[GitHub] [netbeans] neilcsmith-net commented on pull request #5893: small move to a more explicit "protocol" for libraries

["neilcsmith-net (via GitHub)" <gi...@apache.org>]

neilcsmith-net commented on PR #5893:
URL: https://github.com/apache/netbeans/pull/5893#issuecomment-1543983416

   > purl or xml could be done. I've no preference. purl parsing could be implemented as replacement of current parsing with more adhoc restriction. Not every protocol, not every repo.
   
   Definitely only the packagers we want to support, and we'd need a resolver for each.
   
   Making everything a URL is a plus, as we can parse everything as a URI as first step.  I'm happy to look at writing resolution for Maven (well, reusing what I already have), if that's where we do want to go?
   
   > Concerning maven, I don't understand the need to put hash aside as they are in repo.
   
   So we'd need to special case downloading the hash file as well to check the download?  And we'd lose the other benefits of the hash being stored at our end - extra check for security, developer using local repo, etc.?
   
   > At the moment, to have launcher fix, or installer fix you need to fix hash for every adjustment.
   
   Yes, but why is that a problem?  Add new hash and direct file link in to draft PR each time we need to need to test an update.  It's how nb-javac and other PRs have been tested.  We can provide `ci:dev-build` for additional testing.
   
   For local testing, we could also consider making hash check just a warning for local `file:` URL?  That can't accidentally work elsewhere.
   
   Neither of those should ever get near the master branch - master should always be in a releasable state.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org

For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists