You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@netbeans.apache.org by Josh Juneau <ju...@gmail.com> on 2018/06/15 11:42:25 UTC
NetBeans Build and the binaries-list hash
I am able to obtain and build the latest Apache NetBeans incubator sources and build, but not without first modifying the MD5 sums within a number of the binaries-list files to match those that are "expected". Is there a reason that these MD5 sums are not up-to-date if one attempts to build from the latest in the incubator?
I'm going to write a short blog post on how to build from scratch, and I wanted to cover how to modify the MD5 sums to get the build to work correctly. However, this is a workaround and I'd rather not propagate a workaround if I don't have to do so. It also may bring security questions into the fold, and I don't want to go down that path.
Thanks for your time, and great work on NetBeans 9.0!
Josh Juneau
juneau001@gmail.com
http://jj-blogger.blogspot.com
https://www.apress.com/index.php/author/author/view/id/1866
Re: NetBeans Build and the binaries-list hash
Posted by Emilian Bold <em...@protonmail.ch.INVALID>.
This most definitely should *not* happen.
Note that Travis builds NetBeans all the time and downloads dependencies just like you do and builds would fail when this happens.
Do *not* change hashes if you don't know why it must be changed. From a security standpoint it is very dangerous.
--emi
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On 15 June 2018 6:41 PM, Josh Juneau <ju...@gmail.com> wrote:
> Hi Jan and Emilian,
>
> Thanks for the responses. Yes, after I clone, I simply run ant. I just performed a new clone to test the issue again, and here is example of the hash update:
>
> Download of B9BBF5BF22E1B8603F312F6E02ABC6267996B38A-net.java.html.boot.fx-1.5.1.jar produced content with hash BA6D811096540A6AA8C50131D9839F24BA130798 when B9BBF5BF22E1B8603F312F6E02ABC6267996B38A was expected
>
> In this case, I'd have to modify the binaries-list has to the expected hash and re-run the build. This occurs about 10 times, and then the build will complete successfully.
>
> If we are asking users to build from source, then I'd think that this manual hash update requirement should not be occurring.
>
> Thanks for your time and assistance...it is appreciated.
>
> Josh Juneau
>
> juneau001@gmail.com
>
> http://jj-blogger.blogspot.com
>
> https://www.apress.com/index.php/author/author/view/id/1866
>
> > On Jun 15, 2018, at 9:40 AM, Jan Lahoda lahoda@gmail.com wrote:
> >
> > Hi Josh,
> >
> > Do I understand correctly that you clone, and then simply run "ant"? Then
> >
> > I'd expect no need to update any hashes (the correct dependencies should be
> >
> > downloaded). Do you have an example where you had to change the hash?
> >
> > Thanks,
> >
> > Jan
> >
> > > On Fri, Jun 15, 2018 at 1:42 PM, Josh Juneau juneau001@gmail.com wrote:
> > >
> > > I am able to obtain and build the latest Apache NetBeans incubator sources
> > >
> > > and build, but not without first modifying the MD5 sums within a number of
> > >
> > > the binaries-list files to match those that are "expected". Is there a
> > >
> > > reason that these MD5 sums are not up-to-date if one attempts to build from
> > >
> > > the latest in the incubator?
> > >
> > > I'm going to write a short blog post on how to build from scratch, and I
> > >
> > > wanted to cover how to modify the MD5 sums to get the build to work
> > >
> > > correctly. However, this is a workaround and I'd rather not propagate a
> > >
> > > workaround if I don't have to do so. It also may bring security questions
> > >
> > > into the fold, and I don't want to go down that path.
> > >
> > > Thanks for your time, and great work on NetBeans 9.0!
> > >
> > > Josh Juneau
> > >
> > > juneau001@gmail.com
> > >
> > > http://jj-blogger.blogspot.com
> > >
> > > https://www.apress.com/index.php/author/author/view/id/1866
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
For additional commands, e-mail: dev-help@netbeans.incubator.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: NetBeans Build and the binaries-list hash
Posted by Emilian Bold <em...@protonmail.ch.INVALID>.
> looking at the url for maven central I was wondering if we should use https?
That would only accomplish making the download more private (ie the ISP wouldn't see you downloading this JAR) but since we check the hash there's no way to tamper the bits.
--emi
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On 16 June 2018 1:16 AM, Sven Reimers <sv...@gmail.com> wrote:
> Hi all,
>
> looking at the url for maven central I was wondering if we should use https?
>
> -Sven
>
> Jan Lahoda lahoda@gmail.com schrieb am Fr., 15. Juni 2018, 22:11:
>
> > Hi,
> >
> > Thanks for the information. I suspect this may be caused by a local build
> >
> > of HTML4J, which installs the artifacts into the local .m2 storage, and
> >
> > these are then picked up by the NB build. I think I have an idea how to fix
> >
> > that, need to try it.
> >
> > Jan
> >
> > On Fri, Jun 15, 2018 at 6:10 PM, Josh Juneau juneau001@gmail.com wrote:
> >
> > > Thanks for the responses on this issue. Indeed, it is a bad idea to
> > >
> > > modify hashes...that is my reason for starting this thread.
> > >
> > > It sounds like there is an issue with my local maven repository. I will
> > >
> > > start by troubleshooting there to see if I can repair. Thanks for
> > >
> > > checking
> > >
> > > the jar file to troubleshoot the issue.
> > >
> > > I appreciate your time and responses.
> > >
> > > Josh Juneau
> > >
> > > juneau001@gmail.com
> > >
> > > http://jj-blogger.blogspot.com
> > >
> > > https://www.apress.com/index.php/author/author/view/id/1866
> > >
> > > > On Jun 15, 2018, at 11:03 AM, Matthias Bläsing <
> > > >
> > > > mblaesing@doppel-helix.eu> wrote:
> > > >
> > > > Hi Josh,
> > > >
> > > > Am Freitag, den 15.06.2018, 10:41 -0500 schrieb Josh Juneau:
> > > >
> > > > > Thanks for the responses. Yes, after I clone, I simply run ant. I
> > > > >
> > > > > just performed a new clone to test the issue again, and here is
> > > > >
> > > > > example of the hash update:
> > > > >
> > > > > Download of B9BBF5BF22E1B8603F312F6E02ABC6267996B38A-
> > > > >
> > > > > net.java.html.boot.fx-1.5.1.jar produced content with hash
> > > > >
> > > > > BA6D811096540A6AA8C50131D9839F24BA130798 when
> > > > >
> > > > > B9BBF5BF22E1B8603F312F6E02ABC6267996B38A was expected
> > > > >
> > > > > In this case, I'd have to modify the binaries-list has to the
> > > > >
> > > > > expected hash and re-run the build. This occurs about 10 times, and
> > > > >
> > > > > then the build will complete successfully.
> > > > >
> > > > > If we are asking users to build from source, then I'd think that this
> > > > >
> > > > > manual hash update requirement should not be occurring.
> > > > >
> > > > > Thanks for your time and assistance...it is appreciated.
> > > >
> > > > this looks as if your local maven repository has broken artifacts. For
> > > >
> > > > your sample the full entry in the binaries list is:
> > > >
> > > > 9BBF5BF22E1B8603F312F6E02ABC6267996B38A org.netbeans.html:net.java.
> > > >
> > > > html.boot.fx:1.5.1
> > > >
> > > > From the syntax the download tasks deduces, that it is a maven
> > > >
> > > > coordinate and tries to download the artifact from maven central. This
> > > >
> > > > leads here:
> > > >
> > > > http://repo1.maven.org/maven2/org/netbeans/html/net.java.
> > > >
> > > > html.boot.fx/1.5.1/
> > > >
> > > > as no qualifier is specified, the unqualified jar is downloaded:
> > > >
> > > > http://repo1.maven.org/maven2/org/netbeans/html/net.java.
> > > >
> > > > html.boot.fx/1.5.1/net.java.html.boot.fx-1.5.1.jar
> > > >
> > > > I checked the jar:
> > > >
> > > > matthias@athena:~$ wget repo1.maven.org/maven2/org/
> > > >
> > > > netbeans/html/net.java.html.boot.fx/1.5.1/net.java.html.boot.fx-1.5.1.jar
> > > >
> > > > --2018-06-15 18:00:00-- http://repo1.maven.org/maven2/
> > > >
> > > > org/netbeans/html/net.java.html.boot.fx/1.5.1/net.java.
> > > >
> > > > html.boot.fx-1.5.1.jar
> > > >
> > > > Auflösen des Hostnamens repo1.maven.org (repo1.maven.org)…
> > > >
> > > > 151.101.112.209
> > > >
> > > > Verbindungsaufbau zu repo1.maven.org (repo1.maven.org
> > > >
> > > > )|151.101.112.209|:80
> > > >
> > > > … verbunden.
> > >
> > > > HTTP-Anforderung gesendet, auf Antwort wird gewartet … 200 OK
> > > >
> > > > Länge: 80886 (79K) [application/java-archive]
> > > >
> > > > Wird in »net.java.html.boot.fx-1.5.1.jar« gespeichert.
> > > >
> > > > net.java.html.boot.fx-1.5.1.jar 100%[=========================
> > > >
> > > > =================================================>] 78,99K --.-KB/s
> > > >
> > > > in 0,05s
> > > >
> > > > 2018-06-15 18:00:00 (1,63 MB/s) - »net.java.html.boot.fx-1.5.1.jar«
> > > >
> > > > gespeichert [80886/80886]
> > > >
> > > > matthias@athena:~$ sha1sum net.java.html.boot.fx-1.5.1.jar
> > > >
> > > > b9bbf5bf22e1b8603f312f6e02abc6267996b38a net.java.html.boot.fx-1.5.1.
> > > >
> > > > jar
> > > >
> > > > matthias@athena:~$
> > > >
> > > > Ignoring casing, this agrees with my assessment.
> > > >
> > > > HTH
> > > >
> > > > Matthias
> > > >
> > > > To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
> > > >
> > > > For additional commands, e-mail:
> > > >
> > > > dev-help@netbeans.incubator.apache.org
> > >
> > > > For further information about the NetBeans mailing lists, visit:
> > > >
> > > > https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
For additional commands, e-mail: dev-help@netbeans.incubator.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: NetBeans Build and the binaries-list hash
Posted by Sven Reimers <sv...@gmail.com>.
Hi all,
looking at the url for maven central I was wondering if we should use https?
-Sven
Jan Lahoda <la...@gmail.com> schrieb am Fr., 15. Juni 2018, 22:11:
> Hi,
>
> Thanks for the information. I suspect this may be caused by a local build
> of HTML4J, which installs the artifacts into the local .m2 storage, and
> these are then picked up by the NB build. I think I have an idea how to fix
> that, need to try it.
>
> Jan
>
>
> On Fri, Jun 15, 2018 at 6:10 PM, Josh Juneau <ju...@gmail.com> wrote:
>
> > Thanks for the responses on this issue. Indeed, it is a bad idea to
> > modify hashes...that is my reason for starting this thread.
> >
> > It sounds like there is an issue with my local maven repository. I will
> > start by troubleshooting there to see if I can repair. Thanks for
> checking
> > the jar file to troubleshoot the issue.
> >
> > I appreciate your time and responses.
> >
> > Josh Juneau
> > juneau001@gmail.com
> > http://jj-blogger.blogspot.com
> > https://www.apress.com/index.php/author/author/view/id/1866
> >
> > > On Jun 15, 2018, at 11:03 AM, Matthias Bläsing <
> > mblaesing@doppel-helix.eu> wrote:
> > >
> > > Hi Josh,
> > >
> > > Am Freitag, den 15.06.2018, 10:41 -0500 schrieb Josh Juneau:
> > >> Thanks for the responses. Yes, after I clone, I simply run ant. I
> > >> just performed a new clone to test the issue again, and here is
> > >> example of the hash update:
> > >>
> > >> Download of B9BBF5BF22E1B8603F312F6E02ABC6267996B38A-
> > >> net.java.html.boot.fx-1.5.1.jar produced content with hash
> > >> BA6D811096540A6AA8C50131D9839F24BA130798 when
> > >> B9BBF5BF22E1B8603F312F6E02ABC6267996B38A was expected
> > >>
> > >> In this case, I'd have to modify the binaries-list has to the
> > >> expected hash and re-run the build. This occurs about 10 times, and
> > >> then the build will complete successfully.
> > >>
> > >> If we are asking users to build from source, then I'd think that this
> > >> manual hash update requirement should not be occurring.
> > >>
> > >> Thanks for your time and assistance...it is appreciated.
> > >
> > > this looks as if your local maven repository has broken artifacts. For
> > > your sample the full entry in the binaries list is:
> > >
> > > 9BBF5BF22E1B8603F312F6E02ABC6267996B38A org.netbeans.html:net.java.
> > html.boot.fx:1.5.1
> > >
> > > From the syntax the download tasks deduces, that it is a maven
> > > coordinate and tries to download the artifact from maven central. This
> > > leads here:
> > >
> > > http://repo1.maven.org/maven2/org/netbeans/html/net.java.
> > html.boot.fx/1.5.1/
> > >
> > > as no qualifier is specified, the unqualified jar is downloaded:
> > >
> > > http://repo1.maven.org/maven2/org/netbeans/html/net.java.
> > html.boot.fx/1.5.1/net.java.html.boot.fx-1.5.1.jar
> > >
> > > I checked the jar:
> > >
> > > matthias@athena:~$ wget repo1.maven.org/maven2/org/
> > netbeans/html/net.java.html.boot.fx/1.5.1/net.java.html.boot.fx-1.5.1.jar
> > > --2018-06-15 18:00:00-- http://repo1.maven.org/maven2/
> > org/netbeans/html/net.java.html.boot.fx/1.5.1/net.java.
> > html.boot.fx-1.5.1.jar
> > > Auflösen des Hostnamens repo1.maven.org (repo1.maven.org)…
> > 151.101.112.209
> > > Verbindungsaufbau zu repo1.maven.org (repo1.maven.org
> )|151.101.112.209|:80
> > … verbunden.
> > > HTTP-Anforderung gesendet, auf Antwort wird gewartet … 200 OK
> > > Länge: 80886 (79K) [application/java-archive]
> > > Wird in »net.java.html.boot.fx-1.5.1.jar« gespeichert.
> > >
> > > net.java.html.boot.fx-1.5.1.jar 100%[=========================
> > =================================================>] 78,99K --.-KB/s
> > in 0,05s
> > >
> > > 2018-06-15 18:00:00 (1,63 MB/s) - »net.java.html.boot.fx-1.5.1.jar«
> > gespeichert [80886/80886]
> > >
> > > matthias@athena:~$ sha1sum net.java.html.boot.fx-1.5.1.jar
> > > b9bbf5bf22e1b8603f312f6e02abc6267996b38a net.java.html.boot.fx-1.5.1.
> > jar
> > > matthias@athena:~$
> > >
> > >
> > > Ignoring casing, this agrees with my assessment.
> > >
> > >
> > > HTH
> > >
> > > Matthias
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
> > > For additional commands, e-mail:
> dev-help@netbeans.incubator.apache.org
> > >
> > > For further information about the NetBeans mailing lists, visit:
> > > https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
> > >
> > >
> > >
> >
>
Re: NetBeans Build and the binaries-list hash
Posted by Jan Lahoda <la...@gmail.com>.
Hi,
Thanks for the information. I suspect this may be caused by a local build
of HTML4J, which installs the artifacts into the local .m2 storage, and
these are then picked up by the NB build. I think I have an idea how to fix
that, need to try it.
Jan
On Fri, Jun 15, 2018 at 6:10 PM, Josh Juneau <ju...@gmail.com> wrote:
> Thanks for the responses on this issue. Indeed, it is a bad idea to
> modify hashes...that is my reason for starting this thread.
>
> It sounds like there is an issue with my local maven repository. I will
> start by troubleshooting there to see if I can repair. Thanks for checking
> the jar file to troubleshoot the issue.
>
> I appreciate your time and responses.
>
> Josh Juneau
> juneau001@gmail.com
> http://jj-blogger.blogspot.com
> https://www.apress.com/index.php/author/author/view/id/1866
>
> > On Jun 15, 2018, at 11:03 AM, Matthias Bläsing <
> mblaesing@doppel-helix.eu> wrote:
> >
> > Hi Josh,
> >
> > Am Freitag, den 15.06.2018, 10:41 -0500 schrieb Josh Juneau:
> >> Thanks for the responses. Yes, after I clone, I simply run ant. I
> >> just performed a new clone to test the issue again, and here is
> >> example of the hash update:
> >>
> >> Download of B9BBF5BF22E1B8603F312F6E02ABC6267996B38A-
> >> net.java.html.boot.fx-1.5.1.jar produced content with hash
> >> BA6D811096540A6AA8C50131D9839F24BA130798 when
> >> B9BBF5BF22E1B8603F312F6E02ABC6267996B38A was expected
> >>
> >> In this case, I'd have to modify the binaries-list has to the
> >> expected hash and re-run the build. This occurs about 10 times, and
> >> then the build will complete successfully.
> >>
> >> If we are asking users to build from source, then I'd think that this
> >> manual hash update requirement should not be occurring.
> >>
> >> Thanks for your time and assistance...it is appreciated.
> >
> > this looks as if your local maven repository has broken artifacts. For
> > your sample the full entry in the binaries list is:
> >
> > 9BBF5BF22E1B8603F312F6E02ABC6267996B38A org.netbeans.html:net.java.
> html.boot.fx:1.5.1
> >
> > From the syntax the download tasks deduces, that it is a maven
> > coordinate and tries to download the artifact from maven central. This
> > leads here:
> >
> > http://repo1.maven.org/maven2/org/netbeans/html/net.java.
> html.boot.fx/1.5.1/
> >
> > as no qualifier is specified, the unqualified jar is downloaded:
> >
> > http://repo1.maven.org/maven2/org/netbeans/html/net.java.
> html.boot.fx/1.5.1/net.java.html.boot.fx-1.5.1.jar
> >
> > I checked the jar:
> >
> > matthias@athena:~$ wget repo1.maven.org/maven2/org/
> netbeans/html/net.java.html.boot.fx/1.5.1/net.java.html.boot.fx-1.5.1.jar
> > --2018-06-15 18:00:00-- http://repo1.maven.org/maven2/
> org/netbeans/html/net.java.html.boot.fx/1.5.1/net.java.
> html.boot.fx-1.5.1.jar
> > Auflösen des Hostnamens repo1.maven.org (repo1.maven.org)…
> 151.101.112.209
> > Verbindungsaufbau zu repo1.maven.org (repo1.maven.org)|151.101.112.209|:80
> … verbunden.
> > HTTP-Anforderung gesendet, auf Antwort wird gewartet … 200 OK
> > Länge: 80886 (79K) [application/java-archive]
> > Wird in »net.java.html.boot.fx-1.5.1.jar« gespeichert.
> >
> > net.java.html.boot.fx-1.5.1.jar 100%[=========================
> =================================================>] 78,99K --.-KB/s
> in 0,05s
> >
> > 2018-06-15 18:00:00 (1,63 MB/s) - »net.java.html.boot.fx-1.5.1.jar«
> gespeichert [80886/80886]
> >
> > matthias@athena:~$ sha1sum net.java.html.boot.fx-1.5.1.jar
> > b9bbf5bf22e1b8603f312f6e02abc6267996b38a net.java.html.boot.fx-1.5.1.
> jar
> > matthias@athena:~$
> >
> >
> > Ignoring casing, this agrees with my assessment.
> >
> >
> > HTH
> >
> > Matthias
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
> > For additional commands, e-mail: dev-help@netbeans.incubator.apache.org
> >
> > For further information about the NetBeans mailing lists, visit:
> > https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
> >
> >
> >
>
Re: NetBeans Build and the binaries-list hash
Posted by Josh Juneau <ju...@gmail.com>.
Thanks for the responses on this issue. Indeed, it is a bad idea to modify hashes...that is my reason for starting this thread.
It sounds like there is an issue with my local maven repository. I will start by troubleshooting there to see if I can repair. Thanks for checking the jar file to troubleshoot the issue.
I appreciate your time and responses.
Josh Juneau
juneau001@gmail.com
http://jj-blogger.blogspot.com
https://www.apress.com/index.php/author/author/view/id/1866
> On Jun 15, 2018, at 11:03 AM, Matthias Bläsing <mb...@doppel-helix.eu> wrote:
>
> Hi Josh,
>
> Am Freitag, den 15.06.2018, 10:41 -0500 schrieb Josh Juneau:
>> Thanks for the responses. Yes, after I clone, I simply run ant. I
>> just performed a new clone to test the issue again, and here is
>> example of the hash update:
>>
>> Download of B9BBF5BF22E1B8603F312F6E02ABC6267996B38A-
>> net.java.html.boot.fx-1.5.1.jar produced content with hash
>> BA6D811096540A6AA8C50131D9839F24BA130798 when
>> B9BBF5BF22E1B8603F312F6E02ABC6267996B38A was expected
>>
>> In this case, I'd have to modify the binaries-list has to the
>> expected hash and re-run the build. This occurs about 10 times, and
>> then the build will complete successfully.
>>
>> If we are asking users to build from source, then I'd think that this
>> manual hash update requirement should not be occurring.
>>
>> Thanks for your time and assistance...it is appreciated.
>
> this looks as if your local maven repository has broken artifacts. For
> your sample the full entry in the binaries list is:
>
> 9BBF5BF22E1B8603F312F6E02ABC6267996B38A org.netbeans.html:net.java.html.boot.fx:1.5.1
>
> From the syntax the download tasks deduces, that it is a maven
> coordinate and tries to download the artifact from maven central. This
> leads here:
>
> http://repo1.maven.org/maven2/org/netbeans/html/net.java.html.boot.fx/1.5.1/
>
> as no qualifier is specified, the unqualified jar is downloaded:
>
> http://repo1.maven.org/maven2/org/netbeans/html/net.java.html.boot.fx/1.5.1/net.java.html.boot.fx-1.5.1.jar
>
> I checked the jar:
>
> matthias@athena:~$ wget repo1.maven.org/maven2/org/netbeans/html/net.java.html.boot.fx/1.5.1/net.java.html.boot.fx-1.5.1.jar
> --2018-06-15 18:00:00-- http://repo1.maven.org/maven2/org/netbeans/html/net.java.html.boot.fx/1.5.1/net.java.html.boot.fx-1.5.1.jar
> Auflösen des Hostnamens repo1.maven.org (repo1.maven.org)… 151.101.112.209
> Verbindungsaufbau zu repo1.maven.org (repo1.maven.org)|151.101.112.209|:80 … verbunden.
> HTTP-Anforderung gesendet, auf Antwort wird gewartet … 200 OK
> Länge: 80886 (79K) [application/java-archive]
> Wird in »net.java.html.boot.fx-1.5.1.jar« gespeichert.
>
> net.java.html.boot.fx-1.5.1.jar 100%[==========================================================================>] 78,99K --.-KB/s in 0,05s
>
> 2018-06-15 18:00:00 (1,63 MB/s) - »net.java.html.boot.fx-1.5.1.jar« gespeichert [80886/80886]
>
> matthias@athena:~$ sha1sum net.java.html.boot.fx-1.5.1.jar
> b9bbf5bf22e1b8603f312f6e02abc6267996b38a net.java.html.boot.fx-1.5.1.jar
> matthias@athena:~$
>
>
> Ignoring casing, this agrees with my assessment.
