parashuram Narasimhan (MS OPEN TECH)" <pa...@microsoft.com>.
I think we should also finalize on the platform switches so that we all agree on a pattern (even if it is different across platforms). This way, we can release 3.6.0 with a set of switches, and ensure that it is backward compatible.
-----Original Message-----
From: iclelland@google.com [mailto:iclelland@google.com] On Behalf Of Ian Clelland
Sent: Monday, August 11, 2014 8:00 AM
To: dev@cordova.apache.org
Subject: Re: [Discuss] 3.6.0 Release
I'll see about committing that today; I've had to reorganize it quite a bit after the Big Config Refactor.
Joe, I'm pretty certain that your code is still in master, but definitely add those tests to make sure, and to make sure we don't regress.
Ian
On Mon, Aug 11, 2014 at 10:52 AM, Marcel Kinard <cm...@gmail.com> wrote:
> I agree with Joe.
>
> On Aug 11, 2014, at 10:02 AM, Joe Bowser <bo...@gmail.com> wrote:
>
> > Let's not release until the new whitelist is figured out. That
> > feature
> is
> > too important.
>
Re: [Discuss] 3.6.0 Release
Posted by Ian Clelland <ic...@chromium.org>.
I'll see about committing that today; I've had to reorganize it quite a bit
after the Big Config Refactor.
Joe, I'm pretty certain that your code is still in master, but definitely
add those tests to make sure, and to make sure we don't regress.
Ian
On Mon, Aug 11, 2014 at 10:52 AM, Marcel Kinard <cm...@gmail.com> wrote:
> I agree with Joe.
>
> On Aug 11, 2014, at 10:02 AM, Joe Bowser <bo...@gmail.com> wrote:
>
> > Let's not release until the new whitelist is figured out. That feature
> is
> > too important.
>
Re: [Discuss] 3.6.0 Release
Posted by Marcel Kinard <cm...@gmail.com>.
I agree with Joe.
On Aug 11, 2014, at 10:02 AM, Joe Bowser <bo...@gmail.com> wrote:
> Let's not release until the new whitelist is figured out. That feature is
> too important.
Re: [Discuss] 3.6.0 Release
Posted by Joe Bowser <bo...@gmail.com>.
Let's not release until the new whitelist is figured out. That feature is
too important. I also need to land the test to confirm my fix is still in
master.
Back from PTO tomorrow.
On Aug 11, 2014 6:55 AM, "Mike Billau" <mi...@gmail.com> wrote:
> There was talk about adding the "internal whitelist" that Ian built for the
> Android vulnerability fixes back into 3.6.0. It was removed from the
> initial security patches because <access origin="sms:*"
> launch-external="true"> is a breaking change. Currently in order to block
> sms:, tel:, and other protocols one needs to install a plugin from Ian's
> repo. Do we want to add this into 3.6.0?
>
>
> On Fri, Aug 8, 2014 at 2:11 PM, Steven Gill <st...@gmail.com>
> wrote:
>
> > How does everyone feel about me starting the release process next
> Tuesday,
> > August 12, 2014?
> >
> > Will your platform be ready?
> >
>
Re: [Discuss] 3.6.0 Release
Posted by Mike Billau <mi...@gmail.com>.
There was talk about adding the "internal whitelist" that Ian built for the
Android vulnerability fixes back into 3.6.0. It was removed from the
initial security patches because <access origin="sms:*"
launch-external="true"> is a breaking change. Currently in order to block
sms:, tel:, and other protocols one needs to install a plugin from Ian's
repo. Do we want to add this into 3.6.0?
On Fri, Aug 8, 2014 at 2:11 PM, Steven Gill <st...@gmail.com> wrote:
> How does everyone feel about me starting the release process next Tuesday,
> August 12, 2014?
>
> Will your platform be ready?
>
Re: [Discuss] 3.6.0 Release
Posted by Ian Clelland <ic...@chromium.org>.
The whitelist changes are in, in cordova-android and in cordova-docs now,
so I'm closing that blocker.
On Tue, Aug 26, 2014 at 3:23 PM, Parashuram Narasimhan (MS OPEN TECH) <
panarasi@microsoft.com> wrote:
> We found a few issues with Windows Phone 8.1 (whitelist does not allow
> HTTP) that Sergey discussed and is fixing.
>
> -----Original Message-----
> From: Marcel Kinard [mailto:cmarcelk@gmail.com]
> Sent: Tuesday, August 26, 2014 11:54 AM
> To: dev@cordova.apache.org
> Subject: Re: [Discuss] 3.6.0 Release
>
> I'm running mobile-spec (plugins + non-plugins + automatic + manual +
> platforms) with master on Android and finding a few failing tests, but they
> are getting fixed. With an impending 3.6.0 release soon, I would assume
> many others are doing the same. But perhaps that's not a good assumption.
>
> On Aug 8, 2014, at 2:11 PM, Steven Gill <st...@gmail.com> wrote:
>
> > How does everyone feel about me starting the release process next
> > Tuesday, August 12, 2014?
> >
> > Will your platform be ready?
>
>
Re: [Discuss] 3.6.0 Release
Posted by Edna Y Morales <ey...@us.ibm.com>.
There are a few issues on iOS (CB-7423).
Thanks,
Edna Morales
From: Marcel Kinard <cm...@gmail.com>
To: dev@cordova.apache.org
Date: 08/29/2014 12:10 PM
Subject: Re: [Discuss] 3.6.0 Release
So to consolidate the list of known issues that should be addressed before
cutting an RC:
* CB-7375 Investigate breaking changes at file plugin
* Android manual plugin tests not run yet
* CB-7410 lots of breakages of the Android native tests
* CB-7416 Windows+plugins. source-file is not correctly processed
Any omissions or extras?
On Aug 27, 2014, at 2:19 PM, Sergey Grebnov (Akvelon)
<v-...@microsoft.com> wrote:
> Found out another Windows issue. Jesse could you pls take a look?
Otherwise I'll investigate it my tomorrow morning.
>
> CB-7416 - Windows+plugins. source-file is not correctly processed
>
> Thx!
> Sergey
Re: [Discuss] 3.6.0 Release
Posted by Ian Clelland <ic...@chromium.org>.
We used to, in the 2.x days, because we had to.
One of the stated goals of the 3.x series of releases was to decouple
platforms and plugins, so that we had the freedom to release plugins
weekly, if needed (and not even as a whole set; just the ones which had
significant improvements,) and update platforms monthly (or even less
frequently than that, as it's turned out)
And I agree that we should be testing against latest released plugins
regardless; not everyone is going to update all of their plugins
immediately, and they shouldn't have to.
(This all makes testing harder, but one of these days it will force us into
a stable, well-defined platform-plugin interface... or so I've been saying)
On Fri, Aug 29, 2014 at 1:31 PM, Marcel Kinard <cm...@gmail.com> wrote:
> My assumption is that this would be a platforms / tools / plugins release.
> That's why the testing we've been doing here has been using plugins master
> instead of plugins latest.
>
> Now that I look back at recent history, I see that platforms and tools
> were released concurrently, but not plugins. I didn't see that before. So
> if the plan is to not do a concurrent plugins release, then we should be
> testing platforms with plugins latest instead of plugins master. I'm not
> sure whether to face-palm or frown.
>
> Is there a reason we've not released plugins concurrently with platforms /
> tools?
>
> On Aug 29, 2014, at 12:39 PM, Ian Clelland <ic...@chromium.org> wrote:
>
> > CB-7375 shouldn't block the release; it's a platforms / tools release,
> not
> > plugins.
>
>
Re: [Discuss] 3.6.0 Release
Posted by Marcel Kinard <cm...@gmail.com>.
My assumption is that this would be a platforms / tools / plugins release. That's why the testing we've been doing here has been using plugins master instead of plugins latest.
Now that I look back at recent history, I see that platforms and tools were released concurrently, but not plugins. I didn't see that before. So if the plan is to not do a concurrent plugins release, then we should be testing platforms with plugins latest instead of plugins master. I'm not sure whether to face-palm or frown.
Is there a reason we've not released plugins concurrently with platforms / tools?
On Aug 29, 2014, at 12:39 PM, Ian Clelland <ic...@chromium.org> wrote:
> CB-7375 shouldn't block the release; it's a platforms / tools release, not
> plugins.
Re: [Discuss] 3.6.0 Release
Posted by Ian Clelland <ic...@chromium.org>.
CB-7375 shouldn't block the release; it's a platforms / tools release, not
plugins.
https://issues.apache.org/jira/browse/CB-5535 inadvertently created a
problem with the tooling: It's not possible to use the current versions of
CLI to create an iOS project, so we'll have to release a new CLI along with
iOS 3.6.0.
On Fri, Aug 29, 2014 at 12:33 PM, Parashuram Narasimhan (MS OPEN TECH) <
panarasi@microsoft.com> wrote:
> Do any of these known issues block the release? Can we start the vote
> today as Steve wanted despite these issues?
>
> -----Original Message-----
> From: Marcel Kinard [mailto:cmarcelk@gmail.com]
> Sent: Friday, August 29, 2014 9:10 AM
> To: dev@cordova.apache.org
> Subject: Re: [Discuss] 3.6.0 Release
>
> So to consolidate the list of known issues that should be addressed before
> cutting an RC:
>
> * CB-7375 Investigate breaking changes at file plugin
> * Android manual plugin tests not run yet
> * CB-7410 lots of breakages of the Android native tests
> * CB-7416 Windows+plugins. source-file is not correctly processed
>
> Any omissions or extras?
>
> On Aug 27, 2014, at 2:19 PM, Sergey Grebnov (Akvelon) <
> v-segreb@microsoft.com> wrote:
>
> > Found out another Windows issue. Jesse could you pls take a look?
> Otherwise I'll investigate it my tomorrow morning.
> >
> > CB-7416 - Windows+plugins. source-file is not correctly processed
> >
> > Thx!
> > Sergey
>
RE: [Discuss] 3.6.0 Release
Posted by "Parashuram Narasimhan (MS OPEN TECH)" <pa...@microsoft.com>.
Do any of these known issues block the release? Can we start the vote today as Steve wanted despite these issues?
-----Original Message-----
From: Marcel Kinard [mailto:cmarcelk@gmail.com]
Sent: Friday, August 29, 2014 9:10 AM
To: dev@cordova.apache.org
Subject: Re: [Discuss] 3.6.0 Release
So to consolidate the list of known issues that should be addressed before cutting an RC:
* CB-7375 Investigate breaking changes at file plugin
* Android manual plugin tests not run yet
* CB-7410 lots of breakages of the Android native tests
* CB-7416 Windows+plugins. source-file is not correctly processed
Any omissions or extras?
On Aug 27, 2014, at 2:19 PM, Sergey Grebnov (Akvelon) <v-...@microsoft.com> wrote:
> Found out another Windows issue. Jesse could you pls take a look? Otherwise I'll investigate it my tomorrow morning.
>
> CB-7416 - Windows+plugins. source-file is not correctly processed
>
> Thx!
> Sergey
Re: [Discuss] 3.6.0 Release
Posted by Steven Gill <st...@gmail.com>.
Thanks for the update! No worries. I will run the tests now and tag if
everything looks good.
-Steve
On Fri, Aug 29, 2014 at 3:16 PM, Marcel Kinard <cm...@gmail.com> wrote:
> I've fixed enough of the native tests on Android to be comfortable with
> counting the native tests as successful. All the issues have been in the
> tests themselves, not the platform. So based on that, the failures in the
> native tests are no longer blockers.
>
> That said, I haven't been running the plugin tests using @latest, since I
> had been running them using master. So I don't have data indicating if
> there are any platform issues with the plugins @latest. I'm out of time
> today, so I can do that on Tuesday (Monday is a bank holiday) unless
> someone else in a more western timezone could slip that in today.
>
> I wish I could have spent more time wrapping this up, but there were some
> critical customer issues here that diverted my time over the last couple
> days.
>
> On Aug 29, 2014, at 5:50 PM, Steven Gill <st...@gmail.com> wrote:
>
> > Sounds good Marcel.
> >
> > Update: Only Android platform is left to tag
> >
> >
> > On Fri, Aug 29, 2014 at 12:52 PM, Marcel Kinard <cm...@gmail.com>
> wrote:
> >
> >> I'm looking at the broken native tests on Android.
> >>
> >> On Aug 29, 2014, at 3:39 PM, Steven Gill <st...@gmail.com>
> wrote:
> >>
> >>> With Joe on Vacation, is anyone looking into tagging cordova-android? I
> >>> could do it if no one else wants to.
> >>>
> >>> -Steve
> >>
> >>
>
>
Re: [Discuss] 3.6.0 Release
Posted by Marcel Kinard <cm...@gmail.com>.
I've fixed enough of the native tests on Android to be comfortable with counting the native tests as successful. All the issues have been in the tests themselves, not the platform. So based on that, the failures in the native tests are no longer blockers.
That said, I haven't been running the plugin tests using @latest, since I had been running them using master. So I don't have data indicating if there are any platform issues with the plugins @latest. I'm out of time today, so I can do that on Tuesday (Monday is a bank holiday) unless someone else in a more western timezone could slip that in today.
I wish I could have spent more time wrapping this up, but there were some critical customer issues here that diverted my time over the last couple days.
On Aug 29, 2014, at 5:50 PM, Steven Gill <st...@gmail.com> wrote:
> Sounds good Marcel.
>
> Update: Only Android platform is left to tag
>
>
> On Fri, Aug 29, 2014 at 12:52 PM, Marcel Kinard <cm...@gmail.com> wrote:
>
>> I'm looking at the broken native tests on Android.
>>
>> On Aug 29, 2014, at 3:39 PM, Steven Gill <st...@gmail.com> wrote:
>>
>>> With Joe on Vacation, is anyone looking into tagging cordova-android? I
>>> could do it if no one else wants to.
>>>
>>> -Steve
>>
>>
Re: [Discuss] 3.6.0 Release
Posted by Steven Gill <st...@gmail.com>.
Sounds good Marcel.
Update: Only Android platform is left to tag
On Fri, Aug 29, 2014 at 12:52 PM, Marcel Kinard <cm...@gmail.com> wrote:
> I'm looking at the broken native tests on Android.
>
> On Aug 29, 2014, at 3:39 PM, Steven Gill <st...@gmail.com> wrote:
>
> > With Joe on Vacation, is anyone looking into tagging cordova-android? I
> > could do it if no one else wants to.
> >
> > -Steve
>
>
Re: [Discuss] 3.6.0 Release
Posted by Marcel Kinard <cm...@gmail.com>.
I'm looking at the broken native tests on Android.
On Aug 29, 2014, at 3:39 PM, Steven Gill <st...@gmail.com> wrote:
> With Joe on Vacation, is anyone looking into tagging cordova-android? I
> could do it if no one else wants to.
>
> -Steve
Re: [Discuss] 3.6.0 Release
Posted by Steven Gill <st...@gmail.com>.
With Joe on Vacation, is anyone looking into tagging cordova-android? I
could do it if no one else wants to.
-Steve
On Fri, Aug 29, 2014 at 12:00 PM, Jesse <pu...@gmail.com> wrote:
> Yes, CB-7416 is closed ( now )
>
> Plugin test failures should not affect the release of tooling+platforms.
>
> We need to start this vote today, windows8+wp8 are ready for rc.
>
> Note also that because of the way lib works, we are going to have to test
> with cordova platform add --usegit, as the npm packages cannot be published
> until the vote has passed ...
>
> @purplecabbage
> risingj.com
>
>
> On Fri, Aug 29, 2014 at 11:28 AM, Shazron <sh...@gmail.com> wrote:
>
> > I'm working on iOS getting all tagged up plus fixing some last minute
> > issues like https://issues.apache.org/jira/browse/CB-5535
> > including the version file script thingy to be handled by coho
> > (hard-code, instead of reading VERSION)
> >
> >
> > On Fri, Aug 29, 2014 at 11:23 AM, Steven Gill <st...@gmail.com>
> > wrote:
> > > Ian summarizes it well. This release is only for platforms + tools. We
> > can
> > > do a plugins release shortly after once their issues are fixed up.
> > >
> > > Native tests failing on Android sounds like it could be a legitimate
> > > blocker though. It would be really great to have everything tagged
> today
> > so
> > > I could start a vote thread.
> > >
> > >
> > > On Fri, Aug 29, 2014 at 11:18 AM, Sergey Grebnov (Akvelon) <
> > > v-segreb@microsoft.com> wrote:
> > >
> > >> Hi, the following issue has been fixed
> > >>
> > >> CB-7416 Windows+plugins. source-file is not correctly processed
> > >>
> > >> Thx,
> > >> Sergey
> > >>
> > >> Sent from my Windows Phone
> > >> ________________________________
> > >> From: Marcel Kinard<ma...@gmail.com>
> > >> Sent: 8/29/2014 8:10 PM
> > >> To: dev@cordova.apache.org<ma...@cordova.apache.org>
> > >> Subject: Re: [Discuss] 3.6.0 Release
> > >>
> > >> So to consolidate the list of known issues that should be addressed
> > before
> > >> cutting an RC:
> > >>
> > >> * CB-7375 Investigate breaking changes at file plugin
> > >> * Android manual plugin tests not run yet
> > >> * CB-7410 lots of breakages of the Android native tests
> > >> * CB-7416 Windows+plugins. source-file is not correctly processed
> > >>
> > >> Any omissions or extras?
> > >>
> > >> On Aug 27, 2014, at 2:19 PM, Sergey Grebnov (Akvelon) <
> > >> v-segreb@microsoft.com> wrote:
> > >>
> > >> > Found out another Windows issue. Jesse could you pls take a look?
> > >> Otherwise I'll investigate it my tomorrow morning.
> > >> >
> > >> > CB-7416 - Windows+plugins. source-file is not correctly processed
> > >> >
> > >> > Thx!
> > >> > Sergey
> > >>
> >
>
Re: [Discuss] 3.6.0 Release
Posted by Jesse <pu...@gmail.com>.
Yes, CB-7416 is closed ( now )
Plugin test failures should not affect the release of tooling+platforms.
We need to start this vote today, windows8+wp8 are ready for rc.
Note also that because of the way lib works, we are going to have to test
with cordova platform add --usegit, as the npm packages cannot be published
until the vote has passed ...
@purplecabbage
risingj.com
On Fri, Aug 29, 2014 at 11:28 AM, Shazron <sh...@gmail.com> wrote:
> I'm working on iOS getting all tagged up plus fixing some last minute
> issues like https://issues.apache.org/jira/browse/CB-5535
> including the version file script thingy to be handled by coho
> (hard-code, instead of reading VERSION)
>
>
> On Fri, Aug 29, 2014 at 11:23 AM, Steven Gill <st...@gmail.com>
> wrote:
> > Ian summarizes it well. This release is only for platforms + tools. We
> can
> > do a plugins release shortly after once their issues are fixed up.
> >
> > Native tests failing on Android sounds like it could be a legitimate
> > blocker though. It would be really great to have everything tagged today
> so
> > I could start a vote thread.
> >
> >
> > On Fri, Aug 29, 2014 at 11:18 AM, Sergey Grebnov (Akvelon) <
> > v-segreb@microsoft.com> wrote:
> >
> >> Hi, the following issue has been fixed
> >>
> >> CB-7416 Windows+plugins. source-file is not correctly processed
> >>
> >> Thx,
> >> Sergey
> >>
> >> Sent from my Windows Phone
> >> ________________________________
> >> From: Marcel Kinard<ma...@gmail.com>
> >> Sent: 8/29/2014 8:10 PM
> >> To: dev@cordova.apache.org<ma...@cordova.apache.org>
> >> Subject: Re: [Discuss] 3.6.0 Release
> >>
> >> So to consolidate the list of known issues that should be addressed
> before
> >> cutting an RC:
> >>
> >> * CB-7375 Investigate breaking changes at file plugin
> >> * Android manual plugin tests not run yet
> >> * CB-7410 lots of breakages of the Android native tests
> >> * CB-7416 Windows+plugins. source-file is not correctly processed
> >>
> >> Any omissions or extras?
> >>
> >> On Aug 27, 2014, at 2:19 PM, Sergey Grebnov (Akvelon) <
> >> v-segreb@microsoft.com> wrote:
> >>
> >> > Found out another Windows issue. Jesse could you pls take a look?
> >> Otherwise I'll investigate it my tomorrow morning.
> >> >
> >> > CB-7416 - Windows+plugins. source-file is not correctly processed
> >> >
> >> > Thx!
> >> > Sergey
> >>
>
Re: [Discuss] 3.6.0 Release
Posted by Shazron <sh...@gmail.com>.
I'm working on iOS getting all tagged up plus fixing some last minute
issues like https://issues.apache.org/jira/browse/CB-5535
including the version file script thingy to be handled by coho
(hard-code, instead of reading VERSION)
On Fri, Aug 29, 2014 at 11:23 AM, Steven Gill <st...@gmail.com> wrote:
> Ian summarizes it well. This release is only for platforms + tools. We can
> do a plugins release shortly after once their issues are fixed up.
>
> Native tests failing on Android sounds like it could be a legitimate
> blocker though. It would be really great to have everything tagged today so
> I could start a vote thread.
>
>
> On Fri, Aug 29, 2014 at 11:18 AM, Sergey Grebnov (Akvelon) <
> v-segreb@microsoft.com> wrote:
>
>> Hi, the following issue has been fixed
>>
>> CB-7416 Windows+plugins. source-file is not correctly processed
>>
>> Thx,
>> Sergey
>>
>> Sent from my Windows Phone
>> ________________________________
>> From: Marcel Kinard<ma...@gmail.com>
>> Sent: 8/29/2014 8:10 PM
>> To: dev@cordova.apache.org<ma...@cordova.apache.org>
>> Subject: Re: [Discuss] 3.6.0 Release
>>
>> So to consolidate the list of known issues that should be addressed before
>> cutting an RC:
>>
>> * CB-7375 Investigate breaking changes at file plugin
>> * Android manual plugin tests not run yet
>> * CB-7410 lots of breakages of the Android native tests
>> * CB-7416 Windows+plugins. source-file is not correctly processed
>>
>> Any omissions or extras?
>>
>> On Aug 27, 2014, at 2:19 PM, Sergey Grebnov (Akvelon) <
>> v-segreb@microsoft.com> wrote:
>>
>> > Found out another Windows issue. Jesse could you pls take a look?
>> Otherwise I'll investigate it my tomorrow morning.
>> >
>> > CB-7416 - Windows+plugins. source-file is not correctly processed
>> >
>> > Thx!
>> > Sergey
>>
Re: [Discuss] 3.6.0 Release
Posted by Steven Gill <st...@gmail.com>.
Ian summarizes it well. This release is only for platforms + tools. We can
do a plugins release shortly after once their issues are fixed up.
Native tests failing on Android sounds like it could be a legitimate
blocker though. It would be really great to have everything tagged today so
I could start a vote thread.
On Fri, Aug 29, 2014 at 11:18 AM, Sergey Grebnov (Akvelon) <
v-segreb@microsoft.com> wrote:
> Hi, the following issue has been fixed
>
> CB-7416 Windows+plugins. source-file is not correctly processed
>
> Thx,
> Sergey
>
> Sent from my Windows Phone
> ________________________________
> From: Marcel Kinard<ma...@gmail.com>
> Sent: 8/29/2014 8:10 PM
> To: dev@cordova.apache.org<ma...@cordova.apache.org>
> Subject: Re: [Discuss] 3.6.0 Release
>
> So to consolidate the list of known issues that should be addressed before
> cutting an RC:
>
> * CB-7375 Investigate breaking changes at file plugin
> * Android manual plugin tests not run yet
> * CB-7410 lots of breakages of the Android native tests
> * CB-7416 Windows+plugins. source-file is not correctly processed
>
> Any omissions or extras?
>
> On Aug 27, 2014, at 2:19 PM, Sergey Grebnov (Akvelon) <
> v-segreb@microsoft.com> wrote:
>
> > Found out another Windows issue. Jesse could you pls take a look?
> Otherwise I'll investigate it my tomorrow morning.
> >
> > CB-7416 - Windows+plugins. source-file is not correctly processed
> >
> > Thx!
> > Sergey
>
RE: [Discuss] 3.6.0 Release
Posted by "Sergey Grebnov (Akvelon)" <v-...@microsoft.com>.
Hi, the following issue has been fixed
CB-7416 Windows+plugins. source-file is not correctly processed
Thx,
Sergey
Sent from my Windows Phone
________________________________
From: Marcel Kinard<ma...@gmail.com>
Sent: 8/29/2014 8:10 PM
To: dev@cordova.apache.org<ma...@cordova.apache.org>
Subject: Re: [Discuss] 3.6.0 Release
So to consolidate the list of known issues that should be addressed before cutting an RC:
* CB-7375 Investigate breaking changes at file plugin
* Android manual plugin tests not run yet
* CB-7410 lots of breakages of the Android native tests
* CB-7416 Windows+plugins. source-file is not correctly processed
Any omissions or extras?
On Aug 27, 2014, at 2:19 PM, Sergey Grebnov (Akvelon) <v-...@microsoft.com> wrote:
> Found out another Windows issue. Jesse could you pls take a look? Otherwise I'll investigate it my tomorrow morning.
>
> CB-7416 - Windows+plugins. source-file is not correctly processed
>
> Thx!
> Sergey
Re: [Discuss] 3.6.0 Release
Posted by Marcel Kinard <cm...@gmail.com>.
So to consolidate the list of known issues that should be addressed before cutting an RC:
* CB-7375 Investigate breaking changes at file plugin
* Android manual plugin tests not run yet
* CB-7410 lots of breakages of the Android native tests
* CB-7416 Windows+plugins. source-file is not correctly processed
Any omissions or extras?
On Aug 27, 2014, at 2:19 PM, Sergey Grebnov (Akvelon) <v-...@microsoft.com> wrote:
> Found out another Windows issue. Jesse could you pls take a look? Otherwise I'll investigate it my tomorrow morning.
>
> CB-7416 - Windows+plugins. source-file is not correctly processed
>
> Thx!
> Sergey
RE: [Discuss] 3.6.0 Release
Posted by "Sergey Grebnov (Akvelon)" <v-...@microsoft.com>.
Found out another Windows issue. Jesse could you pls take a look? Otherwise I'll investigate it my tomorrow morning.
CB-7416 - Windows+plugins. source-file is not correctly processed
Thx!
Sergey
-----Original Message-----
From: Sergey Grebnov (Akvelon) [mailto:v-segreb@microsoft.com]
Sent: Wednesday, August 27, 2014 1:11 PM
To: dev@cordova.apache.org
Subject: RE: [Discuss] 3.6.0 Release
Pushed the following fix to CLI master which adds back missing reference to fs (requires for Windows platform).
https://github.com/apache/cordova-cli/commit/6662888cffaab997a0f6daa7657d10962b23cf31
Looks like it has been accidentally removed by the following commit
https://github.com/apache/cordova-cli/commit/68d0d9f17cd12289999ecadae852522416526868
Thx!
Sergey
-----Original Message-----
From: Sergey Grebnov (Akvelon) [mailto:v-segreb@microsoft.com]
Sent: Wednesday, August 27, 2014 11:57 AM
To: dev@cordova.apache.org
Subject: RE: [Discuss] 3.6.0 Release
Jesse, could you please also include the following commit to 3.6.0. After additional testing I found out that it leads to incorrect filtering of not supported rules (https only) on Windows.
https://github.com/apache/cordova-windows/commit/31bac42808e56a2239cbda07a02794147ebafb8b
CB-7377 Removes unnecessary rules tracing which is also incorrectly handled by PS
Thx!
Sergey
-----Original Message-----
From: purplecabbage [mailto:purplecabbage@gmail.com]
Sent: Wednesday, August 27, 2014 11:26 AM
To: dev@cordova.apache.org
Subject: Re: [Discuss] 3.6.0 Release
All tagged too.
I'll take care of the npm publish in the morning here.
Sent from my iPhone
> On Aug 26, 2014, at 11:51 PM, "Sergey Grebnov (Akvelon)" <v-...@microsoft.com> wrote:
>
> Btw, who will publish cordova-windows to npm? Since the name is not taken (we previously used cordova-windows8) I can do this, I'm also fine if someone else who is more experienced in such things will do this.
>
> Windows platform looks like as 100% ready for tagging, Jesse has added Release notes and polished other related things.
>
> -Sergey
> -----Original Message-----
> From: Steven Gill [mailto:stevengill97@gmail.com]
> Sent: Wednesday, August 27, 2014 12:57 AM
> To: dev@cordova.apache.org
> Subject: Re: [Discuss] 3.6.0 Release
>
> Hopefully this gets resolved soon. Seeing how it is a BB only issue, it won't hinder other platforms from tagging.
>
>
>> On Tue, Aug 26, 2014 at 1:53 PM, Josh Soref <js...@blackberry.com> wrote:
>>
>> There's still a problem w/ blackberry10.
>>
>> We have code that assumes the location of the blackberry10 code in
>> ~/.cordova/lib/blackberry10,
>>
>> https://issues.apache.org/jira/browse/CB-7409
>>
>>
>> I found this while working on the version script (which we should
>> have replaced a while ago...).
>>
>>
RE: [Discuss] 3.6.0 Release
Posted by "Sergey Grebnov (Akvelon)" <v-...@microsoft.com>.
Pushed the following fix to CLI master which adds back missing reference to fs (requires for Windows platform).
https://github.com/apache/cordova-cli/commit/6662888cffaab997a0f6daa7657d10962b23cf31
Looks like it has been accidentally removed by the following commit
https://github.com/apache/cordova-cli/commit/68d0d9f17cd12289999ecadae852522416526868
Thx!
Sergey
-----Original Message-----
From: Sergey Grebnov (Akvelon) [mailto:v-segreb@microsoft.com]
Sent: Wednesday, August 27, 2014 11:57 AM
To: dev@cordova.apache.org
Subject: RE: [Discuss] 3.6.0 Release
Jesse, could you please also include the following commit to 3.6.0. After additional testing I found out that it leads to incorrect filtering of not supported rules (https only) on Windows.
https://github.com/apache/cordova-windows/commit/31bac42808e56a2239cbda07a02794147ebafb8b
CB-7377 Removes unnecessary rules tracing which is also incorrectly handled by PS
Thx!
Sergey
-----Original Message-----
From: purplecabbage [mailto:purplecabbage@gmail.com]
Sent: Wednesday, August 27, 2014 11:26 AM
To: dev@cordova.apache.org
Subject: Re: [Discuss] 3.6.0 Release
All tagged too.
I'll take care of the npm publish in the morning here.
Sent from my iPhone
> On Aug 26, 2014, at 11:51 PM, "Sergey Grebnov (Akvelon)" <v-...@microsoft.com> wrote:
>
> Btw, who will publish cordova-windows to npm? Since the name is not taken (we previously used cordova-windows8) I can do this, I'm also fine if someone else who is more experienced in such things will do this.
>
> Windows platform looks like as 100% ready for tagging, Jesse has added Release notes and polished other related things.
>
> -Sergey
> -----Original Message-----
> From: Steven Gill [mailto:stevengill97@gmail.com]
> Sent: Wednesday, August 27, 2014 12:57 AM
> To: dev@cordova.apache.org
> Subject: Re: [Discuss] 3.6.0 Release
>
> Hopefully this gets resolved soon. Seeing how it is a BB only issue, it won't hinder other platforms from tagging.
>
>
>> On Tue, Aug 26, 2014 at 1:53 PM, Josh Soref <js...@blackberry.com> wrote:
>>
>> There's still a problem w/ blackberry10.
>>
>> We have code that assumes the location of the blackberry10 code in
>> ~/.cordova/lib/blackberry10,
>>
>> https://issues.apache.org/jira/browse/CB-7409
>>
>>
>> I found this while working on the version script (which we should
>> have replaced a while ago...).
>>
>>
RE: [Discuss] 3.6.0 Release
Posted by "Sergey Grebnov (Akvelon)" <v-...@microsoft.com>.
Jesse, could you please also include the following commit to 3.6.0. After additional testing I found out that it leads to incorrect filtering of not supported rules (https only) on Windows.
https://github.com/apache/cordova-windows/commit/31bac42808e56a2239cbda07a02794147ebafb8b
CB-7377 Removes unnecessary rules tracing which is also incorrectly handled by PS
Thx!
Sergey
-----Original Message-----
From: purplecabbage [mailto:purplecabbage@gmail.com]
Sent: Wednesday, August 27, 2014 11:26 AM
To: dev@cordova.apache.org
Subject: Re: [Discuss] 3.6.0 Release
All tagged too.
I'll take care of the npm publish in the morning here.
Sent from my iPhone
> On Aug 26, 2014, at 11:51 PM, "Sergey Grebnov (Akvelon)" <v-...@microsoft.com> wrote:
>
> Btw, who will publish cordova-windows to npm? Since the name is not taken (we previously used cordova-windows8) I can do this, I'm also fine if someone else who is more experienced in such things will do this.
>
> Windows platform looks like as 100% ready for tagging, Jesse has added Release notes and polished other related things.
>
> -Sergey
> -----Original Message-----
> From: Steven Gill [mailto:stevengill97@gmail.com]
> Sent: Wednesday, August 27, 2014 12:57 AM
> To: dev@cordova.apache.org
> Subject: Re: [Discuss] 3.6.0 Release
>
> Hopefully this gets resolved soon. Seeing how it is a BB only issue, it won't hinder other platforms from tagging.
>
>
>> On Tue, Aug 26, 2014 at 1:53 PM, Josh Soref <js...@blackberry.com> wrote:
>>
>> There's still a problem w/ blackberry10.
>>
>> We have code that assumes the location of the blackberry10 code in
>> ~/.cordova/lib/blackberry10,
>>
>> https://issues.apache.org/jira/browse/CB-7409
>>
>>
>> I found this while working on the version script (which we should
>> have replaced a while ago...).
>>
>>
Re: [Discuss] 3.6.0 Release
Posted by purplecabbage <pu...@gmail.com>.
All tagged too.
I'll take care of the npm publish in the morning here.
Sent from my iPhone
> On Aug 26, 2014, at 11:51 PM, "Sergey Grebnov (Akvelon)" <v-...@microsoft.com> wrote:
>
> Btw, who will publish cordova-windows to npm? Since the name is not taken (we previously used cordova-windows8) I can do this, I'm also fine if someone else who is more experienced in such things will do this.
>
> Windows platform looks like as 100% ready for tagging, Jesse has added Release notes and polished other related things.
>
> -Sergey
> -----Original Message-----
> From: Steven Gill [mailto:stevengill97@gmail.com]
> Sent: Wednesday, August 27, 2014 12:57 AM
> To: dev@cordova.apache.org
> Subject: Re: [Discuss] 3.6.0 Release
>
> Hopefully this gets resolved soon. Seeing how it is a BB only issue, it won't hinder other platforms from tagging.
>
>
>> On Tue, Aug 26, 2014 at 1:53 PM, Josh Soref <js...@blackberry.com> wrote:
>>
>> There's still a problem w/ blackberry10.
>>
>> We have code that assumes the location of the blackberry10 code in
>> ~/.cordova/lib/blackberry10,
>>
>> https://issues.apache.org/jira/browse/CB-7409
>>
>>
>> I found this while working on the version script (which we should have
>> replaced a while ago...).
>>
>>
RE: [Discuss] 3.6.0 Release
Posted by "Sergey Grebnov (Akvelon)" <v-...@microsoft.com>.
Btw, who will publish cordova-windows to npm? Since the name is not taken (we previously used cordova-windows8) I can do this, I'm also fine if someone else who is more experienced in such things will do this.
Windows platform looks like as 100% ready for tagging, Jesse has added Release notes and polished other related things.
-Sergey
-----Original Message-----
From: Steven Gill [mailto:stevengill97@gmail.com]
Sent: Wednesday, August 27, 2014 12:57 AM
To: dev@cordova.apache.org
Subject: Re: [Discuss] 3.6.0 Release
Hopefully this gets resolved soon. Seeing how it is a BB only issue, it won't hinder other platforms from tagging.
On Tue, Aug 26, 2014 at 1:53 PM, Josh Soref <js...@blackberry.com> wrote:
> There's still a problem w/ blackberry10.
>
> We have code that assumes the location of the blackberry10 code in
> ~/.cordova/lib/blackberry10,
>
> https://issues.apache.org/jira/browse/CB-7409
>
>
> I found this while working on the version script (which we should have
> replaced a while ago...).
>
>
Re: [Discuss] 3.6.0 Release
Posted by Steven Gill <st...@gmail.com>.
Hopefully this gets resolved soon. Seeing how it is a BB only issue, it
won't hinder other platforms from tagging.
On Tue, Aug 26, 2014 at 1:53 PM, Josh Soref <js...@blackberry.com> wrote:
> There's still a problem w/ blackberry10.
>
> We have code that assumes the location of the blackberry10 code in
> ~/.cordova/lib/blackberry10,
>
> https://issues.apache.org/jira/browse/CB-7409
>
>
> I found this while working on the version script (which we should have
> replaced a while ago...).
>
>
Re: [Discuss] 3.6.0 Release
Posted by Josh Soref <js...@blackberry.com>.
There's still a problem w/ blackberry10.
We have code that assumes the location of the blackberry10 code in
~/.cordova/lib/blackberry10,
https://issues.apache.org/jira/browse/CB-7409
I found this while working on the version script (which we should have
replaced a while ago…).
Re: [Discuss] 3.6.0 Release
Posted by Steven Gill <st...@gmail.com>.
Okay, JS, mobile-spec and hello world app have all been tagged.
Go ahead and tag your platforms using the commands from
https://github.com/apache/cordova-coho/blob/master/docs/cadence-release-process.md#branch--tag-for-cordova-js-cordova-mobile-spec-and-cordova-app-hello-world.
Just replace 3.5.0 with 3.6.0 and 3.5.x with 3.6.x.
As you can see, no rc-1 tag for platforms.
I can take care of tagging FFOS & Ubuntu. Let me know if other platforms
need help too.
Once platforms are done, I can get the RC ready by tagging cordova-lib + CLI
On Tue, Aug 26, 2014 at 1:34 PM, Steven Gill <st...@gmail.com> wrote:
> I have created the master issue, tagging the js, mobile-spec and hello
> world app now.
>
> https://issues.apache.org/jira/browse/CB-7383
>
> Following steps from
> https://github.com/apache/cordova-coho/blob/master/docs/cadence-release-process.md
>
>
> On Tue, Aug 26, 2014 at 1:20 PM, Parashuram Narasimhan (MS OPEN TECH) <
> panarasi@microsoft.com> wrote:
>
>> Given that both the blockers are now closed, will we be starting a vote
>> thread next?
>>
>> -----Original Message-----
>> From: Bryan Higgins [mailto:bryan@bryanhiggins.net]
>> Sent: Tuesday, August 26, 2014 1:05 PM
>> To: dev@cordova.apache.org
>> Subject: Re: [Discuss] 3.6.0 Release
>>
>> BB10 should be good to go now.
>>
>> I published cordova-blackberry10 as a package [1]. We had already updated
>> the name in package.json due to the strict name checking in CLI, so this
>> had to be done anyway.
>>
>> Adding all packages to bundledDependencies works around the 'npm install'
>> problem [2].
>>
>> [1] https://www.npmjs.org/package/cordova-blackberry10
>>
>> [2]
>>
>> https://git-wip-us.apache.org/repos/asf?p=cordova-blackberry.git;a=commit;h=8f9248654791f820490919a876d06bba591f6f6c
>>
>>
>>
>>
>> On Tue, Aug 26, 2014 at 3:23 PM, Parashuram Narasimhan (MS OPEN TECH) <
>> panarasi@microsoft.com> wrote:
>>
>> > We found a few issues with Windows Phone 8.1 (whitelist does not allow
>> > HTTP) that Sergey discussed and is fixing.
>> >
>> > -----Original Message-----
>> > From: Marcel Kinard [mailto:cmarcelk@gmail.com]
>> > Sent: Tuesday, August 26, 2014 11:54 AM
>> > To: dev@cordova.apache.org
>> > Subject: Re: [Discuss] 3.6.0 Release
>> >
>> > I'm running mobile-spec (plugins + non-plugins + automatic + manual +
>> > platforms) with master on Android and finding a few failing tests, but
>> > they are getting fixed. With an impending 3.6.0 release soon, I would
>> > assume many others are doing the same. But perhaps that's not a good
>> assumption.
>> >
>> > On Aug 8, 2014, at 2:11 PM, Steven Gill <st...@gmail.com> wrote:
>> >
>> > > How does everyone feel about me starting the release process next
>> > > Tuesday, August 12, 2014?
>> > >
>> > > Will your platform be ready?
>> >
>> >
>>
>
>
Re: [Discuss] 3.6.0 Release
Posted by Steven Gill <st...@gmail.com>.
I have created the master issue, tagging the js, mobile-spec and hello
world app now.
https://issues.apache.org/jira/browse/CB-7383
Following steps from
https://github.com/apache/cordova-coho/blob/master/docs/cadence-release-process.md
On Tue, Aug 26, 2014 at 1:20 PM, Parashuram Narasimhan (MS OPEN TECH) <
panarasi@microsoft.com> wrote:
> Given that both the blockers are now closed, will we be starting a vote
> thread next?
>
> -----Original Message-----
> From: Bryan Higgins [mailto:bryan@bryanhiggins.net]
> Sent: Tuesday, August 26, 2014 1:05 PM
> To: dev@cordova.apache.org
> Subject: Re: [Discuss] 3.6.0 Release
>
> BB10 should be good to go now.
>
> I published cordova-blackberry10 as a package [1]. We had already updated
> the name in package.json due to the strict name checking in CLI, so this
> had to be done anyway.
>
> Adding all packages to bundledDependencies works around the 'npm install'
> problem [2].
>
> [1] https://www.npmjs.org/package/cordova-blackberry10
>
> [2]
>
> https://git-wip-us.apache.org/repos/asf?p=cordova-blackberry.git;a=commit;h=8f9248654791f820490919a876d06bba591f6f6c
>
>
>
>
> On Tue, Aug 26, 2014 at 3:23 PM, Parashuram Narasimhan (MS OPEN TECH) <
> panarasi@microsoft.com> wrote:
>
> > We found a few issues with Windows Phone 8.1 (whitelist does not allow
> > HTTP) that Sergey discussed and is fixing.
> >
> > -----Original Message-----
> > From: Marcel Kinard [mailto:cmarcelk@gmail.com]
> > Sent: Tuesday, August 26, 2014 11:54 AM
> > To: dev@cordova.apache.org
> > Subject: Re: [Discuss] 3.6.0 Release
> >
> > I'm running mobile-spec (plugins + non-plugins + automatic + manual +
> > platforms) with master on Android and finding a few failing tests, but
> > they are getting fixed. With an impending 3.6.0 release soon, I would
> > assume many others are doing the same. But perhaps that's not a good
> assumption.
> >
> > On Aug 8, 2014, at 2:11 PM, Steven Gill <st...@gmail.com> wrote:
> >
> > > How does everyone feel about me starting the release process next
> > > Tuesday, August 12, 2014?
> > >
> > > Will your platform be ready?
> >
> >
>
RE: [Discuss] 3.6.0 Release
Posted by "Parashuram Narasimhan (MS OPEN TECH)" <pa...@microsoft.com>.
Given that both the blockers are now closed, will we be starting a vote thread next?
-----Original Message-----
From: Bryan Higgins [mailto:bryan@bryanhiggins.net]
Sent: Tuesday, August 26, 2014 1:05 PM
To: dev@cordova.apache.org
Subject: Re: [Discuss] 3.6.0 Release
BB10 should be good to go now.
I published cordova-blackberry10 as a package [1]. We had already updated the name in package.json due to the strict name checking in CLI, so this had to be done anyway.
Adding all packages to bundledDependencies works around the 'npm install'
problem [2].
[1] https://www.npmjs.org/package/cordova-blackberry10
[2]
https://git-wip-us.apache.org/repos/asf?p=cordova-blackberry.git;a=commit;h=8f9248654791f820490919a876d06bba591f6f6c
On Tue, Aug 26, 2014 at 3:23 PM, Parashuram Narasimhan (MS OPEN TECH) < panarasi@microsoft.com> wrote:
> We found a few issues with Windows Phone 8.1 (whitelist does not allow
> HTTP) that Sergey discussed and is fixing.
>
> -----Original Message-----
> From: Marcel Kinard [mailto:cmarcelk@gmail.com]
> Sent: Tuesday, August 26, 2014 11:54 AM
> To: dev@cordova.apache.org
> Subject: Re: [Discuss] 3.6.0 Release
>
> I'm running mobile-spec (plugins + non-plugins + automatic + manual +
> platforms) with master on Android and finding a few failing tests, but
> they are getting fixed. With an impending 3.6.0 release soon, I would
> assume many others are doing the same. But perhaps that's not a good assumption.
>
> On Aug 8, 2014, at 2:11 PM, Steven Gill <st...@gmail.com> wrote:
>
> > How does everyone feel about me starting the release process next
> > Tuesday, August 12, 2014?
> >
> > Will your platform be ready?
>
>
Re: [Discuss] 3.6.0 Release
Posted by Bryan Higgins <br...@bryanhiggins.net>.
BB10 should be good to go now.
I published cordova-blackberry10 as a package [1]. We had already updated
the name in package.json due to the strict name checking in CLI, so this
had to be done anyway.
Adding all packages to bundledDependencies works around the 'npm install'
problem [2].
[1] https://www.npmjs.org/package/cordova-blackberry10
[2]
https://git-wip-us.apache.org/repos/asf?p=cordova-blackberry.git;a=commit;h=8f9248654791f820490919a876d06bba591f6f6c
On Tue, Aug 26, 2014 at 3:23 PM, Parashuram Narasimhan (MS OPEN TECH) <
panarasi@microsoft.com> wrote:
> We found a few issues with Windows Phone 8.1 (whitelist does not allow
> HTTP) that Sergey discussed and is fixing.
>
> -----Original Message-----
> From: Marcel Kinard [mailto:cmarcelk@gmail.com]
> Sent: Tuesday, August 26, 2014 11:54 AM
> To: dev@cordova.apache.org
> Subject: Re: [Discuss] 3.6.0 Release
>
> I'm running mobile-spec (plugins + non-plugins + automatic + manual +
> platforms) with master on Android and finding a few failing tests, but they
> are getting fixed. With an impending 3.6.0 release soon, I would assume
> many others are doing the same. But perhaps that's not a good assumption.
>
> On Aug 8, 2014, at 2:11 PM, Steven Gill <st...@gmail.com> wrote:
>
> > How does everyone feel about me starting the release process next
> > Tuesday, August 12, 2014?
> >
> > Will your platform be ready?
>
>
RE: [Discuss] 3.6.0 Release
Posted by "Parashuram Narasimhan (MS OPEN TECH)" <pa...@microsoft.com>.
We found a few issues with Windows Phone 8.1 (whitelist does not allow HTTP) that Sergey discussed and is fixing.
-----Original Message-----
From: Marcel Kinard [mailto:cmarcelk@gmail.com]
Sent: Tuesday, August 26, 2014 11:54 AM
To: dev@cordova.apache.org
Subject: Re: [Discuss] 3.6.0 Release
I'm running mobile-spec (plugins + non-plugins + automatic + manual + platforms) with master on Android and finding a few failing tests, but they are getting fixed. With an impending 3.6.0 release soon, I would assume many others are doing the same. But perhaps that's not a good assumption.
On Aug 8, 2014, at 2:11 PM, Steven Gill <st...@gmail.com> wrote:
> How does everyone feel about me starting the release process next
> Tuesday, August 12, 2014?
>
> Will your platform be ready?
Re: [Discuss] 3.6.0 Release
Posted by Marcel Kinard <cm...@gmail.com>.
I'm running mobile-spec (plugins + non-plugins + automatic + manual + platforms) with master on Android and finding a few failing tests, but they are getting fixed. With an impending 3.6.0 release soon, I would assume many others are doing the same. But perhaps that's not a good assumption.
On Aug 8, 2014, at 2:11 PM, Steven Gill <st...@gmail.com> wrote:
> How does everyone feel about me starting the release process next Tuesday,
> August 12, 2014?
>
> Will your platform be ready?