>
>
> HTH
>
> Matthias
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
> For additional commands, e-mail: dev-help@netbeans.incubator.apache.org
>
> For further information about the NetBeans mailing lists, visit:
> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>
>
>
Re: NetBeans Build and the binaries-list hash
Posted by Matthias Bläsing <mb...@doppel-helix.eu>.
Hi Josh,
Am Freitag, den 15.06.2018, 10:41 -0500 schrieb Josh Juneau:
> Thanks for the responses. Yes, after I clone, I simply run ant. I
> just performed a new clone to test the issue again, and here is
> example of the hash update:
>
> Download of B9BBF5BF22E1B8603F312F6E02ABC6267996B38A-
> net.java.html.boot.fx-1.5.1.jar produced content with hash
> BA6D811096540A6AA8C50131D9839F24BA130798 when
> B9BBF5BF22E1B8603F312F6E02ABC6267996B38A was expected
>
> In this case, I'd have to modify the binaries-list has to the
> expected hash and re-run the build. This occurs about 10 times, and
> then the build will complete successfully.
>
> If we are asking users to build from source, then I'd think that this
> manual hash update requirement should not be occurring.
>
> Thanks for your time and assistance...it is appreciated.
this looks as if your local maven repository has broken artifacts. For
your sample the full entry in the binaries list is:
9BBF5BF22E1B8603F312F6E02ABC6267996B38A org.netbeans.html:net.java.html.boot.fx:1.5.1
From the syntax the download tasks deduces, that it is a maven
coordinate and tries to download the artifact from maven central. This
leads here:
http://repo1.maven.org/maven2/org/netbeans/html/net.java.html.boot.fx/1.5.1/
as no qualifier is specified, the unqualified jar is downloaded:
http://repo1.maven.org/maven2/org/netbeans/html/net.java.html.boot.fx/1.5.1/net.java.html.boot.fx-1.5.1.jar
I checked the jar:
matthias@athena:~$ wget repo1.maven.org/maven2/org/netbeans/html/net.java.html.boot.fx/1.5.1/net.java.html.boot.fx-1.5.1.jar
--2018-06-15 18:00:00-- http://repo1.maven.org/maven2/org/netbeans/html/net.java.html.boot.fx/1.5.1/net.java.html.boot.fx-1.5.1.jar
Auflösen des Hostnamens repo1.maven.org (repo1.maven.org)… 151.101.112.209
Verbindungsaufbau zu repo1.maven.org (repo1.maven.org)|151.101.112.209|:80 … verbunden.
HTTP-Anforderung gesendet, auf Antwort wird gewartet … 200 OK
Länge: 80886 (79K) [application/java-archive]
Wird in »net.java.html.boot.fx-1.5.1.jar« gespeichert.
net.java.html.boot.fx-1.5.1.jar 100%[==========================================================================>] 78,99K --.-KB/s in 0,05s
2018-06-15 18:00:00 (1,63 MB/s) - »net.java.html.boot.fx-1.5.1.jar« gespeichert [80886/80886]
matthias@athena:~$ sha1sum net.java.html.boot.fx-1.5.1.jar
b9bbf5bf22e1b8603f312f6e02abc6267996b38a net.java.html.boot.fx-1.5.1.jar
matthias@athena:~$
Ignoring casing, this agrees with my assessment.
HTH
Matthias
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
For additional commands, e-mail: dev-help@netbeans.incubator.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: NetBeans Build and the binaries-list hash
Posted by Josh Juneau <ju...@gmail.com>.
Hi Jan and Emilian,
Thanks for the responses. Yes, after I clone, I simply run ant. I just performed a new clone to test the issue again, and here is example of the hash update:
Download of B9BBF5BF22E1B8603F312F6E02ABC6267996B38A-net.java.html.boot.fx-1.5.1.jar produced content with hash BA6D811096540A6AA8C50131D9839F24BA130798 when B9BBF5BF22E1B8603F312F6E02ABC6267996B38A was expected
In this case, I'd have to modify the binaries-list has to the expected hash and re-run the build. This occurs about 10 times, and then the build will complete successfully.
If we are asking users to build from source, then I'd think that this manual hash update requirement should not be occurring.
Thanks for your time and assistance...it is appreciated.
Josh Juneau
juneau001@gmail.com
http://jj-blogger.blogspot.com
https://www.apress.com/index.php/author/author/view/id/1866
> On Jun 15, 2018, at 9:40 AM, Jan Lahoda <la...@gmail.com> wrote:
>
> Hi Josh,
>
> Do I understand correctly that you clone, and then simply run "ant"? Then
> I'd expect no need to update any hashes (the correct dependencies should be
> downloaded). Do you have an example where you had to change the hash?
>
> Thanks,
> Jan
>
>
>> On Fri, Jun 15, 2018 at 1:42 PM, Josh Juneau <ju...@gmail.com> wrote:
>>
>> I am able to obtain and build the latest Apache NetBeans incubator sources
>> and build, but not without first modifying the MD5 sums within a number of
>> the binaries-list files to match those that are "expected". Is there a
>> reason that these MD5 sums are not up-to-date if one attempts to build from
>> the latest in the incubator?
>>
>> I'm going to write a short blog post on how to build from scratch, and I
>> wanted to cover how to modify the MD5 sums to get the build to work
>> correctly. However, this is a workaround and I'd rather not propagate a
>> workaround if I don't have to do so. It also may bring security questions
>> into the fold, and I don't want to go down that path.
>>
>> Thanks for your time, and great work on NetBeans 9.0!
>>
>> Josh Juneau
>> juneau001@gmail.com
>> http://jj-blogger.blogspot.com
>> https://www.apress.com/index.php/author/author/view/id/1866
Re: NetBeans Build and the binaries-list hash
Posted by Jan Lahoda <la...@gmail.com>.
Hi Josh,
Do I understand correctly that you clone, and then simply run "ant"? Then
I'd expect no need to update any hashes (the correct dependencies should be
downloaded). Do you have an example where you had to change the hash?
Thanks,
Jan
On Fri, Jun 15, 2018 at 1:42 PM, Josh Juneau <ju...@gmail.com> wrote:
> I am able to obtain and build the latest Apache NetBeans incubator sources
> and build, but not without first modifying the MD5 sums within a number of
> the binaries-list files to match those that are "expected". Is there a
> reason that these MD5 sums are not up-to-date if one attempts to build from
> the latest in the incubator?
>
> I'm going to write a short blog post on how to build from scratch, and I
> wanted to cover how to modify the MD5 sums to get the build to work
> correctly. However, this is a workaround and I'd rather not propagate a
> workaround if I don't have to do so. It also may bring security questions
> into the fold, and I don't want to go down that path.
>
> Thanks for your time, and great work on NetBeans 9.0!
>
> Josh Juneau
> juneau001@gmail.com
> http://jj-blogger.blogspot.com
> https://www.apress.com/index.php/author/author/view/id/1866
Re: NetBeans Build and the binaries-list hash
Posted by Emilian Bold <em...@protonmail.ch.INVALID>.
See https://nextbeans.com/reproducible.html
Our builds are not reproducible.
--emi
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On 15 June 2018 2:42 PM, Josh Juneau <ju...@gmail.com> wrote:
> I am able to obtain and build the latest Apache NetBeans incubator sources and build, but not without first modifying the MD5 sums within a number of the binaries-list files to match those that are "expected". Is there a reason that these MD5 sums are not up-to-date if one attempts to build from the latest in the incubator?
>
> I'm going to write a short blog post on how to build from scratch, and I wanted to cover how to modify the MD5 sums to get the build to work correctly. However, this is a workaround and I'd rather not propagate a workaround if I don't have to do so. It also may bring security questions into the fold, and I don't want to go down that path.
>
> Thanks for your time, and great work on NetBeans 9.0!
>
> Josh Juneau
>
> juneau001@gmail.com
>
> http://jj-blogger.blogspot.com
>
> https://www.apress.com/index.php/author/author/view/id/1866
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.incubator.apache.org
For additional commands, e-mail: dev-help@netbeans.incubator.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists